Privacy Policy

This Privacy Policy describes how Decision Trees Inc ("Shopvibe", "we", "us") handles personal information when Shopify merchants install our app, listed on the Shopify App Store as "Spam Bot Cleanup ‑ Shopvibe". If anything here is unclear, email [email protected].

1. Overview

Shopvibe is a service for Shopify merchants. It finds fake customer accounts and card-testing orders created by bots and, only when the merchant approves, cleans them up. Two groups of people are involved:

• Merchants — Shopify store owners and staff who install and use Shopvibe.
• The store's customers — the customer accounts and orders in the merchant's store that Shopvibe checks. Most accounts Shopvibe flags were created by bots, but any new account or recent order in the store may be checked.

For the store's customer data, the merchant is the controller and Shopvibe is the processor: we act only on the merchant's instructions, which are the checks they turn on and the cleanups they approve. For merchant account data, Shopvibe is the controller. On request, we will enter into a data processing agreement with you.

2. What we read and keep

2.1 From merchants

• Your Shopify store domain, and the store owner's name and email as provided by Shopify.
• Your plan and billing status. Billing is handled by Shopify; we never see card numbers.
• Your settings, such as which checks are turned on.
• Communications you send to support.

2.2 What we read from the store, through the Shopify API

• To check new customer accounts: name, email address, when the account was created, how many orders it has, its tags, and its email and SMS marketing consent.
• To check recent orders (Launch plan, when card-testing watch is on): order number, total, payment results (including card security code and billing address check results), Shopify's risk assessment, the IP address the order was placed from, and fulfillment status.
• During an approved cleanup only: the account's phone number, to see whether it has SMS marketing consent so it can be unsubscribed. Scans never read it, and it is never stored.

Accounts and orders that are checked but not flagged are not stored.

2.3 What we keep for flagged accounts and orders

• The Shopify ID, the display name, and a masked email such as j•••@example.com.
• For orders, the order number, total and currency.
• The reasons it was flagged, for example "Same name as 13 other new accounts" or "3 failed payment attempts".
• The tags and marketing consent it had before cleanup, so the cleanup can be undone.
• A cleanup log of what Shopvibe changed in Shopify and when.

We do not store full email addresses, phone numbers, postal addresses, payment details, or IP addresses.

2.4 Automatically

• Service logs (timestamps, IP address, user agent, request path), kept for security and debugging.

3. How we use it

• Detect bot activity: check new accounts and recent orders for bot patterns, and group the ones that match into cleanup batches with the reasons each was flagged.
• Clean up when you approve: tag accounts and unsubscribe them from email and SMS marketing; on a second approval, delete them; and cancel card-testing orders as fraud with a refund and restock.
• Undo: restore the tags and marketing consent an account had before cleanup.
• Billing & support: manage your plan and answer your questions.
• Security & legal compliance: protect the service, respond to lawful requests, and enforce our Terms.

Automated decisions. Detection is automated, but nothing changes in Shopify until the merchant approves it. Every account is re-checked just before cleanup, merchants can mark any record "Not a bot" to keep it out of the cleanup and future checks, and customers who have placed an order are never flagged.

We never sell personal information, use a store's customer data for advertising, or combine customer data from different stores.

4. Sharing & subprocessors

We share data only with:

• Subprocessors we use to run the service (listed below).
• Shopify, through the APIs you have authorized, to make the changes you approve.
• Authorities, when compelled by valid legal process. We notify the merchant unless legally prohibited.
• An acquirer, in the event of a merger or acquisition, subject to this policy.

5. Data retention

• Flagged accounts and orders: removed 180 days after they were last decided, for example approved, undone, deleted, or marked not a bot. Accounts that are still cleaned up are kept while the cleanup can be undone or the account deleted.
• Deleted accounts: only the Shopify ID stays in the cleanup log.
• Cleanup log: one year.
• Uninstalling: removes everything Shopvibe stored for your store.
• Redaction requests: when Shopify sends a customer redaction request, we delete that customer's records, including their orders' records and cleanup log entries.
• Service logs: 30 days.

6. Your rights

Depending on where you live, you may have the right to:

• Access the personal information we hold about you.
• Correct or update inaccurate information.
• Delete your information ("right to be forgotten").
• Port your data to another service.
• Object to or restrict certain processing.
• Lodge a complaint with your local data protection authority.

If you are a customer of a store that uses Shopvibe, please contact that store, because it is the controller of your data. Shopify passes customer data and deletion requests to us, and we help the store respond. To exercise your rights against Shopvibe directly, email [email protected]. We respond within 30 days.

7. Security

• Data is encrypted in transit (HTTPS) between Shopify, Shopvibe and your browser.
• We copy the minimum data needed: masked emails rather than full addresses, and no phone numbers, addresses or payment details.
• Shopify's privacy webhooks are verified before we act on them.
• If we confirm a breach that affects your data, we notify you within 72 hours.

8. International transfers

Shopvibe is operated from Canada and hosted in the United States. When personal information from the EU, UK or elsewhere is transferred to these countries, we rely on the safeguards the law provides, such as the EU Standard Contractual Clauses and the UK Addendum.

9. Cookies & similar technologies

Shopvibe adds nothing to your storefront and sets no cookies on your customers' devices. Inside Shopify Admin, the app uses strictly necessary cookies and Shopify session tokens to keep you signed in and to protect forms; they are not used for tracking. This website, shopvibe.app, does not set cookies.

10. Children

Shopvibe is not directed at children under 16, and we do not knowingly collect their personal information. Merchants are responsible for ensuring their stores comply with applicable child-protection laws.

11. Changes to this policy

If we make material changes, we'll email merchant administrators at least 30 days before they take effect, and we'll update the "Last updated" date at the top of this page.

12. Contact

Privacy questions and data requests:
Decision Trees Inc · Vancouver, BC, Canada
Email: [email protected]