K1 PreOrder — Privacy Policy

Effective date: September 21, 2026

Who we are: K1 Apps LLC, 30 N Gould St, STE R, Sheridan, WY 82801, USA ("we", "us", "our").

Contact: support@k1apps.com

This Privacy Policy explains how we collect, use, and protect personal data in connection with the K1 PreOrder Shopify application (the "App"). For the K1 Apps website (k1apps.com), see our Website Privacy Policy.

1) Scope & Roles

Merchant data (Shop data). When you install and use the App, we act as an independent controller for your merchant/account information needed to operate, support, and improve the App (e.g., subscription, App settings, diagnostics).

Store customer data processed via Shopify APIs. When our App reads or writes limited order/product data to run pre‑orders (e.g., tagging orders, reading product/variant IDs), we act as a processor on your behalf. You remain the controller for your customers' data. We process customer data only under your documented instructions (the actions & logic you configure in the App). We do not re‑purpose customer data.

Data Processing Addendum (DPA). We offer a Controller‑Processor DPA with SCCs/UK Addendum at K1 PreOrder DPA.

End‑customers. The App does not interact with your store's end‑customers except where you enable its communication features (for example pre‑order emails and payment links), in which case we send the messages you configure to the recipients you choose, acting as your processor (see §2 A2 and the DPA). Otherwise we only process minimal order/product metadata required for the pre‑order workflow you configure.

2) What we collect

We collect the minimum data necessary to run the App reliably, support you, and understand product usage.

A. Shopify & operational data

Shop identifiers (theme name/ID/version, storefront/locale settings, location settings and time zone), catalog context (product/variant IDs, collection IDs/titles, conflict logs, UI preferences), order context (pre‑orders only), and technical logs (timestamps, request IDs, API errors, App version, device data). We do not store full order contents beyond what is necessary to tag/attribute pre‑order activity.

A2. End‑Customer communication data (processed on the Merchant's behalf)

Where a Merchant uses the App's email or manual pre‑order features, we process on the Merchant's instructions: End‑Customer name and email address, order/pre‑order references, amounts and payment status, the content of the emails the Merchant configures, and message delivery metadata (such as message ID, timestamps, delivered/bounced status and, where the Merchant enables engagement tracking, opened/clicked status, and unsubscribe status) returned by our email provider. Merchants control the recipients and content; we act as processor (see DPA). We keep this data for as long as the Merchant's account is active and delete or anonymize it in line with §7 and the shop/redact webhook. We or our email provider may also retain End‑Customer email addresses (which may be stored in hashed form) on a suppression list to honour unsubscribe requests for as long as needed to keep the suppression effective.

B. Support data (Tidio)

If you contact our support widget, the App may pass helpful shop context to reduce back‑and‑forth and speed resolution (e.g., store URL, installed theme name/ID, shop locale, time zone, App version, purely technical diagnostics such as feature flags, onboarding status). You can ask us to remove or limit what's shared.

C. Product analytics (Mixpanel, Hotjar, Mantle)

Mixpanel (pseudonymous event data about admin UI usage, device/OS/browser, performance metrics); Hotjar (optional session insights for admin interface; we mask input fields where feasible and avoid capturing sensitive text; no storefront replays); Mantle (install & lifecycle telemetry; no end‑customer personal data).

D. Communications

Business contact information, such as email — we send operational/service emails needed to run the App (e.g., technical, security/reliability, onboarding). We may also send brief product communications that help improve quality and support (tips, highlights, short surveys) and limited information about closely related features or services. You can opt out of non‑operational emails at any time by contacting support@k1apps.com (transactional/service notices may still be sent).

3) Why we collect it (Purposes & Legal Bases)

We process data for the following purposes, under these typical legal bases:

4) Cookies & similar technologies

Our admin UI and documentation may use cookies or local storage for authentication, preferences, and analytics (Mixpanel) plus optional session insights (Hotjar) — admin interface only. If you prefer, you can email support@k1apps.com and we will disable Hotjar session capture for your shop.

5) Disclosures to third parties (sub‑processors)

We share data only with service providers that help us run the App (e.g., Shopify platform services; Mixpanel — product analytics; Hotjar — optional session insights; Tidio — in‑app support chat; hosting/logging vendors and our email delivery provider (Brevo)). We require appropriate contractual safeguards and limit access to the minimum necessary. Our up‑to‑date Subprocessor List (vendor, service, country, DPF/SCC status) is published at the end of this document.

Advance notice. We will notify at least 30 days in advance of material changes to subprocessors; you may object within that time.

6) International transfers

Our providers may process data outside your country. Where data is transferred internationally, we rely on appropriate safeguards and measures:

• For certified vendors, we rely on the EU‑US Data Privacy Framework and its UK/Swiss extensions.
• Otherwise we use the 2021 EU Standard Contractual Clauses (Modules 2/3) plus the UK Addendum/IDTA, and perform transfer risk assessments with supplementary measures.

