Privacy Policy — Bot Shield Suite

Last updated: 14 August 2026

1. Controller

Onur Cirakoglu — Headon, Germany.
Email: hallo@headon.pro
Web: https://headon.pro

2. What the app does

Bot Shield Suite analyses a store's abandoned checkouts to detect bot-generated fake checkouts. Towards the merchant we act as controller for account administration and billing; for the store data the app processes on the merchant's instruction we act as a processor under Art. 28 GDPR. A Data Processing Agreement is available on request at hallo@headon.pro.

3. Data the app processes

• Shop domain and Shopify session tokens — to associate settings and billing with the store and authenticate against the Shopify Admin API. Legal basis: Art. 6(1)(b) GDPR.
• Checkout signals — for each abandoned checkout the app receives, it processes the email address only in memory to score it, and stores at rest a one-way SHA-256 hash plus the email domain, never the raw address. It also stores non-personal signals (permalink shape, referrer presence, a bot/suspect verdict).
• Mail-server lookup — to tell a real address from an undeliverable one, the app asks public DNS whether the email's domain publishes mail servers. Only the domain part leaves the server, never the address itself, and answers are cached so the same domain is looked up at most once a day. Legal basis: Art. 6(1)(f) GDPR (protecting the merchant's store from bot traffic).
• Customer tags — on a bot verdict the app may add a tag to the matching Shopify customer so the merchant can exclude them from email flows. This is written back to the merchant's store.

4. Where data is stored

On servers operated by Hetzner in Germany, and in the merchant's own Shopify store (tags). No customer data is sold or used for advertising.

5. Retention and deletion

Detection events are deleted automatically after the merchant-configurable retention window (30/60/90/180 days, default 90). On a Shopify customers/redact request the app deletes the matching hashed events; on app uninstall and shop/redact all data for the shop is deleted. You may also request deletion informally at hallo@headon.pro.

6. Sub-processors

Hetzner Online GmbH (hosting, Germany). Shopify Inc. (platform). No other sub-processors receive personal data.

7. Your rights

Under the GDPR you have the right to access, rectification, erasure, restriction, data portability and objection. Contact hallo@headon.pro; we respond within one month.

8. Changes

Material changes are announced in the app at least 30 days in advance. The version published here is authoritative.