Privacy Policy

1. Who we are

Aplon ("we", "us", "our") is the data controller responsible for your personal data. We are operated by Hallway Ltd, incorporated in Cyprus. Our registered address is: Tefkrou Anthia 90, Ayia Napa, 5330, Ammochostos, Cyprus.

This Privacy Policy applies to all personal data collected through our platform at app.aplon.io, our marketing website at aplon.io, and any related services. For all privacy enquiries, contact us at contact@aplon.io.

We act in two different roles, and it matters which. For data about you — your account, your billing, how you use Aplon — we are the controller and this policy explains what we do with it. For data about your customers, which reaches us from your Shopify store and your connected tools, you are the controller and we are your processor: we handle it only to produce your analytics, on your instructions. Sections 2.2 and 4 set out what that means in practice, and our Data Processing Agreement is the GDPR Article 28 contract that governs it. It is already in force — it forms part of our Terms of Service, so there is nothing for you to sign.

2. Data we collect and how we collect it

2.1 Account data

Your email address and, if you provide it, your name — collected when you create an account or sign in. We store your account creation date, last login, plan status, and notification preferences.

You can sign in with a one-time passcode sent to your email, or set a password. If you set one, we store it only as a salted PBKDF2 hash — we never store or have access to the password itself, and we cannot recover it for you. If you turn on two-factor authentication, we store the secret your authenticator app uses, and your recovery codes as hashes. We also record the devices with active sessions on your account so you can sign them out individually.

2.2 Shopify store data

When you connect a Shopify store, we request OAuth access and receive a Shopify access token. We use this token to read your store's order history, product catalogue, customer information, and revenue data via the Shopify Admin API. We store your store domain, shop name, and the encrypted access token. We do not store payment card numbers or Shopify customer passwords.

To keep your analytics fast, we maintain a copy of your store's order and product data in our database, refreshed automatically. This includes personal data about your customers — name, email address, location (country, region, city), order history, and visit or attribution data (such as referring source and landing page) — which we process solely on your behalf to generate your analytics (for example, customer lifetime value, repeat-purchase, and sales-by-region insights). For this customer personal data, you are the data controller and Aplon is your data processor. We do not sell it or use it for our own marketing. It is encrypted, access is restricted and logged, and it is deleted when you delete your account, when you uninstall the app, or on a valid deletion request — including a deletion request Shopify forwards to us on a shopper's behalf.

2.3 Storefront analytics pixel

When you connect a store, Aplon installs a first-party analytics pixel on your Shopify storefront so we can give you traffic, funnel, and marketing-attribution analytics. This pixel collects, from visitors to your storefront: page views and page URLs, referrer, UTM parameters (source, medium, campaign, content, term), device type, approximate country (derived from IP address, which is not itself stored against the visitor), and completed-purchase events (the Shopify order ID). To connect a visitor's sessions across pages it stores a randomly generated visitor and session identifier in the visitor's own browser (local and session storage). The pixel does not collect names, email addresses, payment details, or any directly identifying personal information, and it is a first-party analytics tool — it is not used for advertising, retargeting, or audience building, and the data is never sold or shared with advertising platforms.

How the country is worked out. Our servers see the visitor's IP address, as any web server does, and use it only to derive an approximate country. We do not store the IP address against the visitor. Usually the country comes from a header our hosting or CDN provider already adds. Where it does not, we send the IP address to a geolocation provider (ipinfo.io, or ipapi.co as a fallback) to resolve the country, and cache the answer briefly. Those providers are listed in section 5 and receive nothing else.

The pixel respects shopper consent. Where you (the merchant) have enabled consent collection on your storefront, the pixel integrates with Shopify's Customer Privacy API and does not read or store any identifier, or send any event, unless the shopper has consented to analytics tracking; if a shopper later grants consent, tracking begins from that point. The data collected belongs to you as the merchant and is used solely to produce analytics within your Aplon account.

2.4 Meta Ads integration data

If you choose to connect a Meta Ads account, you will be directed to authenticate via Meta's OAuth flow and will be asked to grant Aplon permission to read and, on plans that include ad management, change your ad account data. Upon connection, we receive and securely store an access token issued by Meta.

