Privacy Policy

1Who We Are

Store Shield ("we", "us", "our") is a Shopify application that provides real-time bot detection and blocking for Shopify merchants. This Privacy Policy applies to the Store Shield application available on the Shopify App Store and our website at storeshield.in.

For any privacy-related questions, you can contact us at team@storeshield.in.

2Information We Collect

We collect the minimum information necessary to provide the Store Shield bot blocking service. Here is what we access:

Information from your Shopify store:

• Store metadata — your store's name, domain, and Shopify plan (to configure protection correctly)
• Shopify access token — an OAuth token granted by Shopify, used to integrate with your storefront and Shopify Admin API
• Subscription information — your current plan tier and billing status (managed through Shopify's billing API)

Visitor traffic data processed by the app:

• IP addresses — each visitor's IP address is analyzed in real time against threat intelligence databases to determine if it belongs to a known bot or malicious actor
• Request metadata — HTTP headers, user-agent strings, request frequency, and behavioral signals used for bot fingerprinting
• Geolocation data — country-level location inferred from IP address, used for reporting purposes
• Bot classification results — whether a given visit was classified as a bot, what type, and whether it was blocked or allowed

Information you provide directly:

• Whitelist rules — any custom IP addresses or user-agent strings you configure in the whitelist settings
• Support communications — any messages or emails you send to our support team

Automatically collected information:

• Usage data — feature usage patterns and in-app actions used to improve the product
• Log data — server-side logs, access times, and error logs for debugging and security purposes

We do not collect or store your customers' personal information (names, emails, payment details). We process visitor IP addresses solely for the purpose of bot detection and they are not sold or shared with third parties for marketing purposes.

3How We Use Your Information

We use the information collected solely to deliver and improve the Store Shield service:

• Real-time bot detection — analyzing each visitor request against behavioral signals and IP intelligence databases to identify bots
• Automatic blocking — blocking requests identified as malicious bots before they interact with your storefront
• Whitelist enforcement — ensuring trusted crawlers (Googlebot, Bingbot) and your custom whitelisted IPs are never blocked
• Dashboard & reporting — aggregating blocked and allowed traffic data so you can review bot activity in your Store Shield dashboard
• Billing & subscriptions — processing your subscription through Shopify's billing API (we do not handle payment card data directly)
• Product improvement — aggregated, anonymised analytics to understand which features are most valuable and to improve detection accuracy
• Customer support — responding to your inquiries and resolving issues
• Security & fraud prevention — detecting and preventing unauthorized access or misuse of the Store Shield service itself

4Data Sharing & Third Parties

We do not sell your data. We share information only in the following limited circumstances:

• IP reputation providers — visitor IP addresses are checked against third-party threat intelligence databases (e.g., AbuseIPDB, MaxMind) to classify bots. These providers do not receive any of your store data beyond the IP address being queried.
• Shopify — as a Shopify app, we operate within the Shopify partner ecosystem. Shopify has access to your store data as governed by the Shopify Privacy Policy.
• Infrastructure providers — we use cloud hosting and database providers (e.g., AWS, Cloudflare) to operate the service. These providers process data only on our behalf and under strict data processing agreements.
• Legal compliance — we may disclose information if required by law, court order, or governmental authority, or to protect our rights, property, or the safety of our users.

We do not share IP address data or visitor traffic logs with advertisers, data brokers, or marketing platforms.

5Data Retention

We retain data for the following periods:

• Bot traffic logs — retained for 30 days on the Pro plan and 7 days on the Starter plan. Logs older than this are automatically purged. Enterprise plan retains logs indefinitely.
• Store configuration data — retained for as long as you have Store Shield installed. Deleted within 30 days of app uninstallation.
• Support communications — retained for up to 2 years to support ongoing customer relationships.
• Anonymised analytics — may be retained indefinitely in aggregated, non-identifiable form for product improvement purposes.

When you uninstall Store Shield, we will delete your store's data from our systems within 30 days, except where retention is required by law or for legitimate business purposes (e.g., fraud prevention).

6Security

We take data security seriously and implement industry-standard measures to protect your information:

• All data in transit is encrypted using TLS 1.2 or higher
• Data at rest is encrypted using AES-256
• Access to production systems is restricted and requires multi-factor authentication
• We conduct regular security reviews and vulnerability assessments
• Shopify OAuth tokens are stored securely and never logged in plaintext

No method of transmission over the internet or electronic storage is 100% secure. While we strive to use commercially acceptable means to protect your data, we cannot guarantee its absolute security. If you become aware of any security vulnerability or breach, please contact us immediately at team@storeshield.in.

7Your Rights

Depending on your location, you may have the following rights regarding your personal data:

• Access — request a copy of the personal data we hold about you or your store
• Correction — request correction of any inaccurate or incomplete data
• Deletion — request deletion of your data (subject to legal retention requirements)
• Portability — request your data in a machine-readable format
• Objection — object to certain processing activities, including profiling
• Restriction — request that we restrict processing of your data in certain circumstances

To exercise any of these rights, please contact us at team@storeshield.in. We will respond to your request within 30 days.

Note: Store Shield processes visitor IP addresses on behalf of the merchant (you). If you are a visitor to a store using Store Shield and wish to exercise data rights, please contact that store's owner directly.

8Cookies & Analytics

The Store Shield dashboard and our marketing website may use the following:

• Essential cookies — required for the app to function, including session management and authentication
• Analytics — we may use privacy-respecting analytics tools to understand how our website and app are used. These do not track individual users across third-party websites.

Store Shield itself does not place cookies on your store visitors' browsers. Bot detection is performed server-side using IP and request metadata only.

9Shopify & App Store

Store Shield is distributed through the Shopify App Store and operates as a Shopify Partner app. Our collection and use of information received from Shopify APIs is governed by the Shopify API Terms of Service and Shopify Partner Program Agreement.

We use Shopify's OAuth flow for authentication and Shopify's billing API for subscription management. We do not have access to your customers' payment information.

10Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, we will:

• Update the "Last updated" date at the top of this page
• Notify you via in-app notification or email for significant changes

Your continued use of Store Shield after any changes constitutes your acceptance of the updated Privacy Policy. We encourage you to review this policy periodically.

11Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please reach out: