Privacy policy
Last updated September 26, 2026
This policy explains what information Kovo: BOGO & Tiered Discounts (“Kovo”, “we”, “us”) collects when a Shopify merchant installs and uses the app, how we use it, and the choices available. Kovo is operated by Nicholas Alessi.
Our role
For information about a merchant's own account and store, we are the controller. For information about a merchant's customers and orders, the merchant is the controller and we process it only on the merchant's behalf and instructions, to provide the app. Merchants are responsible for telling their customers how their data is used, for example in their store's privacy policy.
Information we collect
When you install the app
- Your store's myshopify.com domain and the permissions (scopes) you grant.
- An access token Shopify issues so the app can act for your store. It is tied to the store, not to a staff member; we do not store staff names or email addresses.
- Your current Kovo plan, as reported by Shopify.
What you create in the app
- Discounts and their settings: titles, codes (including generated single-use codes), values, schedules, targeting, and customer eligibility rules (customer tags and metafield names and values you choose).
- Storefront settings such as the progress bar's appearance and text.
Order information
To report how discounts perform, the app reads orders from Shopify when they are created, updated or refunded, and when you sync the last 60 days of orders. For each order it stores only:
- the order ID, order number, date, currency, subtotal, total and cancelled status;
- which of the app's discounts or codes were used and the amount discounted;
- refund amounts; and
- the numeric Shopify customer ID, if the order has a customer.
We do not store customer names, email addresses, phone numbers, postal addresses, payment details, or the products in an order.
On your storefront and at checkout
When a signed-in shopper views your store, Shopify adds that shopper's customer tags and the customer metafield values used in your eligibility rules to the page, so the progress bar and discount picker show only offers the shopper qualifies for. This happens in the shopper's browser; it is not sent to or stored on our servers. At checkout, the app's discount function runs on Shopify's servers and reads the same tags and values to decide whether a discount applies; we do not receive them. The app does not set cookies or track shoppers across sites.
Technical information
Our hosting provider keeps short-lived server logs of requests (such as IP address, time and URL). If the app hits an error, an error report (the error, the page or request involved, the store domain and browser type) is sent to our error monitoring provider. Error reports are configured not to include IP addresses or cookies.
How we use information
- To run the app: create and update discounts in Shopify, show offers on your storefront, and show your analytics.
- To check your plan and unlock the features it includes.
- To keep the app secure and working, and to fix problems.
- To respond when you contact us.
We do not sell or rent information, use it for advertising, or combine it with data from other merchants. Where GDPR applies, we rely on performance of our contract with the merchant and our legitimate interest in running a secure, reliable service.
Who we share it with
Only with the service providers that run the app, under agreements that require them to protect it:
| Provider | Purpose | Location |
|---|---|---|
| Shopify | App platform: installs, billing, discounts, and the order data the app reads | Canada / global |
| Render | Hosts the app's web server | United States |
| Neon | Database (encrypted at rest with AES-256) | United States |
| Sentry | Error and performance monitoring | United States |
We may also disclose information if the law requires it. Because these providers are in the United States, information may be processed outside your country; where required we rely on the providers' standard contractual clauses.
How long we keep it
Order-level information is deleted 24 months after the order. When you uninstall the app, the store's access token is deleted immediately and everything else 48 hours later. See our data retention policy for the details.
Security
- All connections to and from the app use TLS encryption.
- The database is encrypted at rest with AES-256, including backups.
- The app requests only the Shopify permissions it needs, and verifies every webhook Shopify sends.
- Access to production systems is limited to the people who operate the app.
Your rights
Merchants can ask us to access, correct or delete information about their store by emailing support.kovo@gmail.com, or delete it all by uninstalling the app. Customers of a store should contact that store: when a merchant receives a customer's access or deletion request, Shopify forwards it to us and we act on it (for deletion, we remove the customer ID from our records). Depending on where you live, you may also have the right to object to processing or to complain to your data protection authority.
Children
The app is for businesses and is not directed at children.
Changes
If we change this policy, we will update the date above, and tell merchants in the app or by email about significant changes.
Contact
Kovo · support.kovo@gmail.com