Privacy Policy

1The short version

The rest of this document is the enforceable version of those five sentences.

2Who we are, and who is responsible for what

The controller

This policy is issued by the developer of KOL Bio AI (“the app”, “we”, “us”), an independent Shopify app. We are the data controller for the personal data described in this policy, except where we tell you otherwise below. [If you operate through a registered company, name it here with its registration place; otherwise keep the product-name form — but do not invent registration details.]

Privacy questions and data-subject requests go to [email protected]. We have not appointed a data protection officer; the mailbox is the single route and is answered by the people who build the app.

The split that actually matters

KOL Bio AI is a Shopify app. That puts us in two different roles at once, and the difference changes who you should complain to:

3What we collect

3.1 Data you give us

• Creator profiles: name, platform account (handle or profile URL), follower count, avatar and notes — whatever you choose to record.
• Landing page content: title, copy, block configuration, product picks, discount settings, footer and support details; templates you save from a page.
• AI inputs: the one-sentence brief for a generated page, an edit instruction, or a description of the visual style you want.
• Support content: the messages and screenshots you send us.

3.2 Data we read through the Shopify API

Only the scopes you approve at install. In practice that means:

We do not request customer profiles, contact details, or payment data of any kind. We never see card numbers: checkout is executed by Shopify on your storefront, so payment data flows between your customer, Shopify and their payment provider without touching our servers.

3.3 Data collected when a page runs

• Landing-page events: page identifier, time, device type and operating-system category, referrer and UTM parameters, plus a randomly generated visitor ID and session ID — attributed to the page and campaign, never to a named individual. See §7.
• Operations logs: for AI calls we record the provider, model name, status code and elapsed time. Never the submitted prompt, page content or model output.

3.4 What we deliberately never collect

4How we use data, and our legal basis

Where GDPR and UK GDPR apply, these are our purposes and the basis for each:

We do not send marketing e-mails, and we do not use personal data for advertising. Under CCPA/CPRA we collect the categories in §3 for the business purposes listed above, and we do not sell or share them for cross-context behavioural advertising as those terms are defined in California. See §16 for the notice at collection.

Automated decision-making and profiling

We do not make decisions producing legal or similarly significant effects on any individual based solely on automated processing. We do not profile your customers, and we do not use models to build profiles or target ads. We do generate text and layout automatically from your inputs — that is the product — but a human (you) reviews and publishes it, and the output is about products and campaigns, not about people.

5AI generation and your prompts

This is the section merchants ask us about most, so it is explicit.

What we send to a model provider

The AI features are optional and run only when you actively click them: generating a page from a description, editing a page with a one-line instruction, and generating a visual style template. Each request contains only the text needed for that one generation — the brief or edit instruction you entered, the store name, the creator’s name if you provided one, the current copy of a page being edited, and any style preference.

Routing is set at deployment. OpenRouter is currently the primary route (it may forward a request to the upstream provider that actually serves the model), and a domestic route such as Alibaba Cloud Model Studio (Beijing, China) can be configured as a fallback. The providers actually used are those configured at deployment time; the primary provider is based outside mainland China, so submitted text may be transferred across borders for processing. Prompts never include buyer names, emails, phone numbers, addresses, order data, landing-page visitor IDs or cookies, and we never send image or video files, access tokens or API keys.

Because the input is written by you, any personal information you choose to type into a brief is sent with the request — please do not enter personal or sensitive data into AI input fields.

Training

• We do not train our own models on merchant data, and we do not ask providers to use it for model training or human labelling. Providers may retain request records briefly for billing, security auditing and abuse detection under their own policies, so their retention period is governed by their privacy policies.
• Our application logs record only the provider, model name, status code and elapsed time — never the submitted prompt, page content or model output.
• If you do not use the AI features, or no model route is configured, the same functions are handled by a built-in rules engine and nothing is sent to a provider.

Retention of prompts and outputs

We do not keep a prompt archive. Generated output is stored only as part of your landing page or template in the app’s database, and is edited and deleted together with it — under §10 and the uninstall behaviour there. You can skip the AI features entirely, or contact [email protected] about using a domestic route if you prefer your data not to leave the country.

Your duties as the publisher

6Cookies and tracking we place

This marketing website sets no cookies

The site you are reading is a set of static pages. It sets no cookies, runs no analytics, loads no advertising or social-media pixels, and makes no third-party origin requests. There is nothing to consent to, which is why there is no consent banner here.

No third-party requests from this website

This site loads everything — styles, scripts, icons and fonts — from our own origin. Fonts are self-hosted rather than pulled from a font CDN, which is a deliberate privacy choice: a third-party font request would hand each visitor’s IP address and browsing context to that provider on every page view, without the visitor ever seeing a banner. Because nothing here calls a tracker, this page sets no non-essential cookies and requires no consent interface to be accurate about what it does.

Inside the app

KOL Bio AI runs embedded inside your Shopify admin, so signing in and request protection are handled by Shopify’s own session in that context. Language and layout preferences are stored server-side against your store, not in cookies on your browser. We set no advertising cookies and do no cross-site tracking anywhere in the product.

Do Not Track and Global Privacy Control

There are no optional cookies on this site to opt out of. We do not sell or share personal data for cross-context behavioural advertising, so a Global Privacy Control signal (Sec-GPC: 1) is satisfied by default — we treat GPC as a valid opt-out under CCPA/CPRA.

7Tracking on the pages you publish — read this if you are a merchant

Pages generated by KOL Bio AI are served from your store domain (yourstore.com/a/kol/…, through Shopify’s App Proxy) to your prospective customers. Legally, that makes you the controller for those visitors, not us.

What we place by default

• Two first-party cookies: lp_vid (visitor ID, valid for one year) and lp_sid (session ID, sliding 30-minute expiry). Both store a random token — never a name, email or phone number, and they are not linked to any Shopify buyer account. They let a visit, an add-to-cart and a later order be attributed to the same anonymous session and the right creator link.
• Server-side event records: page identifier, time, device type and operating-system category, referrer and UTM parameters, and views, clicks, add-to-cart and checkout events. We store the OS category only — never the full browser (User-Agent) string, and never the IP address.
• Add-to-cart and checkout actions write the landing page identifier into your store’s cart attributes; once an order is created it comes back through Shopify’s order webhook so the order can be attributed to the page.

What only appears if you add it

• Meta Pixel, TikTok Pixel, Google tags or any third-party script you choose to embed on the page. The app places no pixels on its own.

We will not add tracking to your pages that you have not enabled, and we do not use data collected on your pages to market anyone else’s products to your customers. Device and system data is used only for aggregate reporting — not for ad targeting, individual profiling or cross-store identification.

8Who we share data with

We disclose data in five situations, and no others:

1. Service providers (sub-processors). Companies doing work for us under contract — hosting and, when you use them, AI model providers, listed below.
2. Shopify Inc. As required to operate the app: OAuth, App Proxy calls that render pages under your store domain, billing records, and the data you choose to write back to your store.
3. The creators you work with, if you share a page link or report with them.
4. Legal and safety. Regulators, courts or law enforcement where we have a lawful obligation, or to defend our rights. We challenge overreach and tell you unless legally barred.
5. A corporate transaction. If we merge or are acquired, data may transfer — with a notice to you and the receiving party bound to this policy.

Sub-processor list — current as of 2026-11-10

Media you upload (avatars, images, videos) goes from your browser directly to your store’s Shopify Files (CDN). It is not relayed through or stored by our servers. Beyond the processors above, we do not share data with other third parties.

Our Data Processing Addendum

For merchant data we process as a processor, the DPA at Terms §12 — Data Processing governs: our documented instructions, confidentiality, security measures, sub-processor flow-down, assistance with data subject requests, breach notification, deletion or return on exit. Using the app after the effective date means the DPA applies between us.

9International transfers

Store data lives in the single deployment that serves your store [state the server region here before publishing]. Where a transfer outside the EEA or UK is unavoidable — Shopify’s infrastructure, a non-EU AI model provider, support access — we rely on one of:

• European Commission adequacy regulations, including the EU–US and UK–US Data Privacy Framework where the recipient is certified;
• the EU Standard Contractual Clauses (Module 2 controller-to-processor, Module 3 processor-to-processor), with the UK Addendum or IDTA where relevant, plus a documented transfer risk assessment;
• the Swiss addendum for Swiss data, where applicable.

You may request a copy of the relevant transfer mechanism via [email protected]. Because the primary AI route is based outside mainland China, text you submit to the AI features may be transferred across borders for processing (§5); a domestic route can be configured instead. We do not claim sector-specific transfer filings we have not made — if you need one for your market, ask us and we will tell you exactly what applies.

10How long we keep it

Merchant data is stored for as long as the app is installed. Uninstalling invalidates the shop session immediately; pages stop resolving, preview links and the generated sitemap go dead, and nothing stays reachable or indexed. Reinstalling within 48 hours finds your data where you left it. After that, Shopify’s shop-data-erasure request runs and the store’s creators, landing pages, templates, visitor events and order attribution are permanently deleted — it cannot be undone.

