BotSweep privacy policy

Last updated: 13 October 2026. BotSweep is made by PuzariCloud (puzaricloud.in), India. Contact: support@puzaricloud.in.

What we access

When a merchant installs BotSweep, we read customers, abandoned checkouts and orders through the Shopify Admin API, and receive webhooks when customers, checkouts, orders and payment transactions are created. We use this only to detect bot and card-testing activity for that store.

What we store

• For records flagged as likely bots: the Shopify ID, a display name, email address, amount, bot score and the reasons.
• Hashes (not the values) of emails, phone numbers and name-plus-address combinations on the store's checkout blocklist, and of recently seen identities, kept 48 hours.
• A log of actions taken (tags, consent changes, deletions, cancellations).
• Store settings. API keys and webhook URLs the merchant enters (for example Klaviyo or Slack) are encrypted at rest.

Records that don't look like bots are scored in memory and not stored.

Who we share it with

Nobody, except services the merchant turns on: Klaviyo (flagged emails are suppressed in the merchant's own Klaviyo account), Slack or the merchant's own webhook (alert text), and Brevo, which delivers alert emails to the merchant. We don't sell data or use it for advertising.

Retention and deletion

Activity counts are kept 15 days, identity hashes 48 hours. Detections and logs are kept while the app is installed. We act on Shopify's privacy webhooks: a customer redaction request deletes that customer's records, and all data for a store is deleted 48 hours after uninstall when Shopify sends the shop redaction request.

Security

Data is stored on our own server in the EU (Hetzner), reachable only over HTTPS. Access is limited to the developer.

Your rights

Merchants can ask us to export or delete their store's data at support@puzaricloud.in. Shoppers should contact the store they bought from, which controls their data.