Privacy Policy

Last updated: October 7, 2026.

1. Who we are

Flokte ("Flokte," "we") provides a return-behavior analysis and order messaging tools to Shopify merchants. When a merchant installs Flokte, we act in two roles, and we do not sell personal data in either:

• For a store's own data we are that merchant's service provider / processor: we process it on the merchant's instructions and on their behalf.
• For the shared score described in Section 4 we decide ourselves how data from participating stores is combined, so Flokte is responsible for it (a controller / business in its own right).

The terms of the merchant relationship are in the Data Processing Agreement, and the language a merchant adds to its own storefront policy is on the merchant disclosure page.

2. Data we collect

From a merchant's connected store, we receive:

• Customer identifiers as provided by the platform — name, email address, and address. We use coarse location (country, region, and part of the postal code) to test the classification for fairness.
• Order history — order identifiers, dates, amounts, and fulfillment status.
• Return history — return and refund identifiers, dates, reasons and notes, refund amounts, and whether a return or refund was attributed to store fault or customer fault.
• Order messages, when a store turns them on — your phone number, the shipping address on the order, your replies, and the IP address and browser you reply from.
• Chargebacks — if you dispute a payment with a store that uses Shopify Payments, the dispute's reason, amount and dates.
• Scores we derive from the above — the classification and the factors behind it.

We match records by email address, including across participating stores for the shared score in Section 4. That shared score is the only combination of data across merchants.

3. Why we use it

We use store data to detect and prevent return abuse, for the merchant whose store it came from and, through the shared score, for the other stores that take part. This includes classifying return behavior and enabling each merchant's configured reward and restriction rules. Where a store turns them on, we also send order messages on its behalf: order confirmations, duplicate-order checks and requests to complete a shipping address. If you dispute a payment, we prepare the store's evidence from these records. We do not use this data for advertising.

4. The shared score across stores

Flokte runs a shared return-behavior score across the Shopify stores that use it (the "Flokte network").

• What is combined. If you shop at more than one participating store with the same email address, Flokte combines your order and return history from those stores and produces one tier and one score from it.
• Who receives it. Each participating store receives the resulting tier and score for its own customers.
• What it is used for. The same purpose as above: return-abuse prevention. The shared score is not sold.
• Stores can opt out. Taking part is the default, and a store can turn it off. An opted-out store is scored on its own data only, and its data is not used for any other store.
• You can opt out. You can ask us to stop combining your history across stores. Each store then scores you on your history with that store alone. Use the privacy requests page.

5. Automated decisions and human review

Flokte produces automated classifications. A person on the merchant's team reviews every restriction before it applies, and you can contest it (Section 6).

6. How to dispute a decision

You can contest a flag or restriction on the Why was I flagged? page or by email to disputes@flokte.com.

7. Retention

We keep data only as long as needed for the purposes above. The current windows are: order and return records, order message and chargeback records, scores and score history — up to 3 years; dispute records and the audit log — up to 7 years; webhook delivery records — 30 days. When a merchant uninstalls Flokte, the customer, order, order message, chargeback, return, score and dispute data for that store is erased within 30 days of the platform's erasure request, and that store's data stops counting toward the shared score as soon as it uninstalls.

8. Your rights

Depending on your jurisdiction (including California, Colorado, Virginia, and Connecticut), you may have the right to access, correct, or delete data processed about you, and to opt out of certain profiling. For a store's own data we act on the merchant's behalf, so we route your request to the relevant merchant and assist in fulfilling it. For the shared score we are responsible ourselves: we will tell you what was combined, correct it, and stop the cross-store scoring if you ask. We do not sell personal data; where a law treats making the shared score available to participating stores as "sharing", opting out stops it. Submit a request on the privacy requests page or by email to privacy@flokte.com. We respond within 45 days. If your concern is a specific restriction, see Why was I flagged?

If you are in the European Economic Area, the United Kingdom or Switzerland: the store you shopped with is the controller of your data and Flokte is its processor; for the shared score, Flokte is a controller and relies on its and the stores' legitimate interest in preventing return abuse. You have the right to access, correct, erase or restrict the data processed about you, to object to that processing, and not to be subject to a decision based solely on automated processing; a person reviews every restriction and you can contest it. Your data is stored in the United States under the safeguards set out in the Data Processing Agreement. You can also complain to your local data-protection authority.

9. Security

We protect data with encryption and access controls.

10. Cookies on this website

This marketing website uses one advertising tool: the Meta (Facebook) pixel, to measure how our ads perform. It loads automatically when you visit the site. It sets Meta's advertising cookies in your browser and sends Meta the pages of this site you view, along with your IP address and browser details; Meta may combine that with your Meta account and use it for advertising. To stop it, turn on Global Privacy Control in your browser (we honor that signal and do not load the pixel), block third-party trackers in your browser, or change your ad settings with Meta.

No order, return or score data is sent to Meta. We use no other advertising or cross-site tracking cookies.

The home page embeds a YouTube video, so Google receives your IP address and browser details.

11. Contact

Questions about this policy: privacy@flokte.com.