7) Data retention

We keep data only as long as needed for the purposes above, to comply with law, or to resolve disputes. Our retention schedule:

If deletion conflicts with legal retention obligations (e.g. tax/audit), we will retain only what's necessary and isolate it from routine use.

8) Security

We use industry‑standard safeguards such as TLS in transit, encryption at rest (where applicable), access controls, audit logging, environment segregation, and least‑privilege administration. No internet service is 100% secure, but we continuously work to protect your data and promptly remediate incidents. We assess incidents promptly and notify affected merchants and authorities as required by law (GDPR/UK/Law 25). We may monitor use of the App's communication features for abuse (such as spam or phishing sent through a Merchant's account), may suspend those features or a Merchant's access when we detect it, and may notify affected recipients, Shopify and our service providers as part of our incident response.

9) Your rights & how we help you

Depending on your location, you may have rights to access, correct, delete, restrict, object to processing, or port your personal data. As a Shopify app, we also support Shopify's mandatory privacy webhooks (see §11) to help you satisfy requests from your customers.

Response timelines & verification. We respond within 1 month (GDPR/UK) or 45 days (US states). We verify identity via admin email/domain verification or reasonable equivalent.

Appeals (US states). If we deny a request, you may appeal within 30 days by writing to privacy@k1apps.com. We will respond within 45 days.

To exercise your rights or ask questions, contact support@k1apps.com.

10) Your choices

Analytics & replays. We use Mixpanel (pseudonymous) for product analytics and may use Hotjar session insights in the admin. If you prefer to opt out of Hotjar for your shop, email support@k1apps.com and we'll disable it.

Global Privacy Control (GPC). Where applicable, we honor Global Privacy Control (GPC) and similar browser signals for "sale"/"sharing" and targeted ads. (We do not sell/share personal information.)

Support context to Tidio. You can ask us to limit or turn off automatic shop‑context sharing; we can handle your request via email instead.

Email preferences. We send operational/service emails necessary to run the App. We may also send concise product communications that help improve quality and support and information about closely related features/services. You can opt out of non‑operational emails via support@k1apps.com or the unsubscribe link (where available).

11) Shopify privacy webhooks we honor

We subscribe to and honor Shopify's mandatory privacy topics so you can meet your obligations:

• customers/data_request — we help provide customer data we process on your behalf.
• customers/redact — we delete/redact customer data we process on your behalf.
• shop/redact — we delete shop‑level data after uninstall.

Deletion SLA. On shop/redact, we erase shop data from our systems within 30 days (sooner where possible). Customers/redact requests are completed promptly upon webhook receipt. You can also request deletion via email.

12) Details on our tools

Mixpanel (admin analytics). Used to understand feature adoption and improve UX. We do not use Mixpanel for advertising. Data is pseudonymous and focused on App UI usage.

Hotjar (session insights). Used occasionally to review how merchants interact with our admin screens. We focus on layout/navigation issues and mask input fields where feasible.

Mantle (install telemetry). Used to monitor installation health, onboarding progress, and aggregate reliability metrics. We do not send end‑customer personal data to Mantle.

Tidio (support). Used to provide real‑time chat and faster support. We pass helpful shop context (see §2B) to accelerate troubleshooting. You can always contact us by email instead.

Hosting (Hetzner). US‑based cloud infrastructure hosting for our application and databases. Primary processing and storage occurs in the United States (Hetzner US region). Transfers from the EEA/UK rely on the 2021 EU SCCs (Modules 2/3) with the UK Addendum/IDTA (as applicable), plus supplementary technical measures (e.g., encryption in transit and at rest).

Email (Brevo). Delivery of service emails to Merchants and, where a Merchant enables it, of the Merchant's pre‑order emails to its End‑Customers. Includes standard message metadata (recipient address, subject, timestamps, delivery/engagement status). Provider: Sendinblue SAS d/b/a Brevo, Paris, France (EU).

Logging/Monitoring (Sentry). Error and performance telemetry to improve reliability. We scrub sensitive fields and avoid collecting customer payload content.

13) Children

Our App is intended for businesses. We do not knowingly collect personal data from children.

14) Changes to this policy

We may update this Policy from time to time. We will post the updated version in‑app and update the "Effective date" above.

15) Contact

Company: K1 Apps LLC
Address: 30 N Gould St, STE R, Sheridan, WY 82801, USA
General inquiries: support@k1apps.com
Privacy inquiries: privacy@k1apps.com

16) Appendix — Subprocessor List

This appendix lists our current subprocessors. We will notify at least 30 days in advance of material changes (add/replace) and provide an opportunity to object.