Using this token, we access the following data from Meta's Marketing API on your behalf:

• Ad account names and IDs
• Campaign, ad set, and ad names and IDs
• Ad performance metrics: spend, impressions, clicks, reach, frequency, CPM, CPC, CTR, ROAS, and conversions
• Attribution data associated with your ad campaigns

We do not access your personal Facebook profile, private messages, friends list, or any data outside of your connected ad accounts. You can disconnect your Meta Ads account at any time from the Settings page, which will revoke our access and delete your stored token. You can also revoke access directly from your Meta Business Settings.

Meta ad data accessed through our integration is used solely to provide you with advertising performance analytics within the Aplon platform. It is not sold, shared with third parties, or used for any purpose other than delivering the service to you.

Changes we make when you ask us to. On plans that include ad management, Aplon can act on your connected ad accounts at your instruction: pausing or resuming ads, changing budgets, and adding tracking parameters to ad destination URLs. These are writes to the live platform, not analytics. We record who made each change and when, in a log you can read in the Ads view. Aplon never changes an ad on its own initiative.

2.5 Google Ads integration data

If you choose to connect a Google Ads account, you will authenticate via Google's OAuth flow and grant Aplon access to your Google Ads account data. We access campaign performance metrics (spend, impressions, clicks, conversions, ROAS) to provide analytics within the Aplon platform, and — on plans that include ad management, and only at your instruction — make the same kinds of changes described above for Meta. The same access, storage, and deletion principles apply. You can disconnect at any time from Settings or directly from your Google account permissions.

2.6 Snapchat Ads integration data

If you connect a Snapchat Ads account, we store an access token issued by Snapchat and use it to read campaign, ad set, and ad performance metrics for advertising analytics. The same access, storage, and deletion principles apply. You can disconnect at any time from Settings.

2.7 Klaviyo integration data

If you connect Klaviyo, you give us a Klaviyo private API key, which we store encrypted at rest. We use it to read your account, campaign, flow and metric data — including aggregate engagement data about your subscribers, such as opens, clicks and revenue attributed to a campaign — in order to produce your email marketing analytics. Where you enable a feature that requires it, we may also write events back to your Klaviyo account. As with your Shopify customer data, you are the controller of this data and we are your processor. You can disconnect at any time from Settings, which deletes the stored key, and you can revoke the key from within Klaviyo.

2.8 Billing data

If you subscribed through our website, payments are processed by Stripe and we store your Stripe customer ID, subscription plan, billing status, and transaction history. If you installed Aplon from the Shopify App Store, your subscription is billed by Shopify and we store the Shopify charge identifier and your plan status instead. In neither case do we store payment card numbers, CVV codes, or bank account details — those are held by Stripe or by Shopify under their own PCI DSS compliance programmes.

2.9 Usage data

We collect data about how you interact with the Aplon platform, including pages visited, features used, Aplo AI chat messages and responses, Aplo request counts, error logs, and session metadata (browser type, device type, IP address, timestamps). This data is used to operate, maintain, and improve the service.

2.10 Push notifications and communications

If you enable push notifications, we store your browser push subscription endpoint and encryption keys to deliver notifications to your device. If you subscribe to email digests or AI insights, we store your email preferences. You can withdraw consent for both at any time from the Account page.

2.11 Measuring our own marketing

We measure how our marketing website (aplon.io) performs using our own first-party analytics only — described in section 3.3. It records page visits and whether a visit led to a signup, and the data goes to our own servers.

We do not use third-party advertising or retargeting technology anywhere: no Meta Pixel, no Google Ads conversion tag, no Google Analytics, and no advertising cookies on aplon.io or app.aplon.io. We do not build retargeting audiences and we do not share visitor data with advertising platforms. The first-party storefront analytics pixel described in section 2.3 is a separate, analytics-only tool installed on merchant storefronts, and is likewise never used for advertising.

3. Cookies and tracking technologies

3.1 What are cookies

Cookies are small text files stored on your device when you visit a website. We also use similar technologies including local storage and session storage to maintain your application state. Below we describe all cookies and tracking technologies we use.

3.2 Strictly necessary

These are essential for the platform to function and cannot be disabled. They include session authentication tokens (stored in local storage on app.aplon.io), CSRF protection tokens, Stripe's fraud prevention cookies used during payment flows, and a short aplon_geo cookie set by our hosting provider's edge network that records only a region and country code. That last one exists so we know whether to ask you for analytics consent before setting anything else, and your choice is remembered in a cookie_pref value in your browser's local storage. No consent is required for these, as they are necessary to deliver the service you have requested — or, in the case of the last two, to honour the choice you make about the rest.

3.3 Analytics storage (aplon.io only)

On our marketing website we use our own first-party analytics — no third-party analytics provider. It stores a randomly generated visitor identifier (_aplon_site_vid, in local storage), a session identifier (_aplon_site_sid, in session storage), and the campaign and landing-page values for your current session (_aplon_site_utm, _aplon_site_landing). These contain no directly identifying information and are sent only to our own servers.

When we ask, and when we assume. If you are in the EU or the UK — or if we cannot tell where you are — we set nothing beyond the essentials until you choose "Accept all" in our cookie banner. Elsewhere, analytics storage is on by default and our banner lets you turn it off. Either way you can change your mind at any time using the Cookies link in the footer of any page, and choosing "Essential only" deletes the visitor identifier.

Two things happen regardless of that choice, and are treated as strictly necessary. Your current session's campaign and landing-page values are kept in session storage, which lasts until you close the tab and never leaves your browser unless one of the events below is sent. And if you sign up for a trial we record that conversion, because it is a first-party record of an action you deliberately took. Neither is shared with anyone.

3.4 Advertising and retargeting cookies

We do not use any. There is no Meta Pixel, no Google Ads conversion tag, and no advertising or retargeting cookie on aplon.io, on app.aplon.io, or on merchant storefronts. We do not share visitor data with advertising platforms.

3.5 Storefront analytics storage (merchant stores)

On the storefronts of merchants who use Aplon, our first-party analytics pixel (section 2.3) stores a randomly generated visitor identifier (_aplon_vid, in local storage) and a session identifier (_aplon_sid, in session storage), along with UTM and landing-page values for the current session. These contain no directly identifying information and are used only to produce the merchant's traffic and attribution analytics. Where the merchant has enabled consent collection, these are set only after the shopper consents via Shopify's Customer Privacy API. They are never used on app.aplon.io or for advertising.

3.6 Managing cookies

You can change or withdraw your choice at any time using the Cookies link in the footer of any page on aplon.io, which reopens the banner and shows which option is currently in force. You can also control cookies through your browser settings — most browsers allow you to refuse cookies, delete existing cookies, or be notified when cookies are set. Note that disabling strictly necessary cookies may prevent the service from functioning correctly.

Because our analytics are first-party and we run no advertising trackers, declining non-essential storage in our banner is sufficient — there is no third-party opt-out you need to visit. Clearing your browser's local and session storage for aplon.io removes the identifiers described in section 3.3.

4. How we use your data and our lawful bases

Under the EU General Data Protection Regulation (GDPR), we must have a lawful basis for each way we use your personal data. The table below sets out our processing activities and the lawful basis for each:

Staff access to your account. To operate, support, troubleshoot, and improve the service, a limited number of authorised Aplon personnel may access your account and view the data in it — including your store analytics and the personal data described above — for example to reproduce a problem or check that a new feature displays your data correctly. Such access is read-only, restricted to authorised personnel, and recorded in an internal access log. We rely on our legitimate interest in providing and improving a reliable service, balanced against your rights. We do not use this access to alter your data.

We do not sell your personal data to third parties. We do not use your store data, ad account data, or Aplo chat history to train AI models.

6. International data transfers

Some sub-processors listed above are located outside the European Economic Area (EEA), including the United States. When your data is transferred outside the EEA, we ensure that appropriate safeguards are in place in accordance with GDPR Chapter V, including:

• Standard Contractual Clauses (SCCs) approved by the European Commission
• Reliance on an EU adequacy decision where applicable
• Sub-processor participation in recognised frameworks such as the EU-US Data Privacy Framework

You may request a copy of the relevant transfer mechanisms by contacting contact@aplon.io.

