Privacy and data access

When you install Flockly, it requests four read-only Shopify scopes. These provide access to products, orders, older orders and files, plus the store domain and access tokens needed to run the app. The older-order permission lets the selected Analytics period include orders beyond Shopify's standard 60-day window.

How data is used

Flockly synchronizes Shopify orders into a privacy-minimal attribution record so changing an Analytics range does not download a large order history again. It stores the Shopify order ID, timestamps, current order value and currency, normalized attribution method and platform, and safe campaign/content identifiers when available. It does not store customer names, contact details, addresses, payment information, raw referrers or raw journey payloads, and it does not create or maintain customer profiles.

Shopify's customer privacy webhooks keep this store scoped. For a customer data request, Flockly records the Shopify request ID, store domain and one-way hashes of the requested order IDs, plus a point-in-time copy of only matching normalized attribution fields. This limited request record can remain long enough to answer the request even if a later shop-redaction event erases the active store dataset. It never includes the customer object or direct customer contact details. Completing the request immediately removes the point-in-time disclosure; the completed request ID and hashes are deleted after 30 days. A customer-redaction request removes matching active attribution rows, while shop redaction removes the remaining active store data described in the Privacy Policy. Social and content data is used for the features you enable.

Your content and AI

Flockly does not sell personal information and does not use your content or metrics to train its own models. AI Assist sends the material you submit for that request to an AI service provider to generate or rewrite a caption.

Ask Flockly sends your message and recent conversation context to an AI service provider to understand the request. For account-aware questions, Flockly's server reads only the store information needed for that task, such as summary analytics, connected-channel status or saved posts. Store identity, access tokens and provider credentials are never supplied by the assistant or accepted from its output. A proposed scheduling action records the exact drafts, revisions and times shown for review; scheduling begins only after you confirm it.

Creative Studio sends your brief, selected product information and reference images or video to AI service providers to create or edit the content you request. Saved conversations and creative results remain in your workspace so you can return to them. Only upload reference material you have permission to use, and avoid including sensitive personal information.

Ask Flockly's support answers use approved Flockly Help articles. Analytics answers report available source data and state when data is importing or unavailable instead of creating an estimate.

Full policy and data requests

Read the Privacy Policy for details of the data we process, the categories of service providers involved, retention and your rights. For a privacy or deletion request, use the contact details in that policy. For other account questions, use the Contact Us page.