Privacy policy

Kesherly pop-ups for Shopify · Last updated 6 November 2026

This policy explains what the Kesherly Shopify app ("the app", "we") does with data when a store installs it. The app shows small pop-ups on the store with real store activity: recent purchases, low stock, how many people are viewing, product views and cart adds. Questions: support@kesherly.net.

Who is responsible

The store that installs the app (the "merchant") decides to use it and is the controller of its customers' data. We process that data only on the merchant's behalf and only to provide the app. Installing and using the app is the merchant's agreement to this policy and to our terms of service, which together form our data processing agreement with the merchant.

What we keep, and why

We do not collect or store buyers' or visitors' email addresses, phone numbers, full addresses, payment details or order totals. We do not identify visitors: no visitor ids, no cookies of ours, no tracking across sites. The pop-up script remembers only within the visitor's own browser whether it already counted that visit and whether the visitor closed a pop-up.

What we never do

• We never sell or rent data, and never use it for advertising, profiling or to train AI models.
• We never show one store's data on another store. Each store's pop-ups read only that store's data, and Shopify signs every request with the store's address so this cannot be faked.
• We never write to the store: the app only reads orders, products and stock (the "write_app_proxy" permission only lets the pop-up use the address /apps/kesherly on the store).
• We never invent activity: a pop-up shows only real numbers, and nothing below the minimum the merchant chose.

Where data is stored, and who helps us

• Supabase (database and server functions) — data is encrypted at rest and every connection uses TLS (HTTPS).
• Netlify — hosts the app's settings page; it does not store store or shopper data.
• Shopify — the platform the app runs on, under Shopify's own terms.

Only the app's operator has access to the database. Access to the app's data, settings changes, installs, uninstalls and privacy requests are recorded in an access log.

Privacy requests from shoppers

Shoppers make privacy requests to the store. Shopify passes them to us automatically, and we act on them:

• Data request — the only personal data we may hold about a shopper is their first name and city on recent orders; the store can obtain it from us at support@kesherly.net.
• Erasure request — we erase that shopper's first name and city from our records.
• After uninstall — Shopify asks us to erase the store's data 48 hours after uninstall; we then erase every buyer detail and the store's access tokens.

Security incidents

If personal data is ever exposed, we will contain it, investigate it, and tell the affected merchants within 72 hours of finding out: what happened, which data, and what we did.

Changes

If this policy changes in a way that matters, we will update the date above and tell merchants inside the app.

Contact

support@kesherly.net