kobyKoby is run by Bluemoon. For the people who use Koby and for their accounts we decide how data is used. For the visitors and customers of a merchant's store and funnels, the merchant decides and we process that data on the merchant's behalf. Questions can go to support@agentkoby.com.
Name, email address, sign-in data, company membership and role, and the sessions and devices you are signed in on.
When a merchant connects a store, Shopify asks them to approve access to products, publications and themes, to read orders, and to set up and read a web pixel. Koby keeps the store domain, an encrypted access token and the approved scopes.
Koby changes a store only when a merchant asks it to: creating a product, adding page templates to a theme, or changing the cart drawer after a review.
From orders Koby keeps order and line item numbers, product numbers, timestamps, status, amounts, currency, refunds and the source of the visit. Orders are read so a merchant can see revenue and which funnel earned it. There is no column for a customer name, address, email, phone number or customer number.
A funnel hosted by Koby starts measuring when the page loads. It places a first-party cookie (fn_sid, 30 days) when the funnel shares a domain with the store, and keeps a random session number in the browser's local storage and the campaign fields in session storage. It sends which page was viewed, clicks to the next page or checkout, the session number, and the source, medium and campaign of the visit.
The Koby web pixel in a connected store sends the same kind of event from the store and checkout.
Koby shows no consent banner on hosted funnels. A browser that sends Global Privacy Control is not measured: no session, no events and no advertising pixel start. Merchants are responsible for their own legal basis for measuring their visitors and for what their own privacy policy tells them, as the terms of service set out. A merchant can add an advertising pixel to a funnel; it then also starts on page load, and that data goes to the provider the merchant chose.
Pages, images, source links and instructions. To build and edit pages, this content is sent to the AI providers listed below. Those requests are made on your behalf; we do not use your content for advertising and we do not sell it.
Supabase runs the database and sign-in. Cloudflare stores files, serves hosted funnels and handles custom domains. Shopify is the source of store and order data and of billing. Anthropic and OpenAI process text and images when you ask Koby to build or edit something. Our own servers run the app and its background work. They process data only to run the service. We share data with nobody else, unless the law requires it.
Raw browser events: 90 days. Totals per minute, hour and day: 13 months. Orders and refunds: 13 months. Incoming Shopify messages: 7 days after they are handled, or sooner when a redaction reaches them. Customer data exports: 30 days. When a customer is deleted, a one-way hash of their identifier stays, so that the same data does not come back later.
Shopify passes on a customer's data and deletion requests. A data request appears in the merchant's Connections screen with its deadline and a file to hand over. A deletion request removes that customer's orders and linked browser events, including those from hosted funnels. Customers should send requests to the merchant they bought from.
When a merchant uninstalls the app, Koby deletes the access token at once and stops collecting from that store. When Shopify asks for the shop's data to be deleted, which it does 48 hours after an uninstall, its orders, events and exports are deleted.
You can ask us which data we hold about you, have it corrected or deleted, or object to its use. Email support@agentkoby.com and we answer within 30 days. You may also complain to your data protection authority.
If this policy changes we update this page and the date below.
See also the terms of service, with our data processing terms. Last updated 6 November 2026