Privacy Policy

Last updated: October 16, 2026

Kimonix Ecommerce Ltd. and its affiliates (collectively, "Appricot", "we", "our" or "us") welcome you to Appricot. We are committed to protecting the privacy of our customers ("Customers") and their authorized users ("End Users", and together with Customers, "Users", "you" or "your"), and to giving Users transparency and control over the use of their data. We designed the Service to collect only the data it needs to work. This Privacy Policy supplements, and should be read together with, our Terms of Service (the "Terms"). Capitalized terms not defined here have the meaning given to them in the Terms.

This Privacy Policy describes how we collect, use, process and share information related to you when you use Appricot, the online service that lets Shopify merchants build apps for their own stores by describing them, runs those apps, and lets Users connect their own AI tools (the "Service"), together with the websites at appricot.ai and app.appricot.ai and any related services (collectively, the "Services").

PLEASE READ THIS PRIVACY POLICY CAREFULLY BEFORE USING THE SERVICES. YOU ARE NOT OBLIGATED BY LAW TO PROVIDE US WITH ANY PERSONAL INFORMATION. IF YOU DO NOT AGREE WITH ANY PART OF THIS POLICY, YOU SHOULD NOT USE THE SERVICES. BY CONNECTING A STORE, SIGNING IN TO OR USING THE SERVICES, YOU AGREE TO THE COLLECTION AND USE OF YOUR INFORMATION IN ACCORDANCE WITH THIS PRIVACY POLICY.

1. What information do we collect?

What is personal information? "Personal Information" is information that identifies an individual or that may, with reasonable effort or together with other information we have access to, enable the identification of an individual, or that may be of a private or sensitive nature relating to an identified or identifiable person. This includes associating a person with a persistent identifier such as a name, an identification number or a cookie identifier. Personal Information does not include information that has been de-identified, anonymized or aggregated so that it can no longer identify a specific person.

What categories of information do we collect?

• Information you give us when you use the Services ("Customer Data").
  • Account details: your name and email address, which we receive from Shopify (or Google, where that sign-in is offered) when you sign in, and the stores, organizations and roles you have.
  • Store details and credentials: your store's name and address, and the credentials of the app you create in your Shopify account to connect your store (client ID, client secret and automation token), which we store encrypted.
  • People you add: the email addresses and roles of the people you invite to your stores and apps.
  • Your apps: the descriptions and change requests you give our AI, the apps it writes for you and their earlier versions, and the data your apps save.
  • Support: the contents of your communications with us, for example by email.
  • Information we are required or authorized to collect by applicable law.
  You can view and change much of this information in the Service, and you can ask us to remove Personal Information you provided by writing to support@appricot.ai.
• Store data your apps work with. When you build, test and run apps, we access the data in your Shopify store that the access you granted allows and that the apps need, such as products, inventory, orders and customers. Data about your own customers ("Store Customers") can include their names, email addresses, phone numbers, addresses and order history. We process this data on your behalf, as described in Section 2 and in the Terms.
• Information we collect automatically.
  • Activity: which app ran, when, on which store, who or what started it (a person, a button, a store event, a schedule or a connected AI tool), and whether it succeeded, including error details.
  • Store events: the notifications Shopify sends us when something your apps listen to happens in your store, such as a new order.
  • Usage: how long each store had apps, and how much AI usage your requests consumed, which we need for billing.
  • AI connections: which AI tool you connected, when, and when it was last used.
  • System data: technical information such as your IP address and browser type, recorded in our server logs for security and troubleshooting.
• Information from other sources. Shopify (your identity, store details and the store data described above), Google (your name and email address, if you sign in with Google) and Paddle, our payment provider (your billing status, invoices and the country used for tax; never your full card number).

