Privacy policy
Kukis is a Shopify app. Shoppers use it to email themselves a cart, a saved product or a wishlist, and merchants use it to keep a record of the marketing consent those shoppers gave. This page explains what we do with personal data, both as a business and on behalf of the merchants who install the app.
Two different roles
- For shopper data, we are the processor. The merchant whose store you shopped in decides what is collected and why. We act on that merchant's instructions under the data processing agreement below.
- For merchant data, we are the controller. That covers the account details of the shop that installs Kukis, and anyone who contacts us.
If you are a shopper and want your data corrected or deleted, contact the store you bought from. They can action it in Kukis, and Shopify's own privacy requests reach us automatically.
What we process for merchants (shopper data)
| Data | Why | Kept for |
|---|---|---|
| Email address (and a one-way hash of it) | To send the cart, product or wishlist the shopper asked for, and any marketing email they agreed to | Until the merchant deletes it or the retention windows below elapse |
| Consent records: the exact wording shown, its version and language, the date and time, the page it happened on, and the cookie choice at that moment | Proof that consent was given or refused (GDPR Art. 7) | 1,095 days by default, set by the merchant |
| Cart contents, saved products, wishlist items | To put them in the email and on the wishlist page | 90 days by default, set by the merchant |
| IP address and browser user agent | Fraud and abuse limits, and as part of the consent record. Stored shortened (the last part of the IP removed) | 90 days by default |
| Email delivery events: sent, delivered, bounced, complained, clicked | To show the merchant whether their email arrived | 365 days by default |
| Shopify customer ID and marketing status, only if the merchant switches on Shopify customer sync | To keep the shopper's marketing choice in step with the merchant's Shopify customer record | For as long as sync is on |
Kukis sets no tracking, analytics or advertising cookies. It sets one
strictly necessary cookie, cc_wishlist_id, and only when a shopper
uses the wishlist, so their list can be shown back to them. It lasts one year.
The marketing checkbox is never ticked in advance. If a shopper leaves it unticked, we record that refusal too, because a merchant has to be able to show what was asked and what was answered.
What we process as a business (merchant data)
- Shop domain, store name, the sender name and addresses configured in the app, and the app's settings.
- The Shopify access token for the shop, held so the app can work.
- Billing is handled by Shopify. We never see card details.
- Messages you send us, for example a contact-form message or a support email.
Our lawful basis is the contract with the merchant, and our legitimate interest in running and securing the service.
Who else touches the data
| Provider | What for | Where |
|---|---|---|
| Shopify | The store platform the app runs in | Global, under Shopify's own terms |
| Fly.io | Runs the application | Frankfurt, Germany. Fly.io is a US company operating that region |
| Neon | The database | Frankfurt, Germany |
| Resend | Sends the email | United States |
| Sentry (optional) | Server error reports, with personal data scrubbed | EU region |
The application and its database run in the EU. Email is sent through a US provider, so email content and recipient addresses are processed in the United States under the EU Standard Contractual Clauses. We say this plainly rather than claim that all data stays in the EU, because it does not.
How the data is protected
- Encrypted in transit (HTTPS) and at rest at our hosting providers.
- Unsubscribe and wishlist links are random tokens, stored only as hashes.
- Logs are scrubbed of email addresses, tokens and keys before they are written.
- Access to production systems is limited to the people who need it, each with their own account and two-factor login.
- We keep a written security incident response procedure, and tell affected merchants without undue delay.
Retention and deletion
Merchants choose their own retention windows in the app, within limits of 30 to 2,555 days. When a window elapses, cart contents, IP addresses and user agents are cleared, delivery history is deleted, and consent records are deleted at the end of their own, longer window. Uninstalling the app starts Shopify's 48-hour redaction process, after which the shop's data is erased. If the merchant reinstalls Kukis within those 48 hours, the data is kept.
Your rights
You can ask for access, correction, deletion, restriction, portability, and you can object to processing. Shoppers should ask the store they bought from; merchants can email us directly. You also have the right to complain to your data protection authority. In the Netherlands that is the Autoriteit Persoonsgegevens.
Contact
Kukis — main@kukis.nl
Registered with the Dutch Chamber of Commerce (KvK) under number 42138940
See also the data processing agreement.