Privacy Policy

ClearSignal: Bot Traffic Detection for Shopify

Effective date: November 12, 2026

This Privacy Policy explains how Alpenglow Software LLC ("we," "us," "our"), operator of ClearSignal ("the App") collects, uses, stores, and protects information when you install and use the App through the Shopify platform. ClearSignal detects bot traffic that may be polluting your store's analytics by combining client-side fingerprinting, order-level signal analysis, and server-side signal correlation. A Shopify Web Pixel extension additionally captures storefront checkout and funnel events (such as checkout started, checkout completed, and add-to-cart) as bot-detection, order-integrity, and conversion-funnel signals. See Section 1 for details.

1. Information We Collect

Data from Shopify APIs

The App requests the following Shopify access scopes:

• read_orders: used to attribute orders to AI-agent-driven traffic and to surface Shopify's own order-level risk assessment. For each order, the App reads and stores the order ID, order total and currency, sales channel and referrer information, the campaign source (utm_source) of the visit that led to the order, and Shopify's risk recommendation, risk level, and risk assessment details. The App does not access or store customer names, addresses, email addresses, or payment information through this scope.
• read_products: used to resolve product titles and handles for the storefront pages your visitors and AI agents view, so reports display product names rather than raw identifiers. The App reads product title and handle only. It does not create, modify, or delete products.
• write_pixels and read_customer_events: used to register and operate a Shopify Web Pixel that receives storefront checkout and funnel events. See "Data from the Web Pixel extension" below for exactly what these events contain.
• write_analytics_annotations (optional; requested only if you turn on "Mark bot spikes in Shopify Analytics", off by default): used to add a marker to your Shopify Analytics charts on days the App detects a bot spike. Each marker contains only a date range and aggregate counts for your own store (the number and share of sessions flagged as bad bots). It contains no visitor-level data. The App keeps its own record of each marker it created (Shopify's marker ID, the date range, and the count) so it can update or remove it. Turning the setting off removes the markers the App created while the permission is still granted; markers that remain after you revoke the permission or uninstall the App stay in your Shopify Analytics.

Data from the Web Pixel extension (storefront events)

ClearSignal registers a Shopify Web Pixel that receives storefront events. The pixel runs in Shopify's sandboxed pixel environment and fires only where your visitors' analytics consent permits, as managed by Shopify's Customer Privacy controls. It subscribes to two categories of event, and from each it collects only non-identifying data:

Checkout events (checkout started and checkout completed), used as an order-integrity signal. From these we collect:

• The event type (checkout started or checkout completed)
• The Shopify order identifier and checkout token
• Shopify's first-party visitor identifier (clientId), used to match a completed order to the bot-scored sessions that preceded it
• The event timestamp and your shop domain

Funnel events (page viewed, collection viewed, product viewed, search submitted, product added to cart, product removed from cart, cart viewed, and the checkout contact-information, address, shipping-information, and payment-information steps), used to measure how bot versus human traffic moves through your store's conversion funnel. From these we collect only:

• The event type
• Shopify's first-party visitor identifier (clientId)
• The event timestamp

Funnel events carry no product, cart, collection, or order details and no order identifier — only the fact that an event of that type occurred, Shopify's clientId, and when. We do not receive or store customer names, email addresses, phone numbers, or postal addresses from any of these events. Shopify withholds those fields unless an app is separately approved for them, and ClearSignal does not request that approval.

Data collected through Shopify session

Shopify provides the following data as part of the standard app authentication process:

• Shop domain
• Staff member name, email address, and user ID
• Account role (store owner or collaborator) and email verification status
• Locale preference
• Session tokens, access tokens, and refresh tokens

This session data is managed by Shopify's official session storage library and is required for the App to function within the Shopify Admin.

