Privacy policy

What BotSweep does

BotSweep is a Shopify app that helps merchants detect customer accounts created by bots or spam scripts, and tags, unsubscribes, or deletes them according to the merchant’s settings.

Information we access

When a merchant installs BotSweep, the app accesses through the Shopify Admin API:

• Customer first name, last name, email address, and note
• Customer order count, amount spent, creation date, and email marketing state
• Basic shop information needed to authenticate the app

BotSweep does not access orders, payment details, addresses, or phone numbers.

How we use it

Each customer’s name, email address, and note are sent to our AI processor, TypeSafe AI (Jev model), solely to judge whether the account looks like a bot. TypeSafe returns a probability; the result is used only to apply the merchant’s configured actions. Customer data is never sold, shared for advertising, or used for any other purpose.

What we store

BotSweep stores only the Shopify customer ID, the risk score, the detected pattern, and the actions taken. We do not store customer names, email addresses, or notes — these are fetched live from Shopify when the merchant opens the review queue. To detect waves of bot accounts that reuse the same names, we also store a one-way cryptographic hash of each customer’s full name (it cannot be turned back into the name) with the account creation time, for 30 days. We also store the merchant’s app settings and the Shopify access token needed to operate the app.

Automated decisions

BotSweep makes automated decisions about whether an account looks like a bot. By default it only adds a tag and unsubscribes the account from email marketing; automatic deletion is off unless the merchant turns it on, and customers with orders are never actioned automatically. A customer who believes they were flagged by mistake can contact the store: when the merchant marks the account “Not a bot”, the tags are removed and the account is permanently excluded from further automated checks.

Retention and deletion

• Verdicts for accounts judged to be real customers are deleted after 90 days.
• Name hashes used for bot-wave detection are deleted after 30 days.
• Records of who accessed customer data (access logs) are kept for 365 days, then deleted.
• When Shopify sends a customer redaction request, we delete that customer’s verdict.
• When a merchant uninstalls the app, all shop data is deleted within 48 hours of Shopify’s shop redaction request.

Security

• All data is encrypted in transit (TLS) and at rest (encrypted storage volumes).
• Only BotSweep’s developer has access to production systems, protected by strong passwords and two-factor authentication.
• Every access to customer names or emails is logged (who, when, how many records — never the data itself).
• Security incidents are handled under a written incident response policy, including notifying affected merchants and Shopify without undue delay.

Your rights

Customers of stores using BotSweep can contact the store directly to exercise their privacy rights; the store can then request that we access or delete data through Shopify. Merchants can contact us at rmodi2407@gmail.com. See also our terms of service.