Legal

Privacy Policy

Last updated: March 5, 2026

⚠ Important Disclaimer

CookieRay provides tools to help you comply with privacy regulations. It does not constitute legal advice. You are responsible for ensuring your store meets all applicable legal requirements. We recommend consulting a qualified legal professional for compliance guidance specific to your business.

1. Introduction

CookieRay is a cookie consent management app for Shopify stores, built and operated by CookieRay Team. This Privacy Policy explains how we collect, use, store, and protect data when you use the CookieRay app or visit CookieRay.com.

If you have any questions about this policy, you can contact us at app@cookieray.com.

2. What Data We Collect

2a. Data from Merchants (you, the store owner)

  • Shopify store domain and shop name
  • Email address (via Shopify OAuth)
  • Billing information (handled entirely by Shopify)
  • Banner configuration and settings
  • App usage data

2b. Data from Store Visitors (your customers)

  • Anonymized visitor ID
  • Consent action (accept / reject / customize)
  • Selected cookie categories
  • Anonymized IP address (4th octet removed)
  • Country code
  • User agent (shortened, e.g. "Chrome / macOS")
  • Device type (desktop / mobile / tablet)
  • Page URL where consent was given
  • Timestamp and consent expiry
  • Cookie snapshot at time of consent

3. How We Use This Data

  • Provide consent management services to merchants
  • Display consent analytics in the merchant dashboard
  • Generate consent audit logs and receipts
  • Maintain compliance records on behalf of merchants
  • Improve the app and fix issues

4. Data Storage & Security

  • Data is stored in a PostgreSQL database via Cloudflare Hyperdrive
  • All data is encrypted in transit (HTTPS/TLS)
  • No raw IP addresses are stored — IPs are anonymized by default
  • No personally identifiable information (PII) of store visitors is stored

5. Data Retention

  • Consent logs: Retained per the merchant's configured retention period
  • Merchant account data: Retained while the app is installed
  • On app uninstall: All shop data is permanently deleted

6. Data Sharing

  • We do NOT sell data to third parties
  • We do NOT share visitor data with third parties
  • Data is shared only with:
    • Cloudflare (infrastructure provider)
    • Shopify (as required by the platform)

7. Third-Party Services

  • Shopify — Platform and billing
  • Cloudflare Workers — Hosting and CDN
  • geojs.io — Visitor region detection (no PII sent)

8. Merchant Rights

  • Access your data via the CookieRay dashboard
  • Export consent logs as CSV
  • Delete all data by uninstalling the app
  • Request data deletion by emailing app@cookieray.com

9. Visitor Rights

  • CookieRay provides the consent mechanism on behalf of the merchant
  • Visitors can withdraw consent at any time via the preferences modal on the merchant's store
  • For data access or deletion requests, visitors should contact the merchant directly (the data controller)

10. Cookies on CookieRay.com

For details on how this website uses cookies, please see our Cookie Policy.

11. Children's Privacy

CookieRay is a B2B service for Shopify merchants. We do not knowingly collect data from children under the age of 16.

12. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will update the "Last updated" date at the top of this page. Material changes will be communicated via email to registered merchants.

13. Contact Us

If you have any questions or concerns about this Privacy Policy, please contact us: