Privacy Policy

Effective Date: March 24, 2026

Introduction

This Privacy Policy explains how Espresso Apps ("we," "us," or "our") collects, uses, stores, shares, and protects information in connection with our Shopify app Kairos (the "Service" or "app").

We are committed to protecting privacy in compliance with applicable laws, including the General Data Protection Regulation (GDPR), the ePrivacy Directive (2002/58/EC) as implemented in EU/EEA member states, the California Consumer Privacy Act (CCPA/CPRA), and other relevant privacy regulations.

This policy applies to two main groups:

Merchants (Shopify store owners) who install the app and use the Service.

End-customers/visitors to merchants' Shopify storefronts where the Service is active.

For merchants: By installing the Service and accepting this policy, you agree to the collection and use of data as described. As a Shopify merchant, your store's data privacy obligations toward visitors — including consent management — are governed through Shopify's Data Privacy platform. You — as the data controller/business — are responsible for ensuring your store's privacy policy discloses the use of third-party apps including ours, and for handling visitor rights requests as the first point of contact.

For visitors: This policy describes our role in processing your data on merchants' sites. The merchant remains primarily responsible for overall processing on their storefront; contact them directly for questions about their specific practices.

Controller Relationship

Merchants who install the Service act as data controllers in respect of their customers' personal data. Espresso Apps acts as a joint controller in respect of visitor data collected under this Service (including browser and network signals and IP addresses), given that we independently determine the purposes and means of retaining and processing that data for our own rule fine-tuning and service security purposes.

Where we act as joint controllers with merchants, we have entered into a joint controllership arrangement pursuant to Article 26 GDPR. The essence of that arrangement is as follows: merchants are primarily responsible for providing transparency to visitors on their storefronts and for handling data subject rights requests as the first point of contact; Espresso Apps is responsible for the security, retention, and deletion of visitor payload data on our own systems.

The full terms of the joint controllership arrangement are available upon request.

Our lead supervisory authority under GDPR is the Datatilsynet (Danish Data Protection Agency), Carl Jacobsens Vej 35, 2500 Valby, Denmark — dt@datatilsynet.dk — www.datatilsynet.dk.

1. Information We Collect

1.1 Merchant Data

The Service automatically collects merchant account information necessary to provide the Service, including store identifiers, configuration settings, and order/customer data shared via the Shopify API (e.g., names, email addresses, billing/shipping details). Payment card details are never collected or stored by us. This data is collected solely for app functionality and stored securely.

1.2 Automated Bot Detection (All Visitors — No Consent Required)

When any session initiates on a merchant's storefront where the Service is active, we perform server-side automated bot detection before any visitor data collection takes place. This processing does not involve any client-side access to terminal device information and does not require ePrivacy consent.

What this involves:

Server-side analysis of the incoming request, including the IP address (automatically transmitted as part of any web request), request headers, behavioral patterns, and request signatures.
Checking the session against known bot signatures, datacenter IP ranges, known malicious IP blocklists, and automated traffic indicators. Integration with Cloudflare Turnstile for network-level bot verification.

Purpose: To identify and block automated scripts (bots) that are not natural persons and therefore have no data privacy rights under GDPR or applicable law. Bots do not have legal standing as data subjects; this processing does not engage data subject rights.

Legal basis: This processing does not engage the ePrivacy Directive (which protects natural persons only) in respect of confirmed bot traffic. For sessions that cannot yet be confirmed as bots — and where the session may therefore involve a natural person — we rely on legitimate interests (Article 6(1)(f) GDPR) for the server-side IP and request-header analysis, given that no terminal device access occurs at this stage and that bot prevention is a recognized legitimate interest under Recital 47 GDPR and Datatilsynet's guidance.

Storage: Where a session is confirmed as bot traffic, minimal session data (IP address, request signature, timestamp, and detection outcome) may be retained for up to 90 days for blocklist maintenance, dispute handling, and rule fine-tuning. No data subject rights apply to confirmed bot session records.

Ambiguous sessions: Where a session cannot be definitively identified as bot or human at the server-side stage, it is treated as potentially involving a natural person, and the full human-visitor protections described below apply.

1.3 Human Visitor Data (Consent Required for EU/EEA Visitors)

Where a session has passed our bot detection checks — meaning we treat the visitor as a legitimate human visitor — and where the visitor has given consent, we collect a limited set of browser and network signals. These signals are collected in the visitor's browser and transmitted to our servers via a network request, where they are stored. Nothing is stored on or in the visitor's device or browser.

What we collect:

IP address
Autonomous System Number (ASN)
Country (derived from IP address)
Browser type and version
User agent string

How these details are used:

The stored details are used solely to apply merchant-defined access rules. For example, a merchant may configure the Service to restrict access from a specific IP address, ASN, or country. Where a visitor's stored details match a merchant-configured rule, access to the storefront or checkout may be restricted. No fraud scoring, behavioral profiling, or inference generation takes place.

ePrivacy and Consent:

The collection of browser and network signals via JavaScript executing in the visitor's browser and their transmission to our servers engages Article 5(3) of the ePrivacy Directive (2002/58/EC), as implemented in Denmark and across EU/EEA member states, which requires prior informed consent before such collection takes place. Consent is managed through Shopify's Data Privacy platform on the merchant's storefront. You may decline consent, in which case no collection under this Section will take place; server-side bot detection will continue to operate independently.

If you have given consent and later wish to withdraw it, you may do so via the consent mechanism on the merchant's storefront. Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal.

Note on Cloudflare Turnstile: Where our integrated Cloudflare Turnstile challenge is triggered as part of bot detection, Cloudflare may independently set cookies or use local storage as part of its verification process. This is governed by Cloudflare's own Privacy Policy.

Retention: We store the collected details for up to 90 days from the date of the visitor's consent. Data is deleted promptly once it is no longer needed, and in any event no later than 90 days after collection.

No data collected under this section is used for advertising, cross-site tracking, marketing, or any purpose unrelated to access control on the installing merchant's store.

2. How We Use Information

We use collected information for the following purposes:

Server-side bot detection and blocking — identifying and blocking automated scripts that are not natural persons, without terminal device access or consent requirements.
Storing browser and network signals for consenting human visitors — retaining IP address, ASN, country, browser type/version, and user agent string on our servers, transmitted via network request from the visitor's browser following consent.
Applying merchant-defined access rules — comparing stored visitor details against merchant-configured rules (e.g., blocked IP addresses, ASNs, or countries) to determine whether access to the storefront or checkout should be restricted. See Section 6 for your rights in relation to automated access restriction decisions.
Post-event dispute handling, including chargeback investigations and order reviews.
Internal fine-tuning of detection rules to improve the security effectiveness of the Service.

We do not use any visitor data for marketing, behavioral profiling, fraud scoring, sale of data, or any purpose unrelated to access control and security on the installing merchant's store.

3. Legal Basis for Processing

3.1 GDPR

Server-side bot detection (Section 1.2): Server-side request analysis (IP address, headers, request signatures) does not constitute terminal device access under the ePrivacy Directive and does not require ePrivacy consent. For sessions not yet confirmed as bots — and therefore potentially involving a natural person — we rely on legitimate interests (Article 6(1)(f) GDPR). Bot and automated traffic prevention are recognized legitimate interests under Recital 47 GDPR, EDPB Guidelines 1/2024, and Datatilsynet's guidance. We have conducted and documented a Legitimate Interests Assessment (LIA) in respect of this processing.

ePrivacy — Client-side browser and network signal collection (Section 1.3): For EU/EEA visitors, we rely on consent (Article 6(1)(a) GDPR and the applicable national ePrivacy implementation) for client-side collection and transmission of browser and network signals. Consent is managed through Shopify's Data Privacy platform.