Data from the Theme App Extension (storefront visitors)

ClearSignal installs a lightweight app embed block on your storefront that runs entirely in your visitors' browsers. This extension collects the following signals from storefront sessions:

• Browser fingerprint data: a bot probability score and browser attributes generated by FingerprintJS BotD, an open-source library that runs entirely in the visitor's browser. No data is sent to FingerprintJS servers.
• Behavioral signals: mouse movement patterns, scroll behavior, and interaction timing, used to distinguish automated from human behavior.
• Honeypot interactions: whether a session triggered invisible form fields that only automated scripts typically interact with.
• Page URL, query string, and referrer: the current page path, the page's query string as received (up to 2,048 characters), and the referring URL. Campaign (UTM) parameter values (source, medium, campaign, content, and term) are also stored as separate fields so reports can attribute traffic by campaign. Advertising click IDs (such as gclid, fbclid, ttclid, and msclkid) are recorded as separate fields only as whether they were present; however, because the full query string is stored as received, any click ID or other parameter present in the page URL is retained within it.
• Durable visitor identifier (optional, off by default): if you enable order-to-session matching, ClearSignal stores a random, first-party identifier (_clearsignal_sid) in the visitor's browser using local storage (localStorage). This is not a cookie and contains no name, email address, or other personal detail. Its sole purpose is to match a completed order back to the bot-scored sessions that preceded it. It is stored only where the visitor's analytics consent permits; otherwise a temporary, page-only identifier is used instead. This setting is off unless you enable it. See Section 9 for details.
• Visit-counting cookie (_cs_visit): a first-party cookie containing a random, non-durable token with a rolling 30-minute expiry. It is used to recognize that several page views belong to the same visit, so a visitor's page views can be counted as a single bot-filtered visit for reporting and for the usage meter that determines your plan's billing. It contains no name, email address, or other personal detail, builds no cross-visit profile, is set only where the visitor's analytics consent permits, and is cleared if the visitor withdraws consent. It is set independently of the order-to-session matching setting above and does not require that setting to be enabled. See Section 9 for details.
• Pre-consent tracker observations: to help you verify that your store's consent banner is working, the extension observes the network destinations your storefront page contacts (such as requests to Google Analytics, Meta, or TikTok) and recognizes a fixed list of known third-party tracking services. Where a visitor has not granted analytics consent and a known tracker fires anyway, the extension reports which tracker it was (a short label such as "ga4" or "meta"), how it was detected, the page path, and the visitor's consent state at page load. The App stores only per-day counts by tracker label and consent state for your store; it does not store the visitor identifier or the tracker's request contents. See Section 9 for details.

This data is transmitted to the App's server via a Shopify app proxy endpoint, which verifies request authenticity using HMAC signature validation.

ClearSignal's storefront component also sends a direct request to the App's server. From that request the App observes the visitor's network (IP) address and reduces it to a truncated network block (a /24 block for IPv4 or a /48 block for IPv6; the rest of the address is discarded). Before the rest of the address is discarded, the App checks whether it falls within the network ranges that operators of AI agents and crawlers publish for their own agents, and keeps only the name of any matching agent (for example, "ChatGPT-User"). This confirms that a visitor identifying itself as one of those agents really comes from that operator, so verified agents can be reported separately from other bots. An ordinary shopper's address is not on these lists, so for shoppers no agent name is kept. Where an address does match, it may be held in the App's memory for up to 10 minutes to limit how often it is checked; it is never stored or logged. This truncated block is used to detect automated (bot) traffic and, at country level only, to show your store's traffic and bot traffic sources by country and to let you filter reports by country. The country lookup runs on the App's own servers; no third party receives the address for it. The block is processed for all storefront sessions — including visitors who declined analytics consent — on the basis of the App's and the merchant's legitimate interest, not on consent. It is never combined or compared across merchants, and is never used to identify an individual visitor.

