legal

Privacy Policy

Last updated: October 8, 2026

This Privacy Policy explains how AEKO Shop ("the Site"), operated by AEKO Intelligence Inc.("AEKO", "we", "us"), handles data. AEKO Shop is a brand and product content space designed to be read by AI engines. Most of the Site is public and requires no account, but merchants can connect a store and sign in to a dashboard, and those parts do involve personal data.

1. Browsing the public Site

Brand, product, and article pages are publicly readable with no account and no sign-in. For these visits we process:

• Server access logs — IP address, User-Agent string, requested URL, timestamp, and HTTP status code, used for security monitoring and abuse prevention. Retained for up to 90 days.
• No third-party tracking — we do not use Google Analytics, Meta Pixel, or any third-party analytics or advertising scripts anywhere on the Site.
• No advertising profiles — we do not build behavioural profiles of visitors and we do not sell or share personal data with data brokers.

2. Signing in and connecting a store

Some parts of the Site are not public: a merchant dashboard, store connection, and account pages. If you use them, we process:

• Account identity — your email address, and an identifier from your identity provider if you sign in through one. We use these to identify your account and the brands you may administer.
• Store connection data — when you connect a store, we store your store's domain and identifier, the permission scopes you granted, and access credentials for that store. Credentials are encrypted at rest and are never displayed back to you or exposed through any public surface.
• Merchant contact details — installing our app from a store platform creates no account and no login: the install itself identifies you. So that we can reach you about that install, the platform gives us the contact details it holds for your store — typically a registered contact email address, a contact phone number, and the company or store name. We refresh them when your catalog syncs. We use them to provide support and to send the messages described in section 5. They are never published on the Site, and we never sell or share them.
• An email address you give us — during setup or in your dashboard we may ask where to send you service notices and feature updates. Giving one is optional. We store the address you confirm separately from the platform contact details above, together with a record of what you agreed to, when, and on which screen. If you also agree to marketing email, we record that consent too; it is never assumed, and you can withdraw it at any time in your dashboard's Store settings.
• Session cookies — signing in or connecting a store sets a session cookie so we can recognise you on subsequent requests. It is HttpOnly (not readable by page scripts) and expires automatically.
• Browser storage — if you sign in with a Microsoft Entra account, the sign-in library stores tokens and sign-in state in your browser's localStorage and sessionStorage so you are not asked to authenticate on every page. Clearing site data removes it.

These are strictly functional. We do not set advertising or cross-site tracking cookies.

3. Store catalog and review content

When a merchant connects a store, we sync product information in order to publish it on the Site. Where reviews are synced, we use the review text and rating and we do not publish reviewer email addresses, account identifiers, or IP addresses.

Content published on the Site is public by design — that is the purpose of the service. Merchants control what is connected and can disconnect at any time.

4. AI agent and crawler visits

We record when an AI crawler or agent fetches a page, because showing brands which engines read their products is a core feature. For each visit we store the bot name derived from the User-Agent, the path requested, a two-letter country code, the User-Agent string, and the time.

We do not store the crawler's IP address. It is used transiently to verify the crawler against published vendor IP ranges and to apply rate limits. The address itself is never written to our database; the only derivative we retain is a one-way hash combining it with the bot name, path and time window, used solely to avoid counting the same visit twice. We record these only for recognised AI crawlers, not for human visitors.

These are automated requests. We do not attempt to identify or track the person behind an AI agent's request, and AI vendors do not transmit their end users' personal data to us.

4A. Public post reports

Anyone can report a public merchant article without signing in. We store the selected reason and the description the reporter submits. The form has no name, email address or other reply field, so we cannot respond through the form. Please do not put sensitive personal information in the description.

To limit automated abuse, we derive a daily-rotating one-way identifier from the request network address. The raw address is not stored with the report, and the short-lived rate limit counter is deleted after it expires.

5. Email we send you

If you have installed our app from a store platform, we send email to the contact address described in section 2. These are messages about your own installation: a welcome message explaining what we did with your catalog and what happens next, help getting set up, and notices about your connection or your plan. Some of them also describe our paid plans.

News, events and offers are sent only if you have agreed to marketing email, to the address you confirmed for it. Turning that off in Store settings takes effect immediately.

Every message carries an unsubscribe link. Unsubscribing stops all non-essential email. We may still send the few messages that are strictly necessary to operate your installation — for example, that your store connection has stopped working or that your plan has changed. We do not send you marketing on behalf of anyone else, and we never sell, rent, or share your contact address.

If your store is in Korea, any message carrying advertising is labelled as such in its subject line and identifies us as the sender, and an unsubscribe request takes effect immediately, as required by the Act on Promotion of Information and Communications Network Utilization and Information Protection (정보통신망법).

5A. Featuring your brand

In the same place we ask for your email, we ask whether AEKO Shop may feature your brand in AEKO's own promotional content, such as case studies, videos and posts. It is optional and does not affect the service. The box is shown already ticked; you can untick it before saving, or change it later in Store settings. If you agree, we may use your brand name, your logo and the product pages you have already published on the Site. We do not use private dashboard data for this.

We keep a record of each answer: what you chose, when, the language and the version of this policy you saw, and whether the box was shown ticked. Like your email address, that record is deleted when you uninstall the app. Turning the option off stops use in new content; we take down, on request, content we control that features your brand.

6. Third-party services

• Microsoft Azure — hosting, CDN, and identity. Subject to Microsoft's Privacy Statement.
• Azure Communication Services — the Microsoft service we use to deliver the email described in section 5. To send a message it processes your contact address and the contents of that message.
• Ecommerce platforms — when you connect a store, we exchange data with that platform (Shopify or Cafe24, depending on where you installed from) under the permissions you grant during installation.
• The AEKO platform — content published from your AEKO account reaches the Site through our own systems.

Links on the Site may lead to third-party brand websites, which have their own privacy policies. AEKO is not responsible for the privacy practices of external sites.

7. Data retention

• Server logs — up to 90 days.
• Bot visit records — retained to power the brand crawl dashboard.
• Public post reports — unresolved reports are retained while they are handled. The report category and description are deleted 90 days after resolution or dismissal. A handling audit that contains no report description is retained for up to 365 days.
• Merchant contact details — retained while your store connection is active, and erased with the rest of the connection data when you uninstall and the platform's data-deletion request is processed.
• An email address you give us — the address you confirmed and your consent record are retained while the app is installed, and deleted when you uninstall it.
• Unsubscribe records — if you unsubscribe, we keep a record of that decision indefinitely. That record is the only thing that stops us contacting you again, so it has to outlive the connection it came from.
• Account and store connection data — retained while your account or store connection is active. Disconnecting or uninstalling immediately revokes your sessions and stops the connection being used; the stored access credentials are erased when the platform's data-deletion request is processed, or on request.

8. Your rights

We hold personal data, so data protection rights apply. Depending on where you live, these may include the right to access, correct, delete, or export your personal data, to object to or restrict certain processing, and to withdraw consent. This includes rights under the EU/UK GDPR, the California Consumer Privacy Act (CCPA/CPRA), and Korea's Personal Information Protection Act (PIPA).

To exercise any of these, contact us at support@aeko-intelligence.com. We will respond within 30 days. You also have the right to complain to your local data protection authority.

9. Children's privacy

The Site is not directed at children under 13 (or the equivalent age threshold in your jurisdiction), and we do not knowingly collect their data.

10. Changes to this policy

We may update this Privacy Policy. The "Last updated" date above will change when we do.

11. Contact

For questions about this Privacy Policy, or about how AI agents may use Site content (see our Terms of Service), contact support@aeko-intelligence.com.