Privacy Policy

Last updated: September 11, 2026.

1. Who we are

Flokte ("Flokte," "we") provides a return-behavior analysis tool to Shopify merchants. When a merchant installs Flokte, we act as that merchant's service provider / processor: we process store data on the merchant's instructions and on their behalf, not as an independent data aggregator, and we do not sell it. The terms of that relationship are in the Data Processing Agreement, and the language a merchant adds to its own storefront policy is on the merchant disclosure page.

2. Data we collect

From a merchant's connected store, we receive:

• Customer identifiers as provided by the platform — name, email address, and address. Email, name, and full address are stored encrypted; only coarse geography (country, region, and the first characters of the postal code) is kept in clear text, and only to test the classification for fairness across regions.
• Order history — order identifiers, dates, amounts, and fulfillment status.
• Return history — return identifiers, dates, return reason codes, refund amounts, and whether a return was attributed to store fault or customer fault.
• Scores and factors we derive from the above — the classification, the specific factors that produced it, and the model version that produced it.

Within a single store, we may match a shopper's guest and account checkouts by email so their return history is assessed as one person and cannot be split across identities. This matching never crosses stores.

We do not collect payment card or bank details, social media data, street addresses on individual orders, or any off-platform data, and we do not combine a merchant's data with any other merchant's data. Device fingerprinting is not part of Flokte today. If it is added in the future, it will be disclosed here with its own purpose limits and retention rules before any such data is collected.

3. Why we use it

We use store data for one purpose: detecting and preventing return abuse for the merchant whose store it came from. This includes classifying return behavior, producing explainable score factors, and enabling the merchant's configured reward and restriction rules. We do not repurpose this data for advertising, and any analytics feature is subject to a separate data-use review before it uses this pipeline.

When a merchant enables it, Flokte writes a small amount of data back to that merchant's own store: an internal tier tag on new orders, and discount codes for customers a reward rule matches. Flokte does not write to any storefront a customer sees, and writes nothing to any system outside the merchant's store.

4. Automated decisions and human review

Flokte produces automated classifications, but no shopper is permanently restricted or denied returns solely by an unreviewed automated output. Every restriction carries a notice, a plain-language reason, and a route to human review.

5. How to dispute a decision

If you believe a flag or restriction is based on inaccurate information, you can contest it. Submit a dispute (see Why was I flagged? or email disputes@flokte.com). A person investigates the specific returns and factors behind the flag, you receive a written resolution, inaccurate information is corrected, and any merchant that received an inaccurate flag is re-notified of the correction.

6. Retention

We set and enforce retention limits per data type through a scheduled deletion process rather than manual cleanup. Order and return records are retained only as long as needed for return-abuse prevention and dispute handling; derived scores are versioned and aged out on the same basis. Specific windows will be stated here on publication.

7. Your rights

Depending on your jurisdiction (including California, Colorado, Virginia, and Connecticut), you may have the right to access, correct, or delete data processed about you, and to opt out of certain profiling. Because we act on a merchant's behalf, we will route your request to the relevant merchant and assist in fulfilling it. Submit one on the privacy requests page or by email to privacy@flokte.com. Platform compliance requests from Shopify are acknowledged immediately and fulfilled within 25 days; after redaction, later access requests for that customer return no data found. If your concern is a specific restriction, see Why was I flagged? EU/UK data subjects are out of scope at launch; if that changes, GDPR/UK GDPR Article 22 protections will be addressed here.

8. Security

Data is encrypted in transit and at rest. Internal access to customer identifiers and scores is least-privilege, test and production environments are separated, and we maintain breach-notification readiness under applicable state law.

9. Cookies on this website

This marketing website does not set advertising or cross-site tracking cookies. If that changes, a disclosure and consent banner will be added before any such cookie is set.

10. Contact

Questions about this policy: privacy@flokte.com.