Data from server-side processing

When a storefront session is scored, the App processes and stores:

• IP addresses: used for geographic analysis and queried against an IP reputation service. IP addresses are retained as part of session records.
• IP reputation scores: scores from the IPQualityScore API indicating the likelihood that an IP address is associated with bots, proxies, or data centers. For storefront visitors, IPQualityScore receives the browser user-agent together with either the network address of the Shopify relay that forwarded the visitor's request (Shopify infrastructure, not the visitor's own address) or the visitor's truncated network block (see above). The visitor's own full IP address is never sent. Results are cached for your store only.
• Data center and ASN classification: whether the session originated from a cloud provider, hosting service, or residential network.
• Bot classification and session scores: the final classification verdict (DEFINITE_BOT, LIKELY_BOT, SUSPICIOUS, or LIKELY_HUMAN) and the underlying signal breakdown that produced it.
• Shopify Flow trigger (optional): if you build a Shopify Flow workflow using ClearSignal's bot-detection trigger, the App sends that workflow, inside your own store, the session's identifier, bot score and classification, detection signals, the truncated network address recorded for the session (the Shopify relay address, not the visitor's own address), the browser user-agent, page-view count, and detection time. What happens next is determined by the workflow you configure.

Abandoned-checkout data (when order-to-session matching is enabled)

When order-to-session matching is enabled (off by default; see Section 9), the App periodically reads your store's abandoned checkouts through the Shopify Admin API (read_orders scope) to tell genuine shoppers who did not complete a purchase apart from bot traffic. For each abandoned checkout, the App stores the checkout identifier, when it was created and whether it was later completed, the subtotal and currency, the number of items, and the durable visitor identifier carried in the cart (if any), together with the bot classification of the linked session. It does not store customer names, email addresses, postal addresses, or payment details. Because this record can include the durable visitor identifier, it is treated as personal data (see Section 7). When order-to-session matching is off, no abandoned-checkout data is collected.

Data you provide to us, and your use of the App

• Help messages and feedback you submit: if you send a message from the in-app Help page, we store the topic you choose (for example, a problem, a how-to question, feedback, or billing), your message, and, for feedback only, an optional satisfaction rating. You may also give a contact email address; we store it only if you also tick the box allowing us to email you about that request, and we record when you sent the message with that box ticked. When you report a problem, we automatically attach your plan, whether tracking is turned on, and when tracking last received an event from the web pixel, so you do not have to look them up. Messages sent through the earlier feedback survey also included free-text answers to its questions and may include a contact email you left there for follow-up, without that box, because the survey did not have one. We use this to answer you, fix problems, and improve the App, and we email you about a message only if you agreed to be contacted.
• How you found the App: once tracking is on and your traffic data is showing, the App asks how you found it, until you answer or skip the question. If you answer, we store your choice from a fixed list (for example, App Store search, Shopify Sidekick, an AI assistant, or a search engine) and, if you choose "Other", the short text you type. You can skip the question. We use the answers, combined across merchants, to understand which channels bring merchants to the App and where to spend our own marketing effort. We do not share your answer with anyone.
• In-app usage: we record which pages of the App's admin interface your store opens and which in-app notices (for example, a plan-limit or setup reminder) are shown, with a timestamp. Repeat views of the same page or notice within 30 minutes are recorded once. We also record whether the one-time "how did you find us" question was shown to you, answered, or skipped. We also record each change to your saved country filter (the countries saved, a filter cleared or restored, or a change refused because your plan does not include the filter), with the countries involved and a timestamp. We use this to understand which features merchants use and to improve the App. It relates to you and your staff's use of the App, not to your storefront visitors.
• Country filter (Essentials and Growth plans, optional): if you save a list of countries to exclude, we store that list of country codes as a setting for your store. It changes only what your ClearSignal reports show: your dashboards (except Daily Reports, which always counts every country), the reports you export from them, your report cards (which state the countries excluded, including on any share link you create, which anyone with the link can see), and the traffic quality summary for Shopify Sidekick. Sessions whose country is unknown are always included, and orders are never filtered by country. The filter is never used to classify, block, or take any action toward a visitor, and it does not change anything you download to send to an ad platform (the bot IP exclusion list for your ad accounts and the paid-traffic bot report for Google Ads or Meta refund claims, which always include every country), Shopify Flow, Klaviyo, other integrations, or billing. If you move to the Free plan the saved list is kept but not applied; it is deleted with the rest of your shop data after uninstall.
• First-use milestones: we record, once per store, the date and time your store first saw certain results in the App (its real-versus-bot traffic read, its true conversion rate, and AI-referred orders), first downloaded a bot-traffic report or exclusion list, and first had storefront traffic recorded. We use these dates to understand how quickly merchants get value from the App and to improve it. They contain no storefront visitor or customer data.
• Operational logs: we keep error and diagnostic records associated with your shop (for example, a failed background job) to operate and troubleshoot the App. These are scrubbed of IP addresses, email addresses, and access tokens before they are stored.

