Privacy policy

Last updated: October 27, 2026

This policy explains how Nope: Fraud & Bot Blocker (the "App") collects, uses and protects personal data. The App is operated by Freshify LLC, 4405 Jager Dr NE Ste C4-4498, Rio Rancho, NM 87144, United States ("Freshify", "we", "us").

Who this policy covers

• Merchants: Shopify stores that install the App, and the store staff who use it.
• Customers and visitors: people who visit or buy from a merchant's store where the App is installed.

For customer and visitor data, the merchant decides why the data is processed, and we process it for the merchant to provide the App. Under data protection laws such as the GDPR, the merchant is the controller and Freshify is the processor. For merchant account data, Freshify is the controller.

Customers and visitors who want to exercise their rights should contact the merchant first. We help merchants answer those requests.

Data we collect

From merchants

• Store details from Shopify: store domain, store name, owner name and email, plan, country, currency and time zone.
• The settings, rules, lists and notification choices the merchant saves in the App.
• Shopify user IDs of staff who view personal data in the App, recorded in an access log. Their IP address is recorded only as a one-way hash.
• Subscription status. Shopify handles all payments, and we never receive card details.

From customers and visitors, for the merchant

The storefront script and checkout features collect, depending on the features the merchant enables:

• Network and device data: IP address, user agent, browser, operating system, device type, the browser's time zone, and whether the browser is controlled by an automation tool.
• Data derived from the IP address: approximate country, region and city, network operator, and whether the address belongs to a VPN, Tor exit node or data center. We work this out on our own servers from public data: internet registries, routing tables, address ranges published by cloud providers, the Tor exit list, and the DB-IP "IP to City Lite" database (IP Geolocation by DB-IP, licensed under CC BY 4.0). Shopper IP addresses are not sent to any third party for these checks.
• Browsing data: pages visited on the store, referrer, time of each visit, and a random session ID created for each browser tab.
• Order data: order and customer IDs, email address, billing and shipping country, the buyer's IP address, and risk signals about the order.
• Checkout data: name, email, phone number and shipping or billing address, when the merchant's checkout rules use them. Shopify evaluates these rules inside its own checkout.
• Security decisions: whether a visit or checkout was allowed, observed or blocked, which rule applied, and why.

How we use the data

We use personal data only to provide the App:

• detect and block bots, fraud, abuse and unwanted traffic, following the merchant's rules;
• show the merchant visitor, order and security reports and alerts;
• send the notification emails the merchant turns on;
• run billing through Shopify, provide support, and keep the App secure;
• meet legal obligations.

We do not sell personal data. We do not use it for advertising, and we do not build profiles across stores. Each merchant's data is kept separate from other merchants' data.

The App can make automated decisions, such as blocking a visit or a checkout, based on rules that the merchant controls. Merchants can review each decision and can always allow a blocked visitor.

Where the GDPR applies, the merchant's legal basis is usually its legitimate interest in protecting its store and customers against fraud and abuse. For merchant account data, our legal basis is the performance of our contract with the merchant and our legitimate interest in operating and securing the App.

How we protect the data

• IP addresses, user agents and list values are encrypted at rest. Emails, phone numbers and other identifiers used for matching are stored as keyed one-way hashes.
• The App shows only masked IP addresses and identities.
• All traffic is encrypted in transit with TLS.
• Every read of personal data in the App is logged.
• Access to production servers is restricted to the operator, through key-based SSH from a single allowlisted address.
• We follow a written security incident response policy. If an incident affects personal data, we notify Shopify and the affected merchants without undue delay.

How long we keep the data

When a merchant uninstalls the App, we revoke our access right away and delete the store's data 48 hours later. Shopify's privacy requests are applied as follows:

• Shop deletion request: deletes all the store's data right away.
• Customer deletion request: deletes the data linked to that customer.
• Customer data request: we prepare a file of the data we hold about that customer and make it available to the merchant.

Who we share data with

We use these service providers (subprocessors) to run the App:

Each provider receives only the data it needs. We may also disclose data when the law requires it, or to protect the rights and safety of merchants, customers or the App.

International transfers

Freshify is based in the United States, and our providers are located in the countries listed above. When personal data from the European Economic Area, the United Kingdom or Switzerland is transferred to a country without an adequacy decision, we rely on safeguards recognized by the applicable law, such as Standard Contractual Clauses.

Browser storage

The storefront script does not set cookies. It uses the browser's storage for the following:

• A random session ID: kept in session storage, for the current tab only.
• The security decision for each page: kept in session storage for about two minutes, so that the check does not run again on every page.
• The store owner's bypass link: kept in local storage, and only when the store owner opens that link.

Your rights

Depending on where you live, you may have the right to:

• access, correct or delete your personal data;

• restrict or object to its processing;

• receive a copy of it;

• withdraw your consent;

• complain to a data protection authority.

• Customers and visitors: contact the merchant whose store you visited. We help the merchant answer your request.

• Merchants: contact us at the address below.

We answer within 30 days.

Children

The App is not directed to children, and we do not knowingly collect children's personal data.

Changes to this policy

We may update this policy. If the changes are significant, we notify merchants by email or in the App before they take effect. The date at the top shows the latest version.

Contact

Freshify LLC, 4405 Jager Dr NE Ste C4-4498, Rio Rancho, NM 87144, United States Email: [email protected]