legal
Privacy Policy
Last updated: August 13, 2026
This Privacy Policy explains how AEKO Shop ("the Site"), operated by AEKO Intelligence Inc.("AEKO", "we", "us"), handles data. AEKO Shop is a brand and product content space designed to be read by AI engines. Most of the Site is public and requires no account, but merchants can connect a store and sign in to a dashboard, and those parts do involve personal data.
1. Browsing the public Site
Brand, product, and article pages are publicly readable with no account and no sign-in. For these visits we process:
- Server access logs — IP address, User-Agent string, requested URL, timestamp, and HTTP status code, used for security monitoring and abuse prevention. Retained for up to 90 days.
- No third-party tracking — we do not use Google Analytics, Meta Pixel, or any third-party analytics or advertising scripts anywhere on the Site.
- No advertising profiles — we do not build behavioural profiles of visitors and we do not sell or share personal data with data brokers.
2. Signing in and connecting a store
Some parts of the Site are not public: a merchant dashboard, store connection, and account pages. If you use them, we process:
- Account identity — your email address, and an identifier from your identity provider if you sign in through one. We use these to identify your account and the brands you may administer.
- Store connection data — when you connect a store, we store your store's domain and identifier, the permission scopes you granted, and access credentials for that store. Credentials are encrypted at rest and are never displayed back to you or exposed through any public surface.
- Session cookies — signing in or connecting a store sets a session cookie so we can recognise you on subsequent requests. It is HttpOnly (not readable by page scripts) and expires automatically.
- Browser storage — if you sign in with a Microsoft Entra account, the sign-in library stores tokens and sign-in state in your browser's
localStorageandsessionStorageso you are not asked to authenticate on every page. Clearing site data removes it.
These are strictly functional. We do not set advertising or cross-site tracking cookies.
3. Store catalog and review content
When a merchant connects a store, we sync product information in order to publish it on the Site. Where reviews are synced, we use the review text and rating and we do not publish reviewer email addresses, account identifiers, or IP addresses.
Content published on the Site is public by design — that is the purpose of the service. Merchants control what is connected and can disconnect at any time.
4. AI agent and crawler visits
We record when an AI crawler or agent fetches a page, because showing brands which engines read their products is a core feature. For each visit we store the bot name derived from the User-Agent, the path requested, a two-letter country code, the User-Agent string, and the time.
We do not store the crawler's IP address. It is used transiently to verify the crawler against published vendor IP ranges and to apply rate limits. The address itself is never written to our database; the only derivative we retain is a one-way hash combining it with the bot name, path and time window, used solely to avoid counting the same visit twice. We record these only for recognised AI crawlers, not for human visitors.
These are automated requests. We do not attempt to identify or track the person behind an AI agent's request, and AI vendors do not transmit their end users' personal data to us.
5. Third-party services
- Microsoft Azure — hosting, CDN, and identity. Subject to Microsoft's Privacy Statement.
- Ecommerce platforms — when you connect a store, we exchange data with that platform (Shopify or Cafe24, depending on where you installed from) under the permissions you grant during installation.
- The AEKO platform — content published from your AEKO account reaches the Site through our own systems.
Links on the Site may lead to third-party brand websites, which have their own privacy policies. AEKO is not responsible for the privacy practices of external sites.
6. Data retention
- Server logs — up to 90 days.
- Bot visit records — retained to power the brand crawl dashboard.
- Account and store connection data — retained while your account or store connection is active. Disconnecting or uninstalling immediately revokes your sessions and stops the connection being used; the stored access credentials are erased when the platform's data-deletion request is processed, or on request.
7. Your rights
We hold personal data, so data protection rights apply. Depending on where you live, these may include the right to access, correct, delete, or export your personal data, to object to or restrict certain processing, and to withdraw consent. This includes rights under the EU/UK GDPR, the California Consumer Privacy Act (CCPA/CPRA), and Korea's Personal Information Protection Act (PIPA).
To exercise any of these, contact us at support@aeko-intelligence.com. We will respond within 30 days. You also have the right to complain to your local data protection authority.
8. Children's privacy
The Site is not directed at children under 13 (or the equivalent age threshold in your jurisdiction), and we do not knowingly collect their data.
9. Changes to this policy
We may update this Privacy Policy. The "Last updated" date above will change when we do.
10. Contact
For questions about this Privacy Policy, or about how AI agents may use Site content (see our Terms of Service), contact support@aeko-intelligence.com.