Data from the optional Klaviyo integration

If you connect your Klaviyo account, the App additionally collects:

• Klaviyo OAuth tokens: stored encrypted at rest using AES-256-GCM. Used to authenticate API calls to your Klaviyo account.
• Klaviyo profile data: email addresses, profile IDs, and activity metrics for profiles in your Klaviyo account, used to assess bot risk. This data is queried from Klaviyo's API and processed to generate bot scores. For profiles the App flags as likely bots, it stores the email address, Klaviyo profile ID, bot signals, confidence score, and review status so you can review and act on them.
• ClearSignal tags applied to profiles: when a profile is flagged, a tag (e.g., "ClearSignal: Bot Suspect") is written back to the Klaviyo profile through the Klaviyo API.

Klaviyo tokens are deleted immediately when you disconnect the integration, and with the rest of your data after you uninstall the App (see Section 6).

Data we do NOT collect

• Customer names, postal addresses, or payment information
• Theme files or store source code
• Customer email addresses, unless you connect the Klaviyo integration and Klaviyo provides them as part of profile data

2. How We Use Your Information

We use the data we collect solely to provide and improve the App's services:

• Bot detection: we correlate fingerprint, behavioral, and IP reputation signals to score storefront sessions and classify them as bot or human traffic.
• AI-agent order attribution: we analyze each order's sales channel, referrer, and source data (including the campaign source of the visit that led to the order) to identify orders driven by AI-agent traffic (e.g., ChatGPT, Microsoft Copilot) and estimate the revenue they contribute.
• Order risk surfacing: we display Shopify's own order-level risk recommendation and risk level in your dashboard so you can evaluate order quality.
• Analytics impact reporting: we use session classifications to calculate your true conversion rate and estimate how bot traffic may be distorting your analytics.
• Dashboard display: we surface bot percentage, session breakdowns, and signal details in the App's merchant dashboard.
• Klaviyo profile audit (if connected): we analyze Klaviyo profiles for bot-like behavior and tag suspected bot profiles so they can be excluded from campaigns.
• Consent-integrity reporting: we show you which known third-party trackers fired on your storefront before a visitor granted analytics consent, so you can fix your consent setup.
• Product improvement and support: we use your help messages, feedback, and in-app usage records (see Section 1) to answer you, improve the App, and follow up with you if you asked us to. This never involves your storefront visitors' data.
• Subscription management: we store your current billing plan to gate features appropriately.
• App functionality: we use your shop domain and session data to authenticate requests and deliver the App within the Shopify Admin.
• Shopify Sidekick (optional): if you ask Shopify Sidekick, Shopify's AI assistant in your Shopify Admin, a question it decides ClearSignal can help answer (for example, about your store's traffic quality or AI-assisted revenue), Sidekick asks ClearSignal for a summary and ClearSignal returns it. Sidekick can specify only a period (7, 30, or 90 days); ClearSignal identifies your store from your Shopify Admin session and reads only your store's data. ClearSignal offers two read-only summaries. The traffic quality summary (every plan) contains the period covered, the total number of scored storefront sessions, the bad-bot rate, and, for each of ClearSignal's four traffic labels (Human, Bad bot, Good agent, and Unclassified), the label, its one-line description, its session count, and its share of sessions. The periods available are those within your plan's reporting window (see Section 6): 7 days on Free; 7 or 30 days on Essentials; and 7, 30, or 90 days on Growth. If you have saved a country filter on the Essentials or Growth plan, the traffic quality summary leaves out sessions from the countries you excluded, as your ClearSignal Summary page does, and also contains the list of excluded country codes and a one-line note naming those countries; sessions whose country is unknown are always included. The AI-assisted revenue summary (Growth plan only) contains, for the period, the number of orders ClearSignal ties to an AI assistant, the combined order totals of those orders, how many of them carried no order total, the currency and whether the orders mix currencies, and, for each AI assistant (for example, ChatGPT or Perplexity), its order count and combined order totals (up to 20 assistants, with a note if there are more), together with a short note that these figures are a minimum. The AI-assisted revenue summary is never filtered by country. Each summary also includes a link to the matching ClearSignal page. If your plan does not include the summary or period requested, ClearSignal returns only a short statement that it is not available on your current plan and, for the traffic quality summary, which periods are. If there is no data for the period, or the data cannot be read, it returns a short message saying so (with the excluded countries and the same note, if a country filter is on). The summaries contain aggregate figures and fixed descriptive text only: no session records or session identifiers, no visitor identifiers (such as Shopify's clientId or the durable visitor identifier), no IP addresses or network blocks, no storefront page URLs, query strings, or referrers, no order identifiers or order-level details (where an AI assistant referred only one order in the period, its figures are that order's total), and no customer names, email addresses, or other customer details. ClearSignal does not receive your questions or Sidekick's replies, and it does not store the summaries it returns; a request can at most trigger the routine subscription plan check described under "Subscription management" above (which can update your stored plan and, after an upgrade from the Free plan, set a one-time in-app notice) and error or diagnostic records (see "Operational logs" in Section 1). Sidekick is operated by Shopify, which processes your conversations, including these summaries, under its own terms and privacy policy.
• AI/ML: ClearSignal does not use artificial intelligence or machine learning to process your data, and we do not use your data or your visitors' data to train AI or machine-learning models. If you choose to use Shopify Sidekick (see "Shopify Sidekick" above), the summaries ClearSignal returns to it are processed by Shopify's AI assistant under Shopify's terms, not by us. We do not control how long Shopify keeps these summaries or how Shopify uses them.