Substance of human visitor data processing (storage, application of access rules, rule fine-tuning): We and the merchant rely on legitimate interests (Article 6(1)(f) GDPR) for the processing of human visitor data once collection has been lawfully obtained via consent. A documented LIA supports this basis.

Automated access restriction decisions (Article 22 GDPR): Where the application of merchant-defined rules results in a human visitor's access being restricted solely by automated means, we rely on Article 22(2)(a) GDPR (processing necessary for entering into or performing a contract). Appropriate safeguards are in place. See Section 6.

3.2 CCPA/CPRA

Under the CCPA/CPRA, the collection and use of visitor data for access control and transaction security constitutes processing for our business purposes (specifically, security, fraud prevention, and debugging). We do not sell or share personal information as defined under the CCPA/CPRA.

Categories of personal information collected (mapped to CCPA statutory categories):

CCPA Category	Examples Collected
Identifiers	IP address, ASN
Internet or other electronic network activity	Browser type, browser version, user agent string
Geolocation data (derived)	Country derived from IP address

Categories of sources: Server-side from incoming requests (all sessions); transmitted from visitors' browsers to our servers via network request (human visitors who have consented).

Categories of third parties with whom data is shared: Infrastructure providers (Shopify, Supabase, Fly.io, Cloudflare), all bound by security and confidentiality obligations.

Sensitive personal information: To the extent that any data collected constitutes sensitive personal information under the CPRA, we limit our use of such information to purposes permitted under the CPRA and do not use it to infer characteristics about consumers beyond what is necessary for access control purposes.

4. Sharing and Service Providers

We do not sell any personal data. We do not share personal data for cross-context behavioral advertising.

Visitor data may be processed by our infrastructure providers — Shopify, Supabase, Fly.io, and Cloudflare — all bound by security and confidentiality obligations. No other sharing occurs except as required by applicable law.

International Data Transfers

Where personal data is transferred outside the EU/EEA, we ensure that appropriate safeguards are in place in accordance with GDPR Chapter V, including Standard Contractual Clauses (SCCs) as adopted by the European Commission and/or transfers to countries benefiting from an EU adequacy decision. A list of key service providers and applicable transfer mechanisms is available upon request at hello@espressoapps.com.

5. Data Retention and Security

Merchant data is retained while the app is installed and deleted within 48 hours of uninstall or scope revocation.
Bot session records (confirmed automated traffic): IP address, request signature, timestamp, and detection outcome retained for up to 90 days for blocklist maintenance and rule fine-tuning. No data subject rights apply to confirmed bot records.
Human visitor data (IP address, ASN, country, browser type/version, user agent string): retained for a maximum of 90 days from the date of the visitor's consent. Deleted earlier if no longer needed.

We apply industry-standard security measures, including encryption in transit and at rest, strict access controls, and multi-factor authentication, via our trusted infrastructure providers.

6. Automated Access Restriction Decisions

The Service applies merchant-defined rules to stored visitor details to determine whether access to a storefront or checkout should be restricted. These rules are categorical in nature — for example, blocking a specific IP address, ASN, or country — and do not involve behavioral profiling or inference generation.

Where the application of such rules results in access being restricted for a human visitor, and where that decision is made solely by automated means, this may constitute a decision with a similarly significant effect for the purposes of Article 22 GDPR, as it denies the visitor access to a commercial service.

Where Article 22 GDPR applies to an access restriction decision affecting a human visitor, you have the right to:

Request human review of the decision by contacting the relevant merchant. The merchant is the first point of contact for such requests. Espresso Apps will assist merchants in responding where access to stored data on our systems is required.
Express your point of view regarding the decision.
Contest the decision. Merchants are required to make these rights practically available to visitors on their storefronts.

Note on bot block decisions: Automated blocking of confirmed bot sessions does not engage Article 22 GDPR. Bots are not natural persons and have no data subject rights.

