Privacy policy
Effective July 2026 · Draft pending legal review
Short version: we collect what the app needs to work, we process your customers' emails on your behalf, and we never sell data. To anyone.
1. Who we are
Kelso ("we", "us") builds Shopify apps, including Kelso: Back in Stock Alerts. This policy covers data handled by our apps and by kelsohq.com. Contact: support@kelsohq.com.
2. What we collect
When you install one of our apps, we collect:
- Shop information. Your store name, domain, contact email, plan, and settings you configure in the app.
- Product and inventory data. Product, variant, and inventory-level data needed to detect restocks and match subscribers to the right variant.
- Subscriber data. Email addresses your customers submit through the "Notify me" widget, with the product and variant they asked about, timestamps, and send history.
- Usage and log data. Send logs (queued, sent, delivered, clicked), app settings changes, and technical logs used to operate and debug the service.
We do not collect payment card data. Billing runs through Shopify's billing system.
3. Your customers' data: we are the processor
Subscriber emails collected through the widget belong to your store. We process them on your behalf, as a data processor, solely to deliver the service: storing waitlists, sending restock alerts you trigger, and reporting results back to you. You are the data controller.
We never sell subscriber data, use it for advertising, or contact your customers for any purpose other than the alerts you configure.
4. GDPR and privacy rights
- We implement Shopify's mandatory privacy webhooks: customers/data_request, customers/redact, and shop/redact. Data subject requests routed through Shopify are honored automatically.
- Double opt-in is available and defaults to on for EU storefronts.
- Every alert email includes the context of the request: the customer asked to be told when a specific product came back. We treat that consent as narrow and self-expiring, not as marketing consent.
- Merchants and their customers may request access, correction, or deletion at any time via support@kelsohq.com.
5. Where data lives and who touches it
Data is stored with our infrastructure providers (currently Cloudflare for hosting and queues, Supabase for the database, and Resend for transactional email delivery). Each acts as a subprocessor under contract terms consistent with this policy. We do not share data with anyone else except when required by law.
6. Retention
We keep shop and subscriber data while the app is installed. When you uninstall, data is deleted following Shopify's redaction webhook schedule, typically within 30 days of Shopify issuing the redaction request. Aggregated, non-identifying statistics may be retained.
7. Security
Data is encrypted in transit and at rest. Access is limited to the people who operate the service. If a breach affects your data, we will notify you without undue delay.
8. This site
kelsohq.com is a static site. It does not set advertising cookies or run third-party trackers.
9. Changes
If this policy changes materially, we will note it here and email installed merchants before the change takes effect.