For the purposes of applicable data protection laws, you (the merchant) are the data controller for storefront visitor data collected through the App. Alpenglow Software LLC acts as a data processor, processing this data solely on your behalf and as described in this policy. For data we collect directly about you and your use of the App (such as support communications, feedback you submit, and in-app usage records), we act as an independent data controller.

3. How We Process Visitor Data

Storefront visitor data flows through the App as follows:

1. The theme app extension loads on your storefront and runs FingerprintJS BotD in the visitor's browser. No data leaves the browser until the next step.
2. Fingerprint and behavioral signals are sent to the App's server via a Shopify app proxy endpoint with HMAC verification. A separate direct request also reaches the App's server, which reduces the visitor's network address to a truncated block (a /24 for IPv4 or a /48 for IPv6) and checks it against AI-agent operators' published networks before discarding the rest (see Section 1), for bot detection and country-level reporting.
3. The server correlates all available signals (fingerprint score, behavioral patterns, and IP reputation) and computes a bot probability score.
4. The classification verdict, the signal breakdown, and the signals it was computed from are stored with the session record for its retention window. Behavioral signals are stored only as aggregate measurements (counts of mouse and scroll events, scroll distance, time on page, and screen size) and the BotD result; individual mouse and scroll events are not stored.
5. Aggregated results are displayed in your merchant dashboard.

Bot classifications represent probabilistic assessments, not definitive verdicts. Individual session records include the contributing signals so you can evaluate the basis for any classification.

Separately, order data (see Section 1) is read directly from the Shopify Admin API via the read_orders scope when an order is created. The resulting order attribution and risk record is stored on its own. It does not pass through the fingerprinting/scoring pipeline described above. The Web Pixel extension referenced in Section 1 delivers storefront checkout and funnel events (see Section 1) to the App's server, where checkout events are recorded as order-integrity signals and funnel events as aggregate conversion-funnel signals. We use Shopify's visitor identifier (clientId) from these events to match completed orders to the bot-scored storefront sessions that preceded them, so genuine buyers can be distinguished from bot traffic in your analytics, and to measure how bot and human traffic move through your store's funnel. This processing is performed only within your own store's data and is never combined or compared across merchants.