7. Data retention

We retain your personal data for as long as your account is active and as needed to provide the service. Specific retention periods:

• Account and store data: retained for the life of your account, and deleted immediately when you delete your account. Backups are overwritten on our provider's normal rolling cycle.
• Integration tokens and keys: deleted immediately upon disconnection or account deletion.
• Aplo chat history: retained for the life of your account unless you request earlier deletion.
• Push notification subscriptions: deleted when you unsubscribe or delete your account.
• Billing and commission records: retained for 7 years as required by applicable financial and tax law. This includes affiliate referral and commission records, which we keep after an account is deleted because they evidence money we have paid.
• Server logs: retained for up to 90 days for security and debugging purposes.

You can delete your account and all associated data at any time from the Settings page. Deletion is permanent and irreversible.

8. Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, or disclosure:

• Integration access tokens and keys — Shopify, Meta, Google, Snapchat, Klaviyo — are encrypted at rest using AES-256-GCM
• All data in transit is encrypted via TLS 1.2 or higher
• Sessions expire after 30 days, and you can sign out any individual device from your account settings
• Passwords are stored only as salted PBKDF2 hashes, and two-factor authentication is available
• Access to production systems is restricted to authorised personnel only
• We do not log or store access tokens in plaintext anywhere in our systems
• Errors sent to our monitoring provider are scrubbed of personal data first

In the event of a personal data breach that poses a risk to your rights and freedoms, we will notify the Cyprus Commissioner for Personal Data Protection within 72 hours of becoming aware. Where the breach is likely to result in a high risk to you, we will also notify you directly without undue delay.

9. Your rights under GDPR

If you are located in the European Economic Area or the United Kingdom, you have the following rights regarding your personal data:

• Right of access (Article 15): to request a copy of the personal data we hold about you and information about how we process it
• Right to rectification (Article 16): to request correction of inaccurate or incomplete personal data
• Right to erasure (Article 17): to request deletion of your personal data where there is no longer a lawful basis for us to hold it. You can also delete your account directly from Settings.
• Right to restriction of processing (Article 18): to request that we limit how we use your data in certain circumstances
• Right to data portability (Article 20): to receive your personal data in a structured, commonly used, machine-readable format and to transfer it to another controller
• Right to object (Article 21): to object to processing of your personal data based on our legitimate interests
• Right to withdraw consent: where processing is based on consent (push notifications, email digests, and analytics storage on aplon.io), you may withdraw consent at any time without affecting the lawfulness of processing prior to withdrawal
• Right not to be subject to automated decision-making: we do not make solely automated decisions that produce legal or similarly significant effects about you

To exercise any of these rights, email contact@aplon.io. We will respond within 30 days. We may ask you to verify your identity before processing your request.

You also have the right to lodge a complaint with the Cyprus Commissioner for Personal Data Protection (dataprotection.gov.cy) or the supervisory authority in your country of residence or place of work.

10. Your rights in the United States

If you live in a US state with a comprehensive privacy law — California, Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Delaware and a growing number of others — you have the rights set out below. We honour them for residents of every US state, whether or not we currently meet the thresholds that would make a particular law apply to us.

10.1 Which data this covers — please read this first

Aplon holds two different kinds of personal information, and your route to exercising a right depends on which one you are asking about.

• If you are an Aplon merchant or user — your account, usage and billing data (sections 2.1, 2.8, 2.9, 2.10). For this we are the business, and the rights below are ours to answer. Contact us directly.
• If you shopped at a store that uses Aplon — the Shopify customer records in section 2.2 and the storefront analytics data in section 2.3. For this the merchant is the business and Aplon is only their service provider: we hold the data on that merchant's instruction and process it solely on their behalf. Please send your request to the store you purchased from, and they will instruct us. If you contact us directly we will tell you so, and we will act on any request the merchant or Shopify forwards to us — including a deletion request Shopify passes on under its own shopper-privacy process.

10.2 Categories of personal information we collect

Using the categories named in the California Consumer Privacy Act. This describes information about you as an Aplon user; the full detail of what each item is, and where it comes from, is in section 2.

Where it comes from: from you directly, from the platforms you choose to connect (Shopify, Meta, Google, Snapchat, Klaviyo), from your use of the service, and from our payment provider. Why we collect it: the purposes are listed in section 4. Who we disclose it to: the sub-processors named in section 5, each for the stated operational purpose only. How long we keep it: section 7 sets the retention period for each kind of data — it is not repeated here so there is only ever one copy to maintain.

