Which permissions does AzLytics use, and why?
| Permission | What AzLytics uses it for | How often | What AzLytics stores |
|---|---|---|---|
| accounts:read | Name the connected account | At connect | Account id and name, while connected |
| metrics:read | Find the AzLytics metrics and Klaviyo’s own browse, cart and checkout metrics | Daily | Metric id and name |
| flows:read | Flow list (name, status, trigger) and the revenue of AzLytics-triggered flows | Daily | Flow id, name, status and trigger metric; revenue per flow and day (last 30 days) |
| campaigns:read | Campaign names and audiences, and campaign revenue (every campaign of the last 30 days) | Daily | Campaign id, name, status, send time, audience ids (up to 50 a day); revenue and recipients over the last 30 days |
| lists:read | Name the list a campaign was sent to | Daily, only new audiences | List id and name |
| segments:read | Name the segment a campaign was sent to | Daily, only new audiences | Segment id and name |
| profiles:read | Check that a shopper is a known Klaviyo profile before an event is sent | For each possible event | Only a link from the shopper to the Klaviyo profile id |
| events:read | Avoid duplicates: skip a shopper Klaviyo’s own integration already tracked | For each possible event | Nothing |
| events:write | Send the three AzLytics events | Within about a minute of the shopper’s action | A send log (event type, time, result), kept 90 days |
AzLytics stores no profile data, list members, message content or raw API responses.
Flow and campaign revenue need Klaviyo’s “Placed Order” metric, so the Klaviyo account must receive the store’s orders through Klaviyo’s Shopify integration. Without it, AzLytics still reads the newest email campaigns (drafts included): their names, status, send time and audiences, and the names of those lists and segments. Only the revenue figures wait until Placed Order exists.
What does AzLytics send to Klaviyo?
Three events. Rules that apply to every event:
- Profile: an existing Klaviyo profile, by its Klaviyo id only. No email address or phone number is sent, and an event whose content contains anything that looks like an email address is not sent.
- Time: the time of the shopper’s action.
- No duplicates: one unique id per shopper action, so a retry never creates a second event.
- Value: in the store’s currency.
- Properties on every event: IdentityMethod (how the shopper was recognized), AzLyticsTest (true only for a test send), azl_event_type, azl_identity_method, azl_mode, azl_source_session (the AzLytics session id, when known), azl_experiment_period (only while a holdout is being measured).
| Metric in Klaviyo | Value | Properties |
|---|---|---|
| AzLytics Viewed Product | Product price | ProductID, VariantID, SKU, Name, URL, ImageURL, Price, Value, CompareAtPrice, Brand, Categories, InventoryQuantity |
| AzLytics Added to Cart | Cart total | $value, Items (per line: ProductID, VariantID, SKU, ProductName, VariantName, Quantity, ItemPrice, RowTotal, ProductURL, ImageURL), ItemNames, Item Count, AddedItemProductName, AddedItemProductID, AddedItemSKU, AddedItemName, AddedItemVariant, AddedItemImageURL, AddedItemURL, AddedItemPrice, AddedItemQuantity, TopItems (3 newest lines), ItemCount, MoreItemsCount, CheckoutURL, CartURL, CartPageURL, CartSource, Currency |
| AzLytics Started Checkout | Checkout total | $value, $currency_code, $extra (token, checkout_url, responsive_checkout_url, line_items: product id, variant id, title, quantity, price, SKU, vendor, product link and image), Items (product names), Item Count, Discount Codes, Total Discounts, Source Name, Customer Locale, Collections, Unavailable Item Count; plus the AddedItem*, TopItems, ItemCount, MoreItemsCount, CartURL and Currency fields above |
All values come from the store’s catalog and the shopper’s cart or checkout (product names, links, prices, stock). No names, addresses, email addresses, phone numbers or payment details are sent.
How does the data flow?
- On your store: AzLytics’ Shopify web pixel records a product view, an add to cart or a checkout start.
- AzLytics collector (Google Cloud, us-central1) receives it.
- AzLytics server (DigitalOcean, San Francisco) recognizes the shopper (Shopify customer, Klaviyo’s own link or cookie). It checks with profiles:read and events:read whether the shopper is known in Klaviyo and whether Klaviyo already tracked the action.
- Klaviyo receives the AzLytics event (events:write). Your own flows send the emails.
- Once a day, AzLytics reads metrics, flows, campaigns, lists and segments, and shows the names and reported revenue of AzLytics-triggered flows in Recovery Suite → Overview. Campaign names, audiences and revenue are read and stored for reporting.
What happens when I disconnect?
AzLytics → Integrations → Klaviyo → Disconnect: AzLytics revokes its access at Klaviyo and deletes its stored login. Removing the app in Klaviyo also cuts access at once: from then on, AzLytics’s calls are refused.
Stored Klaviyo data (the names and revenue figures above) is deleted with the store 30 days after AzLytics is uninstalled from your Shopify store. The send log is deleted after 90 days.
How is the connection kept secure?
Klaviyo tokens are stored encrypted (AES-256) and never shown in the interface. All traffic uses HTTPS.
More questions?
Read the privacy policy or email hello@azlytics.io.