Sweepr privacy policy
Last updated 5 October 2026
Sweepr ("the app") is a Shopify app made by Twinsoft Innovations FZE, licensed by the Sharjah Publishing City Free Zone Authority, Sharjah, United Arab Emirates ("we"). It helps merchants find and clean up customer accounts that look bot-created. This policy explains what the app reads, why, and what happens to it.
What the app reads
When a merchant runs a scan, the app reads these fields for customers who have never placed an order, through Shopify's Admin API:
| Data | Why |
|---|---|
| First name, last name | Bot accounts use identical random names, placeholders such as "John Doe", links or spam words. |
| Email address and email-marketing status | Throwaway domains and random addresses are bot signals; the marketing status decides who an "unsubscribe" action applies to. |
| Creation date | Bursts of sign-ups in a few minutes are a bot signal. |
| Order count, amount spent, tags, the customer note, whether Shopify allows deletion | To guarantee the app never flags customers who have ordered, spent money, carry a protected tag or a merchant note. The note is only checked for being empty; its text is never shown, stored or logged. |
| Account status and whether the email is verified | An activated account with a verified email is treated as a likely real person and is never flagged as a "likely bot" on weak signals alone. |
The app does not read orders, payment details, addresses or phone numbers.
What the app stores
Nothing, persistently. The scan runs as a Shopify bulk operation; Shopify keeps the result file for up to 7 days in its own storage. The app reads that file, classifies it in memory, and shows the merchant the result. A copy of the flagged list (names, emails and reasons) stays in the server's memory for at most 30 minutes so pages load quickly, and is dropped sooner when the merchant runs a new scan or the server instance recycles. The app has no database and writes no customer data to disk.
Server logs record only technical events (for example "scan started" with the shop's myshopify.com domain, the Shopify user ID of the staff member who ran it, and counts). They never contain customer names or email addresses. Logs are kept for 30 days and are used to investigate problems and security incidents.
Billing data
On the Pro plan, deletions above the monthly allowance are billed by Shopify. For that, the app reports to Shopify only the store's ID and the number of accounts deleted in each run. No customer names, email addresses or other customer data are included.
Where it runs
The app runs on Amazon Web Services in the Asia Pacific (Mumbai) region. Data in transit is encrypted with TLS.
Who can see it
Only staff of the merchant's store with permission to view customers, inside the Shopify admin. We do not sell, share or rent any data, and we do not use it for advertising or to train models.
Actions the merchant takes
Tagging, unsubscribing and deleting happen only when a merchant confirms them, and are carried out by Shopify on the merchant's own store. Deleted customers are deleted by Shopify and cannot be restored by us.
Your rights and data requests
The app answers Shopify's mandatory privacy webhooks (customer data request, customer redaction and shop redaction). Because we keep no customer data beyond the 30-minute in-memory copy described above, there is nothing to return, and anything still in memory expires within 30 minutes. Customers should contact the store they bought from; merchants can contact us at the address below.
Uninstalling
Uninstalling the app removes its access immediately. Any tags it added stay on customer records until the merchant removes them.
Terms
Our role as your processor, sub-processors and breach-notification commitments are set out in the terms of service and data processing terms.
Contact
Twinsoft Innovations FZE, Sharjah Publishing City Free Zone, Sharjah, United Arab Emirates — hello@twinsoftinnovations.com