Buyer-name-level data is never stored at all, so there is nothing to purge there: order attribution keeps number, amount, currency, status and note attributes only. If you want a specific creator or page removed earlier, delete it in the app or e-mail [email protected]. Export before you uninstall: the Settings page downloads every landing page as a single JSON file — content, selected products, creators and publish state, no customer data — on every plan.

11Your rights and choices

Whichever law applies to you, we honour the set below. Most are self-serve in the app; the rest go to [email protected] and get answered within one month, extendable by two for complex requests.

How to make a request

1. Self-serve first: the app’s Settings downloads every landing page — content, products, creators, publish state — as a single JSON file, and individual creators, pages and templates delete in place.
2. Otherwise e-mail [email protected] with “data request” in the subject.
3. We verify identity proportionately — usually the store domain you write from. We will not require a government ID for a routine request.
4. We answer within 30 days (one month under GDPR). No fee unless a request is manifestly unfounded or excessive. Requests raised by your buyers arrive through Shopify’s compliance webhooks; see the next heading.

If you are one of your merchant’s customers

Your data on a KOL Bio AI–rendered landing page belongs to the merchant who published it. Send your request to that merchant; if it comes to us instead, we will route it to them and, where instructed, act on their behalf — we cannot answer for a company you have no relationship with. Note that we never stored your name, email, phone, address or IP in the first place: visitor events keep only anonymous random identifiers (§7).

Complaints

You can escalate to your supervisory authority at any time: in the EU to the data protection authority of your member state, in the UK to the Information Commissioner’s Office, in California to the California Privacy Protection Agency. [If you incorporate and have an EU lead authority, name it here; otherwise delete this sentence — do not claim one you don’t have.] We would like a chance to fix it first — one reply to the address in §15 usually does it.

12Security

Measures we maintain, at minimum:

• Transport: HTTPS everywhere; the admin embeds inside Shopify’s own authenticated context.
• Isolation: every query is scoped to one store; your data is never mixed into another merchant’s page or report.
• Secrets: Shopify access tokens are kept per store, scoped to the minimum listed in §3.2, rotated on reinstall and revoked on uninstall.
• Content safety: AI style generation designs a visual spec from a whitelist only — it never writes CSS or scripts, and pages render through fixed components, so generated content cannot inject code into your pages.
• Media: uploads go browser → your store’s Shopify Files CDN; our servers neither relay nor store your files.
• Abuse controls: rate limiting on generation and proxy endpoints, crawler traffic filtered from counts.
• Logging: operations logs keep status and timing, never prompts, page content or visitor identities.

We are a small independent app and do not claim certifications we have not completed (no SOC 2, no ISO 27001). We would rather say that plainly than imply an audit that does not exist. Security reports are welcome at [email protected] — a human reads them.

No method of transmission or storage is perfectly secure. If a breach affecting personal data occurs, we notify the supervisory authority within 72 hours where required, notify affected merchants without undue delay with what we know and what we are doing, and never use a breach as a marketing pause on our obligations.

13Children and age limits

KOL Bio AI is a business tool for merchants and agencies. It is not directed at children, and we do not knowingly collect data from anyone under 16 (or 18 where your local law sets higher). Creators referenced by the tool are professionals in a commercial relationship with the merchant, not users of the app. If we learn we hold a child’s data, we delete it. If you believe a minor’s data reached us, write to the address in §15.

14Changes to this policy

We update this policy when our data practices change, not to surprise you — the app’s own legal text is versioned with the product. Material changes are announced in the app, and this page’s version and “last updated” date always show what is current. Continued use after the effective date accepts the revision. If a change would expand what we collect about your customers, we will make it a switch you control rather than a fait accompli.

15Contact and complaints

One mailbox, read by the people who build the app. Include your store domain when the request concerns a store, so we can find the right data without a round trip. [If you operate through a registered company, add its postal address here; otherwise leave this row out.]

16California Notice at Collection

Provided under Cal. Civ. Code §§1798.100 et seq. as amended by the CPRA. Categories collected in the last 12 months, the purposes, and the retention period for each:

We do not use or disclose sensitive personal information for purposes that trigger a limitation right, and we do not keep personal information longer than reasonably necessary for the purposes above. Because we neither sell nor share personal information, there is no “Do Not Sell or Share My Personal Information” link to click — the honest answer under CCPA/CPRA is that the sale/share does not happen, and we honour GPC as a matter of policy. To exercise any California right, use §11. We will not discriminate against you for exercising any privacy right.