How Noluco Reaches Shoppers

How Noluco knows who to reach, without knowing who they are.

Noluco never learns a shopper's name or email. It works with claim tickets: random codes that only Klaviyo, Meta or Google can turn back into a person, inside their own systems.

Like a coat check. We hand the cloakroom a ticket number and a note: "this one waited 40 seconds at the shipping counter." The cloakroom knows whose coat it is. We never do.

Shoppers on your email list

Klaviyo

Klaviyo puts a ticket in its email link. When Anna clicks your newsletter, Klaviyo adds a random code like kx-7f3a…. Not her email. Only Klaviyo can look it up.
Anna accepts your cookie banner. If she declines, Noluco stays off for her.
Noluco notices the behavior, not the person: shipping section open for 42 seconds, on a phone.
Noluco hands Klaviyo the ticket and the reason: "ticket kx-7f3a…: shipping question."
Klaviyo looks up its own ticket, sees it's Anna, and adds the reason to her profile.
Your flow sends her the shipping answer. Klaviyo knows it's Anna. Noluco never did.

Shoppers who aren't on your list

Meta and Google

Meta and Google already put their own ticket on your site. Their pixels give every visitor a random code, like fb.1.1790….
The shopper accepts your cookie banner, including marketing cookies.
Noluco notices the behavior: shipping section, 42 seconds.
Noluco hands Meta the ticket and the reason: "ticket fb.1.1790…: shipping question."
Meta matches its own ticket inside Meta and adds that person to your "shipping question" audience. You see "1,840 people", never names.
Your shipping-answer ad reaches them. Meta knows who they are. You and Noluco see a count.

What Noluco stores, and what it never touches

Stores	Never collects
A random visitor number we create	Names, emails, phone numbers, addresses
The tickets Klaviyo, Meta and Google already placed	Anything typed into forms or search
Which sections were read, and for how long	Payment details or checkout fields
Phone or computer, which product	Screen recordings or mouse movements
Checkout steps reached and when (never what was typed)	Anything from shoppers who declined cookies

Logged-in shoppers: Shopify gives us their customer number, not their name. Uninstalling Noluco, or a customer asking to be deleted through Shopify, erases their data automatically.

For your legal team

The tickets are pseudonymous, not anonymous. Under GDPR, a code that its issuer can link back to a person is pseudonymous data. That is why Noluco only runs after cookie consent, should be listed as a processor in your privacy policy, and deletes data on request.

Checkout is closed to apps. Shopify only tells apps which checkout step was reached and when. Noluco never sees the checkout page or anything typed into it.

Nothing spends money without you. Ad campaigns are created paused and only run when you approve them.