Privacy Policy

eskopia is a Shopify storefront analytics platform built by AMNYA Technology, founded by Adel Ammari. A merchant ("store") installs a tracking script and webhook on their own Shopify store, and eskopia shows that merchant's own team real-time visitor activity, checkout behavior, and order data for their store. This policy covers data collected through eskopia itself: both about merchants who sign up for an account, and about visitors browsing a merchant's Shopify store.

To power live activity, analytics, and geolocation, the tracking pixel and webhook capture:

• A randomly generated visitor/session identifier (not tied to a real name unless checkout is reached)
• IP address, used only to derive an approximate city/country via an offline lookup: never sent to any external geolocation service
• Pages viewed, products viewed, cart activity, and checkout funnel stage
• At checkout: first name, last name, and order/payment status from Shopify's own checkout and order webhooks

We do not collect payment card details, passwords, or any data beyond what Shopify's pixel and webhook APIs already expose about a checkout. This data belongs to the merchant operating the store: eskopia processes it on their behalf, it is never sold, and it is never shared across merchants.

IP-to-city/country lookups use the DB-IP City Lite database, licensed under CC BY 4.0.

• Name and email address, used for login and team management
• A securely hashed password (bcrypt): we never store or can retrieve your actual password
• Billing status via PayPal Subscriptions: PayPal handles your payment details directly; we never see or store card numbers
• Notification integrations you configure (e.g. a Slack/Teams/Discord webhook URL), stored encrypted
• An audit log of account and settings actions, for security and support

How long visitor/checkout event history is kept depends on the store's plan. On the Standard plan it is deleted automatically once it is older than the store's retention window, which a store admin sets to 1 or 2 years in Settings. On the Enterprise plan it is kept until deleted, unless a store admin chooses one of those same windows. A store admin can also export the full event history as a CSV at any time, or trigger an immediate deletion of older event data. Order records are never automatically deleted. Deleting a store (done by AMNYA Technology platform staff on a merchant's request) permanently removes the store and all of its store data, including every visitor and order record, its team accounts and its settings; audit-log entries and data-request records about it are kept, without the link to the deleted store, as a record of what was done.

eskopia uses a single, essential session cookie to keep a logged-in merchant signed in (HttpOnly, SameSite=Strict, scoped to this application). It is not used for advertising or cross-site tracking.

Website analytics. On our public marketing pages (not inside the application) we count visits with Umami, an analytics tool we host ourselves, so your data goes to our own server and to no one else. It sets no cookies and stores nothing on your device. Each page view records the page, the site you came from, your browser language and screen size, and a country estimate from your IP address, which is not kept. It respects your browser's "Do Not Track" setting. We use it only to see how many people visit and which pages they read, on the basis of our legitimate interest in understanding and improving our website.

Optional advertising measurement. While we run paid advertising for eskopia, our public marketing pages can load a measurement service from our advertising partner, Gravity (trygravity.ai). It is off by default: it only loads if you click "Accept" on the cookie notice, and before that nothing from it is requested, set, or stored. If you accept, it sets two cookies on this site, gr_attrib (kept up to 180 days, remembers which ad brought you here) and gr_session (kept for 1 day), keeps related data in your browser's storage, and sends information about your visit to Gravity, such as the pages you view, how you arrived (for example, the ad you clicked), and technical details such as your IP address and browser type. We use this only to measure which of our ads lead to sign-ups. Our legal basis is your consent. See Gravity's own privacy policy for how they handle that data.

You can change your mind at any time with the "Cookie settings" link at the bottom of our home page: choosing "Reject" removes these cookies and stops the service from loading. We remember your choice in your browser's storage on this site (a small preference record that is not used for tracking). If you never choose, the advertising service never loads.

• PayPal: processes subscription billing; see PayPal's own privacy policy for payment data handling
• Shopify: the source of storefront/order data, via a merchant's own pixel and webhook installation
• Email delivery (for account, invitation, and notification emails)
• Gravity: advertising measurement on our marketing pages, only if you accept advertising cookies
• Optional, merchant-configured notification channels (Slack, a custom webhook, or browser push): only if the merchant sets them up
• ChatGPT (OpenAI): only if a merchant connects their Eskopia account to ChatGPT (see "Eskopia in ChatGPT" below)

A merchant can choose to connect their Eskopia account to ChatGPT. To do so they sign in to Eskopia and explicitly approve read-only access. ChatGPT then retrieves that store's Eskopia information through Eskopia's MCP interface when the merchant asks it a question, and can only see what that merchant's Eskopia account can see.

In response to those requests, Eskopia returns store information: visitor, order, revenue and conversion figures, including breakdowns by country, region, city, traffic source, landing page, device type, browser and time; funnel and checkout-step counts; product view, add-to-cart and sales figures; store setup and health status; anomalies Eskopia has detected; alerts visible to that account; that account's own notification and report settings; and summaries of individual orders and checkouts (time, amount, currency, country, region and city, number of items and the products ordered, checkout stage reached, and whether it was a first order). These responses are deliberately minimized: Eskopia's ChatGPT tools are designed not to return customer names or email addresses, order numbers, visitor IP addresses or visitor identifiers, secrets or credentials (including Shopify credentials), or raw event and order payloads. Information returned to ChatGPT is then handled by OpenAI under its own terms and privacy policy.

For security and support, Eskopia keeps a record of which ChatGPT tool was used, when and whether it succeeded (not the question asked or the answer), for 90 days. A merchant can disconnect ChatGPT at any time in Eskopia under My Settings, Connected apps (a store admin can disconnect any connection on their store); changing or resetting the account password also disconnects it.

AMNYA Technology platform staff can access a store's data for support purposes when needed: every such access is logged with a reason and visible in that store's own audit log, and access automatically expires after a short idle period.

Questions about this policy or a request to access, export, or delete your data can be sent to AMNYA Technology via amnyatech.com.