When order-to-session matching is enabled (off by default; see Section 9), the App additionally maintains a link between a completed order and the storefront session that preceded it, using the durable visitor identifier described in Sections 1 and 9. When an order is created, the App records an order-to-session join (an OrderSessionLink record) connecting the Shopify order to that visitor identifier, so that bot-scored page views can be attributed to the revenue they generated. When order-to-session matching is enabled and the visitor's analytics consent permits, the extension also writes the durable identifier (_clearsignal_sid) into the cart as a custom attribute when the visitor adds an item to their cart, so that the identifier is carried into the resulting Shopify order. This is the point at which the order-linked session data can become personal data: because a Shopify order can be tied to an identifiable customer, enabling this feature can make the linked session data personal data relating to that customer. See Sections 6, 7, and 9 for the corresponding retention limits and data rights.

4. Data Storage and Security

• All data is stored in a PostgreSQL database hosted on Railway (United States).
• Shopify access and refresh tokens (both the App's own copy and the authentication sessions managed by Shopify's session storage library) and Klaviyo OAuth tokens are encrypted at rest using AES-256-GCM encryption.
• All connections use HTTPS/TLS encryption in transit.
• IP reputation results are cached, per store, for up to 7 days and then expire automatically.
• We do not sell your data or your visitors' data. We do not share data with third parties for marketing, advertising, or profiling purposes.
• In the event of a data breach affecting your data, we will notify you and Shopify within 24 hours of discovery, in accordance with Shopify's Partner Program Agreement and applicable law.

5. Third-Party Services

The App uses, or sends data to, the following third-party services:

Before we add or replace a third-party service that processes your storefront visitors' personal data, we will update this section and the effective date of this policy, and notify you in advance by email or in-app notice so you have an opportunity to object or uninstall.

6. Data Retention

• While installed: Detection records, order attribution records, and reports are retained while the App is installed on your store. Bot-detection session records are additionally subject to the per-plan retention window described below, and are automatically purged once they age past it.
• Bot-detection session records (per-plan retention): Session records are retained on a rolling basis determined by your plan and then automatically deleted: Free: 15 days; Essentials: 35 days; Growth: 100 days. Your dashboard reports over a shorter window (Free: 7 days, Essentials: 30 days, Growth: 90 days); records are kept slightly longer than the reporting window so that reporting for the most recent period is complete before the records are deleted. Uninstalling the App deletes this data, regardless of the window, when Shopify's shop data-erasure request arrives (see "On uninstall").
• On uninstall: All data associated with your shop is permanently and automatically deleted when Shopify sends its shop data-erasure request, which Shopify sends about 48 hours after you uninstall. This includes sessions, detections, order attribution records, Klaviyo data and tokens, help messages and feedback, your answer about how you found the App, and your shop record. Deletion is atomic and irreversible. You can ask us to delete it sooner (see Section 7).
• GDPR shop/redact: When Shopify sends a shop data-erasure request, all shop data is deleted on receipt.
• IP reputation cache: IP reputation scores are cached, per store, for up to 7 days and expire automatically.
• Klaviyo tokens: Deleted immediately on disconnect, and with your other data after uninstall.
• Durable visitor identifier (_clearsignal_sid): When order-to-session matching is enabled, the identifier stored in a visitor's browser is retained on a 30-day rolling basis: it is regenerated at least every 30 days, and is removed from the visitor's browser immediately if the visitor withdraws analytics consent.
• Order-to-session join records (OrderSessionLink): Retained for no longer than 13 months, after which they are purged. This window permits year-over-year revenue-attribution reporting before the linkage is removed.
• Web Pixel checkout-event records: Records of completed checkouts, which link a Shopify order to Shopify's visitor identifier, are retained for no longer than 13 months, then purged. Records of checkouts that were started but not completed carry no order identifier and are purged after 60 days. All are deleted with your other data after uninstall, and completed-checkout records on any customer redaction request covering the affected order.
• Web Pixel funnel-event records: Purged after 60 days.
• Abandoned-checkout records: Purged 60 days after the checkout was created, and deleted on any customer redaction request that reaches the linked visitor identifier.
• Pre-consent tracker counts: Purged after 60 days.
• In-app usage records: Purged after 30 days, except the record of whether the one-time "how did you find us" question was shown, answered, or skipped, which is kept with your answer and deleted with the rest of your shop data after uninstall.
• Country filter: Kept with your store's settings until you change or clear it, and deleted with the rest of your shop data after uninstall. Report cards created while a filter was on keep the list of excluded countries they state, and are deleted with your shop data.
• First-use milestones: Kept with your store's settings and deleted with the rest of your shop data after uninstall (see "On uninstall" above).
• Help messages and feedback you submit, your answer about how you found the App, flagged Klaviyo profile records, and operational logs: Retained while the App is installed and deleted with your other data after uninstall, including diagnostic log entries that reference your shop by its domain. Operational logs that do not belong to any single store (for example, infrastructure errors and aggregate operating snapshots) are deleted after 90 days. You may ask us to delete your messages or feedback at any time.
• Email copies: help message notifications and our email replies already delivered to our inboxes are not part of the App's database and are not removed by the automated deletion after uninstall. Contact us to have them deleted.
• Order-linked session records: Bot-detection session records that have been linked to an order are de-identified (the durable identifier is removed) at approximately 90 days, so that the ability to relate a session to an individual does not outlive the order-attribution purpose.

