Privacy Policy

Kensa Reports & Insights (“Kensa,” “we,” “us,” or “our”) is an analytics and reporting application for the Shopify platform, provided by EQUINOXEDGE LTD, a company registered at Theopateron 3, Limassol, 4150, Cyprus (“Company”). This Privacy Policy explains what data we collect through the App, why we collect it, how we protect it, and the rights available to merchants and their customers.

Last updated: August 3, 2026.

1. Who We Are, and Our Role Under Data Protection Law

Kensa is installed by Shopify merchants (“you,” “Merchant”) to generate analytics and reports about their store’s orders, products, and customers. In relation to your own store and account data, Kensa acts as an independent data controller. In relation to the personal data of your customers (contained in your orders, checkouts, and customer records), Kensa acts as a data processor, processing that data solely on your instructions and for the purpose of providing the App’s reporting features — never for its own independent purposes. The terms of that processor relationship are set out in our Data Processing Agreement, incorporated into our Terms of Service.

2. What Data We Collect

The App requests the following Shopify API access scopes, each mapped to a specific reporting feature. We do not request or collect any data beyond what these scopes provide:

• read_orders / read_all_orders — order details (pricing, discounts, tax, shipping, fulfillment and financial status, sales channel, order-level city/country) powering the Overview, Profit & Loss, and Customer Behavior reports.
• read_customers — customer records (name, email, order count, total spend, first/last order dates) powering customer segmentation, cohort retention, and repeat-purchase analysis.
• read_products — product and variant details (title, cost per item) powering profit-margin calculations.
• read_discounts — discount code usage, powering discount-performance reporting.

We also collect basic store profile information (store name, owner name, contact email, phone number, country, primary domain, Shopify plan) automatically when the App is installed, so we can identify and support your account.

We do not collect payment card details — all billing for the App itself is handled directly by Shopify (Shopify App Pricing); we never see or store your card information.

3. Why We Process This Data

We process this data solely to provide and improve the App’s core function: generating reports and analytics that are displayed back to you, the Merchant, within the App. This includes:

• Calculating revenue, profit, and margin figures for the Overview and Profit & Loss pages.
• Segmenting and analyzing your customers (RFM segmentation, cohort retention, reorder timing) for the Customer Behavior page.
• Detecting and alerting you to goal progress or margin thresholds you configure.

We do not use this data for advertising, do not sell it, and do not share it with any third party except the infrastructure sub-processors described in Section 6, who process it only on our instructions to help us deliver the App.

4. How We Store and Protect Your Data

• All data is stored in a PostgreSQL database hosted in the EU (Frankfurt), encrypted at rest using AES-256 encryption, including automated backups.
• All data in transit — between Shopify, the App, and your browser — is encrypted using TLS/HTTPS.
• Test and production data are kept in fully separate databases.
• Access to production infrastructure is restricted to authorized Company personnel only.
• Webhook requests from Shopify are cryptographically verified (HMAC signature validation) before being processed, and application errors are monitored via an error-tracking service (see Section 6) to help us detect and respond to issues quickly.

5. Data Retention and Deletion

We retain data only for as long as the App remains installed on your store, and only as needed to provide the reporting features described above:

• If a specific customer’s data is deleted at your request or Shopify’s instruction (the customers/redact process), we erase that customer’s personal data and remove the link between their record and any associated orders, while retaining anonymized order totals only where needed for aggregate reporting accuracy.
• When the App is uninstalled, all data associated with your store — orders, customers, checkouts, store profile, subscription records, and login sessions — is permanently deleted within 48 hours (the shop/redact process), with no retention period beyond that.
• Where a Merchant or their customer requests a copy of the personal data we hold (the customers/data_request process), that data is available upon request.

6. Sub-processors and Data Sharing

We use a small number of infrastructure providers to operate the App, each acting as a sub-processor bound to process data only on our instructions:

• Render (hosting and database infrastructure, EU region) — stores all App data.
• Shopify (platform provider) — the source of all order/customer/product data processed by the App.
• Sentry (error monitoring) — receives technical error diagnostics to help us detect and fix bugs; we do not deliberately send customer personal data to this service.

We do not sell personal data, and we do not share it with any party for their own marketing or advertising purposes.

7. International Data Transfers

Our primary database infrastructure is located in the European Union. Where any sub-processor involves a transfer of data outside the EU/EEA, we rely on appropriate safeguards (such as Standard Contractual Clauses) as required by applicable data protection law.

8. Your Rights

If you are located in the EU/EEA, UK, or another jurisdiction with similar data protection laws, you (or, where applicable, your customers) may have the right to:

• Access the personal data we hold.
• Correct inaccurate personal data.
• Request erasure of personal data.
• Request a copy of personal data in a portable format.
• Object to or restrict certain processing.

Merchants: contact us using the details in Section 10 to exercise these rights. Customers of a Merchant store: requests concerning your personal data should generally be directed to the Merchant (the data controller for your data); we assist Merchants in fulfilling such requests.

9. Children’s Privacy

The App is a business-to-business tool intended for use by Shopify merchants and their staff. It is not directed at, and we do not knowingly collect personal data directly from, children.

10. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be reflected by an updated “last updated” date above, and, where required by law, we will provide additional notice.

11. Contact Us

Questions about this Privacy Policy or our data practices can be sent to info@kensaworks.com.