10.3 Sensitive personal information

The only sensitive personal information we hold is what lets you into your own account: your log-in credentials, stored as a salted PBKDF2 hash together with your two-factor secret and recovery-code hashes (section 2.1). We use it for one thing — authenticating you — and for the security and fraud-prevention purposes the law permits without further consent. We do not use or disclose it to infer characteristics about you. Because of that, the right to limit the use of sensitive personal information does not arise here; there is no additional use to limit.

10.4 We do not sell or share your personal information

We have not sold personal information, and we have not shared it for cross-context behavioural advertising, in the preceding twelve months — using those terms as the CCPA defines them. We do not run third-party advertising or retargeting technology anywhere: no Meta Pixel, no Google Ads conversion tag, no Google Analytics, no advertising cookies (section 2.11). We do not use your data for targeted advertising or sell it under any other state's definition either, and we have no knowledge of selling or sharing the personal information of anyone under 16.

This is why you will not find a "Do Not Sell or Share My Personal Information" link on our site: there is nothing to opt out of. For the same reason, an opt-out preference signal such as Global Privacy Control has no selling or sharing to stop — we honour such signals as a matter of course by not carrying out the processing they are meant to prevent.

10.5 Your rights

• Right to know and access: to be told what personal information we have collected about you, where it came from, why we collected it, who we disclosed it to, and to receive a copy of it
• Right to delete: to have your personal information deleted, subject to the exceptions the law allows — chiefly the billing and tax records in section 7 that we are legally required to keep
• Right to correct: to have inaccurate personal information corrected
• Right to data portability: to receive your data in a portable, readily usable format
• Right to opt out of sale, sharing, targeted advertising and profiling: we do none of these, as set out in 10.4, so there is nothing to opt out of — but the right stands and we will honour it immediately if that ever changes
• Right to limit the use of sensitive personal information: see 10.3 — our only use is authenticating you, which the law permits without a limit right arising
• Right to non-discrimination: we will not deny you service, charge you a different price, or give you a lower quality of service for exercising any of these rights. We run no financial-incentive or loyalty programme tied to your data
• Right to appeal: if we refuse a request, you may appeal by replying to our decision or writing to the address below. We will respond to an appeal within 60 days, and if we uphold the refusal we will tell you how to complain to your state Attorney General

10.6 How to make a request

Email contact@aplon.io and say which right you are exercising. You can also delete your account and its data yourself, at any time, from Settings → Delete account — described in section 11.

We will confirm receipt within 10 business days and respond within 45 days. If we need longer we will tell you why, and take no more than a further 45 days. We will ask you to verify your identity first — normally by confirming control of the email address on the account — and for a request to know, we will match the request to the account before releasing anything. An authorised agent may act for you if they provide your written permission; we may still contact you to confirm it. Exercising these rights is free unless a request is manifestly unfounded or excessive, in which case we will say so rather than quietly ignore it.

10.7 California "Shine the Light"

Under Californian Civil Code section 1798.83, California residents may ask whether we disclosed personal information to third parties for those third parties' own direct marketing. We do not, and never have.

11. Data deletion requests

You can delete your Aplon account and all associated data at any time from Settings → Delete account. This immediately and permanently removes your login, every store connected to your account, your integration tokens and keys, your Aplo chat history, your team seats, and your notification subscriptions. Any active subscription is cancelled at the same time. Records we are required to keep for tax and accounting are listed in section 7. If you have connected a Meta Ads account, you can also revoke Aplon's access directly from Meta Business Integrations settings. For Google Ads, you can revoke access from your Google Account permissions.

12. Children's data

Aplon is not directed at children under the age of 16. We do not knowingly collect personal data from children. If you believe we have inadvertently collected such data, please contact us at contact@aplon.io and we will delete it promptly.

13. Changes to this policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email and by updating the "Last updated" date at the top of this page at least 14 days before changes take effect. Continued use of the service after that date constitutes acceptance of the updated policy.

14. Contact

Hallway Ltd (operating as Aplon)
Tefkrou Anthia 90, Ayia Napa, 5330, Ammochostos, Cyprus
contact@aplon.io