How Flockly handles your data

What Flockly collects

From your Shopify store

When you install Flockly you grant four read-only scopes. We request nothing beyond them:

• read_products Product titles, descriptions, images, prices, inventory status and URLs, so a post can be built from a product and linked back to it.
• read_orders Order totals and marketing attribution fields (referring source, UTM parameters, and, where Shopify grants access, customer journey summary data). Used only to attribute revenue to a channel, post or Shop Grid tile.
• read_all_orders Extends the same read-only order access beyond Shopify’s standard 60-day window. Flockly uses it for historical attribution in the reporting period you select.
• read_files Images and video already in your Shopify media library, so you can post them without re-uploading.

We also store your store’s myshopify.com domain, store name, and the Shopify access tokens that let the app act on your behalf. Tokens are stored encrypted at rest and are never exposed to the browser.

From you as the merchant

If you enter a display name or contact email in Flockly (for example in settings or onboarding), we store those fields with your shop record so we can personalise the app and reach you about the service. Support emails you send to hello@getflockly.com are kept only as long as needed to handle the request.

Your customers’ data

Flockly does not create, store or maintain customer profiles. We do not write customer names, email addresses, shipping addresses or payment details to our database.

Flockly reads order and journey information from Shopify (under the scopes and protected-customer-data access Shopify has approved for the app) and normalizes it for analytics. We store the Shopify order ID, order and update timestamps, current order value and currency, normalized attribution method and channel, and safe campaign or content identifiers when available. This lets us calculate historical aggregates without downloading the same large Shopify order history whenever you change a report range.

We do not retain raw referrer URLs, raw customer-journey payloads or customer identity fields in that attribution store. When Shopify sends a customers/data_request, Flockly records a privacy-minimal task using the request ID, store domain and one-way, shop-scoped hashes of the requested order IDs, together with a point-in-time copy of only those matching normalized fields. This limited compliance record can survive deletion of the active shop dataset long enough to answer a request already received. It never includes the customer object or direct customer contact data. We can confirm that no customer profile is held and, where required, provide the limited normalized fields to the store owner through our privacy process. When Shopify sends customers/redact with affected order IDs, Flockly deletes the matching normalized order-attribution records.

From your social accounts

When you connect Instagram, TikTok, Facebook, LinkedIn, Pinterest or X, we store the access tokens that authorise posting, along with the account handle, profile picture and the metrics each network reports (reach, engagement, follower counts, and similar).

For inbox and Auto-DM features we also process comments and direct messages on your own posts or threads. That can include other people’s public handles, profile images, message text and timestamps. We use this only to show you the inbox, send replies you choose, and run automations you configure. Disconnecting a channel deletes its tokens; related inbox state for that shop is removed with the rest of the shop data on uninstall or redact (see Deletion).

Content you create in Flockly

We store the posts, drafts, captions, uploaded and generated media, creative briefs, saved conversations, schedules, Shop Grid settings and reply history you create in the app so you can continue your work across devices.

AI features and creative tools

When you use AI Assist, Ask Flockly or Creative Studio, we send the information needed for your request to third-party AI service providers. Depending on the feature, this includes your message or creative brief, caption text, tone and channel choices, product details, reference images or video, and relevant conversation context. These services help us generate or edit text, images and video and respond to your requests.

For account-aware questions, Flockly reads the store information needed for the task, such as summary analytics, connected-channel status or saved posts. Access tokens and service credentials remain on our servers. We do not intentionally include Shopify customer names, contact details or payment information in AI requests. Please do not include sensitive personal information in your prompts or reference media.

We do not use your content, store data or metrics to train Flockly’s own models. Third-party providers process requests under the service terms and data-processing arrangements that apply to the feature. Review generated content before you publish it; proposed schedules require your confirmation.

Flockly Help assistant

If you use the optional website help assistant, the question you submit and up to six recent messages are processed by an AI service provider to answer from approved Flockly documentation. The website also uses a temporary random session identifier and your IP address for abuse prevention and rate limiting. The assistant does not access your Shopify store, social accounts, orders or Flockly workspace. Do not enter customer information, passwords, payment details or access tokens.

From this website

If you join the waiting list we store the email address you submit, and use it to tell you the app is live. There is no advertising or marketing-pixel tracking on this site, and no cookies are set for marketing purposes. Our host may keep ordinary server logs (such as IP address and requested URL) for security and reliability, for a short period.

Why we process it

• To provide the app Scheduling, publishing, Shop Grid, analytics, comment and DM inbox, Auto-DM, and optional AI content creation and assistance. Legal basis: performance of a contract.
• To keep the service working and secure Error diagnosis, abuse prevention, and rate-limit compliance with each network. Legal basis: legitimate interests.
• To bill you Handled by Shopify (see Payments). Legal basis: performance of a contract.
• To communicate with you Support, privacy requests, and material product notices. Legal basis: performance of a contract and legitimate interests.