The retention limits above are additional ceilings on the storefront visitor-identification and order-attribution data; they do not override the deletion after uninstall described earlier in this section, which removes this data regardless of these ceilings.

7. Your Rights

You have the right to:

• Access: View session classifications, signal breakdowns, and detection history through the App's dashboard.
• Deletion: Uninstalling the App deletes all your data when Shopify's shop data-erasure request arrives, about 48 hours after uninstall. You may also contact us to request deletion sooner, or without uninstalling.
• Data portability: Contact us to request an export of your stored data.
• Correction: Contact us if you believe any stored data is inaccurate.

Regarding your store's visitors: ClearSignal's bot-detection extension does not collect names, email addresses, or other directly identifying information from storefront visitors (the optional Klaviyo integration is the exception; if connected, Klaviyo provides email addresses as part of profile data). However, if you enable order-to-session matching (see Section 9), the durable visitor identifier can be linked to a completed order, and through your Shopify order records to an identifiable customer. Where that link exists, the associated bot-detection session data becomes personal data relating to that customer. Separately, ClearSignal receives Shopify's first-party visitor identifier (clientId) through the Web Pixel checkout events described in Section 1; because those records link an order to that identifier, they are likewise treated as personal data, not as anonymous data. ClearSignal honors Shopify's customer privacy webhooks for all of this data: a customers/data_request surfaces the order-linked session records (including the classification the store's reports used for each session and the reason it changed, if it did) and Web Pixel checkout-event records we hold for the requested orders, and a customers/redact request deletes them. Abandoned-checkout records that carry the same durable visitor identifier are likewise treated as personal data: they are included in the response to a customers/data_request and deleted by a customers/redact request that reaches that identifier. Sessions carry no durable identifier, and cannot be matched to any individual, when the visitor did not grant analytics consent, when order-to-session matching is off, or once the session is more than 90 days old. When order-to-session matching is on, a consented visitor's sessions carry the durable identifier and are covered by customer data requests and redaction through that identifier. If a visitor contacts you with a data request, you may contact us and we will assist.

We respond to all data requests within 30 days.

8. International Data Transfers

Your data and your visitors' data are processed and stored on servers located in the United States. By using the App, you consent to the transfer of data to the United States for processing.

9. Storefront Tracking, Cookies, and Local Storage

ClearSignal's theme app extension runs in your store's storefront to collect the bot-detection signals described in Section 1. ClearSignal uses a single first-party cookie (_cs_visit, described below) for visit counting; all other storefront identifiers use browser local storage rather than cookies. This section explains how those techniques interact with your visitors' browsers and with their privacy choices.

Bot-detection signals

The extension reads browser characteristics (via FingerprintJS BotD) and observes behavioral signals to assess whether a session is automated. These signals are used solely to score sessions for bot detection on your store. They are not used to build a personal profile of the visitor, and they are not used to track visitors across other websites.

