Privacy Policy

Who we are

Floq is a Shopify app that helps merchants help shoppers while they are still deciding in their online store. Floq is provided by Shrey Techcorp Pvt Ltd, a company with its registered office at (to be confirmed) (company number (to be confirmed)) ("Floq", "we", "us").

Questions about this policy, your data or a privacy request: privacy@floq.sh. Help with using Floq: support@floq.sh.

Our two roles

Merchants: when you install Floq, we decide how your account information is used, so we are its controller.

Shoppers: when you shop in a store that uses Floq, that store decides how your data is used. Floq processes it for the store and on its instructions, as its processor (or service provider under US state privacy laws). The terms are in our Data Processing Addendum. To use your privacy rights, contact the store; we will help it respond.

(to be confirmed)

What we collect about merchants

• Store details from Shopify: the store's domain and name, currency, time zone, language and plan.
• Staff account details Shopify provides when you open Floq: name, email address, locale and whether you are the store owner.
• Access tokens Shopify issues so Floq can read and act on your store. They are deleted when you uninstall.
• Your settings and choices in Floq: discount limits, which moves Floq may make on its own, notes you add about shoppers or products, and your plan. Shopify handles billing; we never see payment card details.

What we collect about shoppers

Floq receives shopper data from three places: Shopify's customer events (Floq's web pixel), Floq's storefront app embed, and the store's Shopify records. Floq does not receive shoppers' names, email addresses, phone numbers or addresses.

From Shopify's customer events, for each page view, product or collection view, search, cart change and checkout step:

• A pseudonymous identifier derived from Shopify's own browser identifier.
• The page address (including campaign tags such as utm_source and ad click identifiers), page title and referring page.
• Device type, browser, operating system, screen size and a country derived from the browser's language setting.
• Search terms, product titles, prices, quantities and cart totals.
• If the shopper is logged in: their Shopify customer ID and number of past orders.
• When an order is completed: the order ID, totals, currency, discount amount, shipping method, payment gateway name and whether the shopper accepted email or SMS marketing. We never receive card numbers.

Shopify sends these events only when the shopper's privacy choices allow analytics. Floq does not ask for marketing or data-sale permission for them.

From Floq's storefront app embed, when the merchant turns it on: the same pseudonymous identifier (read from Shopify's _shopify_y cookie), the cart contents, the page the shopper is on, and whether they saw, used, copied or dismissed something Floq showed. The embed asks Shopify's Customer Privacy API first: it sends nothing until the shopper's choices allow analytics, and shows offers or personalised help only when they also allow marketing. (to be confirmed)

From the store's Shopify records: customers (ID, tags, number of orders, total spent, marketing consent) and orders (items, totals, dates). Floq uses these to recognise returning customers and to check which purchases happened after Floq stepped in.

Our servers also see the IP address and browser user agent of every request. We use the IP address only to stop abusive traffic (a counter that expires after 60 seconds) and the user agent to filter out automated traffic. We do not store either with shopper records.

Cookies and browser storage

In stores: Floq reads Shopify's _shopify_y cookie so the pixel and the storefront embed recognise the same browser. The web pixel may also set a floq_sid cookie and session storage entry holding the same pseudonymous identifier. The storefront embed keeps small records in the browser's session and local storage, such as which messages a shopper has already seen or dismissed, so it doesn't repeat them.

In the Floq admin: Floq stores your light or dark theme choice in local storage. Floq uses no advertising cookies, and does not sell or share personal data for cross-context behavioural advertising.

(to be confirmed)

How we use data

• To show merchants who is shopping right now, what they are looking at and who may need help.
• To decide when stepping in would help (an answer, real stock information, free shipping or an offer within the merchant's limits), and to show it to the shopper when the merchant approves it or has allowed it.
• To check against Shopify's records which purchases followed, and to learn which moves work in that store.
• To create single-use discount codes in the merchant's Shopify store when an offer is approved.
• To keep Floq secure and reliable: preventing abuse, filtering automated traffic and fixing errors.
• To bill merchants through Shopify and to answer support requests.

Floq does not sell personal data, does not build advertising profiles, and does not use one store's shopper data to serve another store.

Aggregated statistics: to give a new store a sensible starting point, Floq combines counts of which moves were followed by purchases across stores in the same product category. A figure is used only when at least 5 stores and 50 outcomes contribute to it, and it contains no store name, shopper identifier or single store's counts. (to be confirmed)

AI processing

Floq uses AI models in two places. To judge whether stepping in would help, a model receives only a de-identified summary of the visit in labelled ranges. To explain a suggestion to the merchant in one sentence, a language model receives short factual notes about the visit. Neither receives names, contact details, customer or browser identifiers, search terms or campaign names.

Our AI providers process these requests under their business API terms, which do not permit using the data to train their models, and keep it no longer than needed to answer and to detect abuse. (to be confirmed)

Who we share data with

The services below process data for Floq under written terms. We may also disclose data where the law requires it, or to a successor if our business is sold or reorganised, under the same protections.

We list changes to sub-processors here and in the Data Processing Addendum before they apply.

How long we keep data

• Live shopper activity is held in memory and expires about 30 minutes after a shopper's last activity.
• Stored shopper event history is deleted daily once it is older than the store's plan allows: 7 days on Free and 90 days on Pro. A store whose plan Floq can't confirm keeps 90 days.
• Short-lived working records (for example, lookups used to recognise a returning shopper) expire after between 24 hours and 30 days.
• Merchant notes about an anonymous shopper expire after 30 days.
• Data collected by earlier versions of Floq (shopper names, email addresses, phone numbers and chat messages) is deleted by 30 November 2026.
• Customer profiles, recognised identities, records of what Floq did and its outcomes, and merchant settings are kept while the app is installed, unless a deletion request applies sooner. (to be confirmed)

When a merchant uninstalls Floq we immediately delete access tokens and short-lived data, stop storefront processing and revoke API keys, and keep the rest for 48 hours in case of reinstallation. Shopify then sends a shop-deletion request, and we delete everything we hold for that store.

Your rights

Shoppers: depending on where you live, you may have the right to access, correct, delete or move your data, and to object to or restrict processing. Contact the store you shopped with. When a store asks Shopify to delete a customer's data, Shopify tells Floq and we delete that customer's records, including every browser identifier linked to them and their orders. When a customer asks a store for their data, Floq records the request and gives the merchant an export to answer it.

Merchants: you can ask us to access, correct or delete your account data at privacy@floq.sh.

You can complain to your local data protection authority. (to be confirmed)

Security

Data is encrypted in transit. Access tokens are deleted on uninstall, API keys are stored only as hashes, and every Shopify webhook is verified with Shopify's signature before Floq acts on it. No system is perfectly secure: if a breach affects personal data we will notify the affected merchants without undue delay.

International transfers

Floq and its sub-processors process data in the locations listed above, which may be outside the country where the store or the shopper is. (to be confirmed)

Children

Floq is a tool for businesses and is not directed at children. We don't knowingly collect data about children beyond what a store's own shoppers generate.

Changes to this policy

We post changes here and update the date at the top. For material changes we tell merchants in the app or by email before they take effect. See also our Terms of Service and Data Processing Addendum.