What we protect, and how.

Where your data lives

App data is stored in Frankfurt, Germany, with Supabase. Error monitoring (Sentry) is also hosted in Frankfurt.

Some sub-processors are outside the European Union: Vercel (app hosting, computing in Frankfurt, US company), Resend (emails) and Anthropic (assistant). These transfers are covered by the EU-US Data Privacy Framework or by the European Commission’s Standard Contractual Clauses.

The full list, with the role of each one, is on the Sub-processors page.

What Hokku accesses in your store

Hokku asks Shopify only for the access its features need: products, inventory, discounts, cart, theme, files, orders, shipping, markets.

• Orders are used to measure your results: we read the order amount and the order number.
• Hokku stores no contact details of your customers: no name, no email, no address.
• Visits are linked to a random identifier, never tied to a name.

Every exchange is verified

• Every connection uses HTTPS. Browsers are told never to fall back to HTTP for one year.
• Every message Shopify sends to Hokku is checked with a signature. A message with a bad signature is rejected.
• Requests coming from your store are checked the same way.
• In your Shopify admin, the app opens with a session token issued by Shopify, valid for a limited time.

Under the hood: HSTS max-age 31536000 · HMAC SHA-256 signatures compared in constant time · nosniff, Referrer-Policy and Permissions-Policy headers, strict CSP on the App Proxy.

How long we keep your data

• When you uninstall Hokku, your sessions are deleted right away.
• About 48 hours later, Shopify asks for your store’s data to be erased: access tokens, support requests and conversations are deleted, and order numbers are anonymized.
• Your configuration is kept for 60 days, in case you come back, then deleted.
• Conversations with the assistant: 30 days.
• Support requests: 12 months. The reply-to address: 90 days.
• Deleted data can remain in backups for up to 7 days.
• Copies of the emails we send stay 30 days with our email provider, plus 7 days of backup.
• A data access request from one of your customers is answered within 30 days.

The details are in our privacy policy and our data processing agreement.

Backups and logs

• The database is backed up every day. Each backup is kept for 7 days.
• Supabase states: “All customer data is encrypted at rest with AES-256 and in transit via TLS.” (supabase.com/security)
• Error monitoring records no personal data, no IP address and no request content.
• Server logs are kept for 1 day, database logs for 7 days.

Our code is monitored

• Every change is scanned for a password or key left in the code.
• The libraries we use are checked continuously against databases of known vulnerabilities.
• Security fixes for these libraries are proposed automatically.
• Access to admin accounts is restricted and protected by strong authentication.

Under the hood: automated checks on every code change, across the full history, and continuous monitoring of known vulnerabilities.

Report a vulnerability

Write to support@gethokku.com. For a serious vulnerability, put “[URGENT]” in the subject line: these messages are read every day.

• Acknowledgement within 5 business days.
• First assessment within 14 days.
• A progress update at least once a month.
• We aim to ship a fix within 90 days, then agree with you on the publication date.
• Research carried out in good faith, within this policy, will not lead to any legal action on our part.