2. How do we use your personal information?

Legal basis. We collect, process and use your information for the purposes described in this Privacy Policy based on at least one of the following legal grounds:

• Performing our agreement with you: to provide the Services under the Terms, including building, testing and running your apps, maintaining and improving the Services, and developing new features.
• Legitimate interests: to detect, prevent and address fraud, abuse, security, usability, functionality or technical issues, and to protect the rights, property or safety of our Services, our Users or the public, as required or permitted by law, while applying safeguards that protect your privacy.
• Your consent: where we ask for your agreement to process your information for a specific purpose. You can withdraw your consent at any time.

Purposes of use. We use the information we collect to provide and operate the Services, build and test your apps against your store's data, run them when you, their events or their schedules call for it, bill you, support you, secure the Services, comply with legal requirements, and for other legitimate business purposes, including:

• Product improvement: analyzing use of the Services to prioritize and develop features, improve reliability and improve our support, using anonymized and aggregated information where we can.
• Legal requirements: complying with applicable law, protecting our legal interests, and responding to or defending against legal proceedings.

AI. When you ask Appricot to build or change an app, we share your request, the app's code, and samples of the store data needed to write and test it with our AI provider, Anthropic (Claude). Anthropic processes them solely to return a response and does not use them to train its models. We keep your requests and the versions they produced as each app's history, so you can see how it changed and restore an earlier version, for as long as the app exists. When you connect your own AI tool to Appricot, the information that tool receives from Appricot is handled by that tool's provider under its own privacy policy.

Data about Store Customers. We process data about your Store Customers only on your behalf and on your instructions, which are the Terms and the apps you build and enable. You are the controller of that data and we are your processor (or service provider). If a Store Customer asks us about their data, we will refer them to you and help you respond.

3. With whom do we share personal information?

We share your information with third parties, or allow them access to it, only in the following ways:

Third-party service providers. We share Personal Information with selected service providers that help us provide and operate the Services, under written terms that protect it ("Third-Party Service Providers"):

• Railway: hosting and databases, in the United States.
• Anthropic: the AI that writes and changes apps.
• Paddle: payments, invoicing and taxes, as our reseller and merchant of record.
• Shopify: where your store and its data live, and where your apps act.
• Google: sign-in, where offered, and the fonts our pages load.
• Cloudflare: domain name services and visit counts for our website.
• Our business, legal and financial advisors.

People you work with. The people you add to your stores, apps and organizations see what their roles allow, which can include your name, email address and activity. When you share an app with another store, the people on that store can use it.

AI tools you connect. When you or your people connect an AI tool to Appricot, it receives the information it requests within that person's access.

Law enforcement, legal proceedings and as authorized by law. We may disclose or allow access to Personal Information under a legal requirement or request, such as a subpoena, search warrant or court order, or in compliance with applicable law.

Protecting rights and safety. We may share Personal Information, with or without notice to you, if we believe in good faith that this will help protect the rights, property or personal safety of Appricot, any of our Users, or any member of the public.

Our affiliated companies. We may share Personal Information within our family of companies, current or future, for the purposes described in this Privacy Policy. If we or any of our affiliates undergo a change in control, including by merger, acquisition or purchase of substantially all of its assets, Personal Information may be shared with the parties involved.

We may also share your Personal Information in other ways with your explicit approval, or where we are legally obligated to. We may use and share non-personal information at our discretion. We do not sell your Personal Information.

4. Direct contact

With your consent, we may use the contact details you provided to tell you about our products and services. You can withdraw your consent at any time by writing to support@appricot.ai or by using the "Unsubscribe" link in the email.

We may also contact you with important information about the Services, for example about changes to our terms, your billing, an app that keeps failing, an AI connection, or service maintenance. You cannot opt out of these service messages.

5. Where do we store your information?

Information about Users is maintained, processed and stored by us and by our authorized affiliates and service providers in the United States and, as needed, in other countries where our service providers operate, in secured cloud infrastructure.

Although data protection laws in these countries may differ from those where you live, we, our affiliates and our service providers that store or process your Personal Information on our behalf are each committed to keeping it protected and secure in accordance with this Privacy Policy and industry standards. Where we transfer Personal Information from the European Economic Area, the United Kingdom or Switzerland, we rely on appropriate safeguards such as the Standard Contractual Clauses approved by the European Commission.