Consent-gated device read

The FingerprintJS BotD check reads information from the visitor's device (browser). Where your storefront's analytics consent settings indicate that a visitor has not granted analytics consent, ClearSignal does not perform this device read. Those sessions are still scored using server-side signals only, IP address and network (ASN) reputation, behavioral patterns, and honeypot interactions, none of which access information stored on the visitor's device.

Durable visitor identifier (optional, off by default)

If you enable order-to-session matching, a setting that is off by default, ClearSignal stores a random, first-party identifier in each visitor's browser using local storage (localStorage). This is not a cookie. The identifier (_clearsignal_sid) contains no name, email address, or other personal detail, is scoped to your store's domain only, and is never shared or reused across other websites. Its sole purpose is to link a completed order back to the bot-scored page views that led to it.

This identifier is stored only where your visitors' analytics consent permits. Where a visitor has not granted analytics consent, or where the setting is off, ClearSignal instead uses a temporary identifier that exists only for the current page and is discarded when the page is closed. If a visitor withdraws analytics consent, ClearSignal removes the stored identifier from their browser and reverts to the temporary identifier.

Visit-counting cookie (_cs_visit)

ClearSignal sets a single first-party cookie, _cs_visit, on your store's domain. It holds a random, non-durable token with a rolling 30-minute expiry (refreshed as the visitor continues browsing) and contains no name, email address, or other personal detail. Its sole purpose is to recognize that several page views belong to the same visit, so a visitor's page views can be collapsed into one bot-filtered visit — both for the counts shown in your reports and for the usage meter that determines your plan's billing. It is not used to build a cross-visit profile of the visitor and is not shared or reused across other websites.

This cookie is set only where your visitors' analytics consent permits. It is set independently of the order-to-session matching setting above; unlike the durable visitor identifier, it does not require you to enable durable tracking. Where a visitor has not granted analytics consent, the cookie is not set, and if a visitor withdraws analytics consent ClearSignal clears it from their browser.

Consent-integrity monitoring

To help you confirm that your consent banner actually holds back third-party trackers, the extension watches the network destinations your storefront page contacts (for example, script, image, and data requests) and checks them against a fixed list of known tracking services. It does not read the contents of those requests, and it does not read or write anything on the visitor's device. A report is sent only when a visitor has not granted analytics consent and a known tracker fired anyway, and it contains only the tracker's label, how it was detected, the page path, and the visitor's consent state at page load. The App stores only per-day counts by tracker label and consent state for your store (see Section 1), purged after 60 days.

Checkout and funnel events via Shopify Web Pixel

ClearSignal registers a Shopify Web Pixel that receives checkout and funnel events from your storefront (see Section 1). This pixel runs in Shopify's sandboxed environment and is gated by Shopify's Customer Privacy controls, so it fires only under the analytics consent your visitors have granted. It does not read information from the visitor's device and does not set any identifier of its own. It receives Shopify's own first-party visitor identifier (clientId), which ClearSignal uses to match completed orders to the sessions that preceded them and to measure bot-versus-human movement through your store's funnel, within your store only.

No cross-site tracking

None of these techniques track visitors across different websites or link a visitor's activity on your store to their activity elsewhere. All collected signals are used solely for bot detection, order attribution, and your store's own traffic reporting (including reporting and filtering by country) on your store.

Your responsibilities as merchant

By enabling the App's storefront extension, you represent that your store's privacy policy and consent mechanisms adequately disclose the use of browser fingerprinting, behavioral analysis, and local-storage-based durable visitor identification for bot detection and order attribution purposes, and that your store's consent management (via Shopify's Customer Privacy API) is configured to reflect your visitors' choices. You are responsible for compliance with applicable privacy laws regarding your store's visitors.

10. Children's Privacy

The App is designed for use by Shopify merchants (business users) and is not directed at children under 13. We do not knowingly collect personal data from children.

11. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we will update the effective date at the top of this page. Continued use of the App after changes constitutes acceptance of the updated policy.

12. Contact Us