BotScrub Privacy Policy
Effective date: October 17, 2026 Publisher: Second to None Media LLC ("we", "us"), P.O. Box 590907, Houston, TX 77259, USA Contact: info@secondtononemedia.com
BotScrub: Fake Account Cleanup ("BotScrub" or the "App") helps Shopify merchants find customer accounts that look like bot or spam sign-ups and take reversible clean-up actions on them. This policy explains what data the App accesses, why, how long we keep it, and your choices.
1. Roles
- The merchant that installs the App is the controller of its customers' personal data.
- We act as a processor / service provider for the merchant. We process customer data only to provide the App's features and only on the merchant's instructions, given through the App.
- Customers of a store who have questions about their data should contact that store first. We will help the merchant respond.
2. Data the App accesses through Shopify
When a merchant opens the App, it reads the following through the Shopify Admin API to score accounts:
- Customer profile: first and last name, display name, email address, whether a default address exists, creation date, order count, tags, and notes.
- Marketing consent: email marketing state, opt-in level, and the date it last changed. If the merchant has granted phone access, it also reads SMS marketing state. It does not read the phone number itself.
- Store details: shop domain and the store's time zone.
The scan runs on demand. The scan results are shown to the merchant and are not stored by the App.
3. Data the App stores
| What | Why | Where |
|---|---|---|
| Session data: shop domain, Shopify access token, granted scopes | Lets the App call Shopify for the merchant | Our database |
| Undo log, created only when the merchant applies an action: customer ID, display name, email, tags before the change, tag added, email/SMS marketing state before the change and when it last changed, Klaviyo/Mailchimp sync result and previous Mailchimp status, timestamps, error messages | Shows the merchant what was changed and lets them undo it | Our database |
| Integration settings (optional): the merchant's Klaviyo private API key and/or Mailchimp API key, a short key hint, and the chosen Mailchimp audience ID and name | Syncs clean-up actions to the merchant's own Klaviyo/Mailchimp account | Our database. Keys are encrypted with AES-256-GCM and are never shown again or written to logs. |
| Server logs: request paths, shop domain, timestamps, error messages | Operating and debugging the service | Our hosting provider |
We do not use cookies or trackers for advertising. Shopify's embedded-app framework may use technically necessary session mechanisms.
4. How we use data
- To score customer accounts for bot or spam signals and show the reasons to the merchant.
- To carry out actions the merchant confirms, and to undo them. The actions are: adding a tag, unsubscribing from email/SMS marketing, suppressing the profile in the merchant's Klaviyo account, and archiving the contact in the merchant's Mailchimp audience.
- The App never deletes customers in Shopify, Klaviyo, or Mailchimp.
Automated scoring. The App gives each account a score and explains the reasons. It takes no action on its own. A merchant must review and confirm every action, and every action can be undone. Accounts with orders, accounts the merchant tagged "botscrub-not-a-bot", and accounts older than 90 days are never acted on.
5. Sharing
- We do not sell personal data and do not "share" it for cross-context behavioral advertising.
- Service providers: our application and database are hosted by Railway Corp. in the United States (US East). Railway encrypts data at rest and in transit.
- The merchant's own email platforms: if the merchant connects Klaviyo or Mailchimp, the App sends affected customers' email addresses to the merchant's own account to suppress or archive those contacts. Klaviyo and Mailchimp are the merchant's providers, governed by the merchant's agreements with them.
- Shopify: the App works through Shopify's APIs, governed by Shopify's terms.
- We may disclose information if the law requires it.
6. Retention
- Scan results: not stored.
- Undo log: kept for 12 months so the merchant can review and undo actions, then deleted automatically.
- Session data: deleted when the App is uninstalled.
- When a merchant uninstalls: sessions are deleted right away. All remaining data for the store (undo log, encrypted Klaviyo/Mailchimp keys and settings, plan cache) is deleted when Shopify sends its shop data deletion request (
shop/redact), 48 hours after uninstall. - Customer erasure: when Shopify sends a
customers/redactrequest, we delete that customer's undo-log records. - Server logs: kept for the limited period set by our hosting provider.
7. Privacy requests (GDPR, UK GDPR, CCPA/CPRA and similar laws)
We support Shopify's mandatory privacy webhooks:
customers/data_request: we identify the records we hold about that customer so the merchant can provide them.customers/redact: we delete that customer's records.shop/redact: we delete all data for the store.
Merchants can also email us to access, correct, export, or delete data. We will respond within the time the law requires. California residents have rights to know, delete, and correct their data, and we will not discriminate against anyone for using them. Because we are the merchant's service provider, we will usually pass consumer requests to the relevant merchant.
8. Security
- HTTPS for all traffic.
- Shopify webhooks are checked with HMAC signatures.
- Third-party API keys are encrypted at the application level (AES-256-GCM).
- The hosting provider encrypts the database at rest (AES-256).
- Access to production systems is limited to authorized staff.
No method of transmission or storage is 100% secure. We will notify affected merchants without undue delay if a security incident affects their data.
9. International data
We process data in the United States. By installing the App, merchants direct us to process their customers' data in the US.
10. Children
The App is a business tool for merchants and is not directed at children.
11. Changes
We will post updates here with a new effective date. We will notify merchants of material changes through the App or by email.
12. Contact
Second to None Media LLC, P.O. Box 590907, Houston, TX 77259, USA. Email: info@secondtononemedia.com
See also our Terms of Service, which include our data processing terms.