Skip to content
Legal

Privacy Policy

Last updated: October 15, 2026

1. Who We Are

All Over Apps ("we", "us", "our") is a company based in the United States. We run the website alloverapps.com and develop applications for e-commerce platforms including Shopify. This Privacy Policy explains how we collect, use, store, and protect information when you use our websites and applications, including Banners All Over and Anti-Fraud All Over.

2. Information We Collect

Merchant Data (App Users)

When you install one of our Shopify apps, we receive and store:

  • Shop domain, name, and email address (provided by Shopify during installation)
  • Shopify access token (used to communicate with your store on your behalf)
  • App configuration and settings you create (e.g., banner content, scheduling rules)
  • App usage and performance analytics (e.g., banner impressions, click-through rates)

Buyer Data (Anti-Fraud All Over)

When a store uses Anti-Fraud All Over, we process personal data of the buyers who place orders in that store. Section 4 explains what we process, why, and how long we keep it.

Storefront Visitor Data (Banners All Over)

Our storefront components (e.g., banner widgets) do not collect or transmit personal data from your store's visitors. Banner display logic runs client-side and does not send visitor information to our servers. When customer tag-based targeting is enabled, tag matching is performed using data already available in the Shopify storefront context and is not sent to or stored on our infrastructure.

Website Visitors

Our marketing website uses privacy-friendly analytics. We may collect basic usage data (pages visited, referral source) without personally identifying you. We do not use third-party tracking cookies.

3. How We Use Your Information

  • To provide, operate, and maintain our applications
  • To detect and prevent fraudulent orders for stores that use Anti-Fraud All Over
  • To process billing and subscriptions through Shopify's billing API
  • To communicate with you about your account, support requests, or product updates
  • To improve our products based on aggregated, anonymized usage data
  • To comply with legal obligations

We do not sell, rent, or share your personal information with third parties for their marketing purposes.

4. Anti-Fraud All Over

Anti-Fraud All Over is a Shopify app that checks every new order in a store for fraud. This section describes the buyer data it processes.

Our Role

The merchant who installs the app is the controller of their buyers' data. We process that data on the merchant's behalf.

Data We Process for Each Order

  • Order details: order number, totals and currency, a summary of the line items (SKUs and quantities), discount codes and payment gateway
  • Card BIN: the first digits of the card number, never the full card number
  • Buyer details: name, email, phone, billing address and shipping address
  • Connection details: IP address and its country, browser user agent and browser language. The country is looked up in a GeoIP database (DB-IP Lite) hosted on our own servers.
  • Customer history: Shopify customer ID, number of previous orders, amount spent and account age

Why We Process It

We use this data to detect and prevent fraudulent orders for the merchant:

  • Each order gets a risk score, based on the merchant's rules and on signals built into the app.
  • The app then takes the actions the merchant configured in Shopify: adding tags or notes, holding fulfillment, cancelling the order, or adding a Shopify risk assessment.
  • We send alert emails to the merchant.

Shared Fraud Network (Opt In)

Merchants can join a shared fraud network with their explicit consent. A store receives information from the network only if it also shares.

  • Identifiers from orders confirmed as fraud (email, phone, IP address and address) are shared only as keyed hashes (HMAC-SHA256 with a secret kept on our servers), never in clear text. These hashes are matched against orders in other member stores.
  • The network also builds anonymous aggregates (fraud rates by hour, amount band, email domain, IP and shipping country, and card BIN prefix) and rule patterns proven in at least 3 stores. None of them contain identifying values.
  • When a store leaves the network, it stops sharing at once and stops receiving.

The built-in global filters, written by All Over Apps, use no data from other stores.

Automated Decisions

Every order gets a risk score automatically. Holding an order only pauses it until the merchant reviews it, and orders are cancelled automatically only if the merchant turns that option on. Buyers can ask the store for a human review of any decision. The merchant can release the hold, mark the order as safe or run the check again.

Requests From Buyers

If you placed an order in a store that uses Anti-Fraud All Over, the store controls your data, so please send requests about it to the store. We answer the data requests Shopify sends us on the store's behalf, and you can also write to us at [email protected].

5. Data Storage and Security

Your data is stored in MongoDB databases on servers in the United States, hosted by OVHcloud US. We use industry-standard security measures including encrypted connections (TLS), access controls, and regular security reviews to protect your information. Shopify access tokens are stored securely and are only used to perform actions you have authorized.

Anti-Fraud All Over adds these protections for buyer data:

  • Buyers' personal data is encrypted at rest in the database with AES-256-GCM and can only be searched through keyed hashes. The keys are kept outside the database.
  • Database backups are stored encrypted in Cloudflare R2.
  • Every access to buyers' personal data in the app is logged.
  • Staff access is restricted.

6. Data Retention

We retain your data for as long as your app is installed and your account is active. When you uninstall one of our apps, your shop data is soft-deleted and permanently removed after 30 days. You may request immediate deletion at any time by contacting us.

For Anti-Fraud All Over:

  • Fraud checks are deleted automatically after 365 days.
  • Hashed entries in the shared fraud network are deleted at most 18 months after the last report.
  • Logs of staff access to personal data are deleted after 365 days.
  • Database backups are taken every 6 hours, and only the latest 28 are kept (about 7 days).
  • We honor Shopify's privacy requests: customer data requests and customer redaction.
  • When a store uninstalls the app, Shopify sends us a shop redaction request 48 hours later, and we then delete all of the store's data, including its contributions to the shared fraud network.
  • Deleted data can remain in the encrypted backups until they rotate out, about 7 days.

7. GDPR Compliance (European Users)

We comply with the General Data Protection Regulation (GDPR). As a data processor acting on behalf of Shopify merchants:

  • We implement all three mandatory Shopify GDPR webhooks: customers/data_request, customers/redact, and shop/redact
  • You have the right to access, correct, or delete your personal data
  • You have the right to data portability
  • You may withdraw consent or object to processing at any time
  • We will respond to data subject requests within 30 days

8. CCPA Compliance (California Users)

Under the California Consumer Privacy Act (CCPA), California residents have the right to:

  • Know what personal information we collect and how it is used
  • Request deletion of personal information
  • Opt out of the sale of personal information (we do not sell personal information)
  • Not be discriminated against for exercising these rights

9. Subprocessors

We use the following subprocessors to operate our applications:

  • OVHcloud US: hosting, on servers in the United States
  • Cloudflare: DNS, proxy, content delivery and encrypted backup storage (R2)
  • Amazon Web Services (SES): emails to merchants, such as fraud alerts
  • Sentry: error monitoring
  • Shopify: e-commerce platform, app integration and billing

Each third-party service processes data in accordance with their own privacy policies. We only share the minimum data necessary for each service to function.

10. Children's Privacy

Our services are not directed at children under 13. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us so we can delete it.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify affected users of material changes via email or in-app notification. The "Last updated" date at the top of this page reflects the most recent revision.

12. Contact Us

For privacy-related questions, data requests, or concerns, contact us at:

All Over Apps