We do not sell personal information, do not use it for cross-context behavioural advertising (as those terms are used in the CCPA/CPRA), and do not profile merchants or their customers for advertising.

Who else sees it

We use service providers to run Flockly. The categories below explain the work they do and the information they process. These arrangements do not change your privacy rights. For details of a provider involved in processing your information, contact hello@getflockly.com.

• Cloud hosting and media storage providers Host the app and website, store uploaded and generated media, and process delivery, security and reliability information.
• Database infrastructure providers Store your shop record, posts, settings, encrypted tokens, saved creative work and privacy-minimal normalised order-attribution records.
• Social account connection and publishing providers Process connected-account details and authorisation, the posts and media you choose to publish, social metrics, comments, messages and configured reply automations for the networks you connect.
• AI text, image and video service providers Process the prompts, selected reference media, product information and relevant context needed for the AI feature you use, including caption assistance, creative generation, account-aware assistance and answers from approved Help documentation.
• Social networks Meta (Instagram, Facebook), TikTok, LinkedIn, Pinterest and X receive the content you choose to publish, under their own terms and privacy policies.
• Shopify Your store data originates with Shopify, and billing runs through Shopify App Pricing.

Payments

Subscriptions are billed by Shopify on your regular Shopify invoice. Flockly never receives, processes or stores your card details.

Where data is held, and for how long

Data is processed in Australia. Our hosting, database and AI providers operate global networks, so some processing and backup may occur outside Australia; where it does, and where personal data moves out of the UK or EEA, our processors rely on Standard Contractual Clauses or an equivalent safeguard. Contact our privacy address for information about the providers, processing locations and safeguards relevant to your data.

• Shopify access tokens Kept while the app is installed; deleted on uninstall.
• Social access tokens Kept until you disconnect the channel or uninstall.
• Merchant name and email If provided, kept with the shop record until deleted on uninstall/redact or on request.
• Posts, drafts, creative work, Shop Grid and inbox Kept while the app is installed, then deleted within 30 days after uninstall unless you ask sooner.
• Shopify order attribution Normalized order-attribution records are kept while the app is installed so historical reporting works. A matching record is deleted when Shopify sends a customer-redaction request for its order ID; all remaining records are deleted with the shop after uninstall or shop redaction.
• Shopify customer data-request tasks The request ID, store domain, one-way order hashes and limited point-in-time disclosure are kept until the privacy request is completed, including when a later shop-redaction event erases the active store dataset. Completion immediately removes the disclosure. The completed request ID, store domain and one-way hashes are then deleted after 30 days.
• Social analytics snapshots Retained according to the applicable plan and provider history window, then deleted.
• AI Assist prompts Processed by our AI service providers to produce a response; we do not keep a separate long-term archive of prompts beyond ordinary app/server logs needed to run and secure the service.
• Saved creative conversations and media Kept with your workspace so you can return to a brief, conversation or result. They are removed with the shop data under the deletion process below. AI service providers may retain request data for the periods set by their applicable service terms and data-processing arrangements.
• Flockly Help questions Processed to produce an answer. We do not keep a transcript archive; short-lived rate-limit records contain a one-way identifier rather than the question text.
• Waiting-list emails Deleted once the launch email is sent, or on request.

Deleting your data

Uninstalling Flockly from your Shopify admin triggers Shopify’s app/uninstalled webhook. We mark the store uninstalled, revoke and delete its access tokens immediately, and purge the remaining store data within 30 days. Shopify’s shop/redact webhook, which arrives 48 hours after uninstall, erases the store record outright, including the connected social-account profile data we manage for that shop through our publishing providers.

You can also ask us to delete everything at any time, installed or not, by writing to hello@getflockly.com. We will confirm within 30 days.

Your rights

Depending on where you live you may have the right to access, correct, export, restrict or delete the personal data we hold about you, to object to processing, and to withdraw consent. Exercise any of them at hello@getflockly.com. We do not charge for this and we do not require an account to make a request.

Flockly Pty Ltd is an Australian company and handles personal information in line with the Privacy Act 1988 (Cth) and the Australian Privacy Principles. If you think we have handled your information badly, tell us first and we will try to fix it. If you are still unhappy you can complain to the Office of the Australian Information Commissioner (OAIC). If you are in the UK or the EEA you may instead complain to your own supervisory authority (in the UK, the Information Commissioner’s Office).

Security

Data is encrypted in transit (TLS) and at rest. Access tokens are stored server-side and never sent to the browser. Access to production systems is limited to the people who need it. No system is perfectly secure; if a breach affects your data we will notify you and the relevant authority as the law requires.

Children

Flockly is a business tool and is not directed at anyone under 16. We do not knowingly collect data from children.

Changes

If we change this policy we will update the date above, and for material changes we will tell you in the app or by email before the change takes effect.

Contact