7. Your Rights and Choices

Merchants

As a merchant, you have the right to access, correct, and delete your shop and customer data via the app settings or by contacting us at hello@espressoapps.com.

Visitors (Human)

As a human visitor, you have the following rights in respect of your data, to the extent applicable under your jurisdiction:

Withdraw consent for client-side collection and transmission of browser and network signals at any time via the consent mechanism on the merchant's storefront. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.
Access: Request a copy of the personal data we hold about you.
Rectification: Request correction of inaccurate data.
Erasure: Request deletion of your data, subject to our legitimate interests in retaining data for active dispute or chargeback investigations.
Restriction: Request that we restrict processing of your data.
Objection: Object to processing based on legitimate interests. We and the merchant will cease processing unless compelling legitimate grounds exist (e.g., an ongoing dispute or chargeback investigation).
Rights related to automated access restriction decisions: See Section 6 above.
Data portability: Where applicable, request that your data be provided in a structured, commonly used, machine-readable format.

How to exercise your rights: Please contact the merchant in the first instance. You may also contact us directly at hello@espressoapps.com.

For GDPR: If you are unsatisfied with our response, you have the right to lodge a complaint with your local supervisory authority or with our lead supervisory authority: Datatilsynet, Carl Jacobsens Vej 35, 2500 Valby, Denmark — dt@datatilsynet.dk.

For CCPA/CPRA: We do not sell or share personal information. You may submit a request for deletion or to know what data we hold via the merchant or by contacting us directly.

8. Important Notes for Merchants

As a data controller/business operating on Shopify, your store's visitor-facing data privacy and consent obligations are managed through Shopify's Data Privacy platform. You should ensure that your store's privacy policy — maintained through Shopify — discloses the use of third-party apps including Kairos, and specifically the collection and server-side storage of visitor browser and network signals for access control purposes.

You must also:

Handle visitor rights requests — including requests for human review of automated access restriction decisions — in compliance with applicable law, as the first point of contact for such requests.
Enter into the required joint controllership arrangement with us and comply with Shopify's requirements for third-party apps.

Example disclosure wording for your store's privacy policy

To help secure our storefront and manage access, we use Kairos (operated by Espresso Apps). Kairos performs server-side bot detection on all sessions using IP address and request signals — this does not require your consent as it targets automated scripts rather than individual users. Where you have given your consent, Kairos also collects a limited set of browser and network signals — specifically your IP address, ASN, country, browser type and version, and user agent string — which are transmitted to Espresso Apps' servers and stored for up to 90 days. These details may be used to restrict access to our storefront or checkout in accordance with our configured access rules (for example, blocking specific IP addresses, networks, or countries). If your access is restricted by an automated rule, you have the right to request human review of that decision via our customer support team. You may withdraw your consent at any time via the consent mechanism on our storefront. For more information, see the Kairos Privacy Policy.

We are not responsible for your failure to comply with your own legal obligations as a data controller. Contractual disclaimers of liability do not override applicable statutory obligations under GDPR or other privacy laws.

9. Children's Data

The Service is not directed at children under the age of 16 (or the applicable minimum age in the relevant jurisdiction). We do not knowingly collect personal data from children. Merchants whose storefronts are directed at or accessible to children are responsible for ensuring appropriate safeguards are in place and for complying with applicable laws, including COPPA (US) and Article 8 GDPR (EU/EEA).

10. Changes to This Policy

We may update this policy from time to time. Material changes will be communicated to merchants with reasonable advance notice before taking effect. The updated policy will be posted here with a new effective date. For visitors, the current version will always be accessible at this page.

Continued use of the Service by merchants after the effective date of a material change, having received reasonable notice, constitutes acceptance of the updated policy.

11. Contact Information

For any questions about this Privacy Policy, to exercise your rights, or to request information about international transfer mechanisms or our joint controllership arrangement, please contact:

Espresso Apps — hello@espressoapps.com