6. Cookies and similar technologies

A cookie is a small data file stored by your browser. We use only what the Service needs to work, and no advertising or analytics cookies:

• Sign-in cookie (kb_session): keeps you signed in to the account site, for up to 30 days or until you sign out.
• Sign-in step cookie (kb_login): protects the step where Shopify or Google confirms who you are, for up to 15 minutes.
• Browser storage: remembers the last store you signed in with, so signing in again takes one click. It stays in your browser and is not sent to us.

Inside the Shopify admin, Shopify sets its own cookies under Shopify's privacy policy. When you add a payment method or pay, Paddle's checkout sets its own cookies under Paddle's privacy policy. Our pages load fonts from Google Fonts, which receives your IP address under Google's privacy policy. Our website counts visits with Cloudflare Web Analytics, which uses no cookies and does not follow you across sites. You can block or delete cookies in your browser settings; the Service will not work without the sign-in cookies. Learn more about cookies at www.allaboutcookies.org.

7. Minors

You must be at least eighteen (18) years old to use the Services. We do not knowingly collect Personal Information from anyone under eighteen (18), and we may ask for proof of age at any stage to verify that minors are not using the Services.

8. Information security

We have implemented administrative, technical and physical safeguards to help prevent unauthorized access to, use of or disclosure of your Personal Information. Data is encrypted in transit, store credentials are encrypted at rest, apps run in an isolated environment with only the access they declare, and people see only what their roles allow. Access to your information within Appricot is limited to employees and partners on a need-to-know basis. Despite these measures, we cannot eliminate all security risks, and security breaches may happen. If you have questions about security, contact us at support@appricot.ai.

9. Data retention

We keep your information only for as long as you use the Services, or as needed for the purposes for which it was collected. In particular:

• Store events that Shopify sends us are deleted seven (7) days after they are processed.
• Removing an app from a store deletes that app's data and activity on that store. Deleting an app deletes it everywhere.
• Your AI requests and the versions they produced are kept as each app's history for as long as the app exists.
• Within thirty (30) days after you stop using the Services and ask us to close your account, we delete the information you provided, unless the law requires us to keep it. Records of billing and usage are kept as needed for tax, accounting and audit purposes.
• Deleted data may remain in our routine backups for up to twelve (12) months before the backup rotation removes it. Backups are used only for disaster recovery.

10. Your rights under applicable privacy laws

Depending on where you live, you may have the following rights regarding your Personal Information. To exercise them, contact us at support@appricot.ai. We may ask for information to confirm your identity before handling your request. If you are a Store Customer of one of our Customers, please contact that store first: it controls your data, and we will help it respond.

10.1 European Economic Area, United Kingdom and Switzerland (GDPR)

If you are in the European Economic Area, the United Kingdom or Switzerland, we process your Personal Information in accordance with the General Data Protection Regulation (EU 2016/679) ("GDPR") and its local equivalents. You have the right to:

• Access your Personal Information and receive a copy of the data we hold about you.
• Rectification of inaccurate or incomplete Personal Information.
• Erasure ("right to be forgotten") of your Personal Information in certain circumstances.
• Restriction of processing in certain situations, such as when you contest the accuracy of your data.
• Data portability: receive your Personal Information in a structured, commonly used, machine-readable format.
• Object to processing based on legitimate interests or for direct marketing.
• Withdraw consent at any time, where processing is based on consent, without affecting processing before the withdrawal.
• Lodge a complaint with your local data protection supervisory authority.

10.2 California (CCPA/CPRA)

If you are a California resident, the California Consumer Privacy Act of 2018 as amended by the California Privacy Rights Act of 2020 ("CCPA/CPRA") gives you the right to:

• Know what Personal Information we collect, use and disclose.
• Delete your Personal Information, subject to certain exceptions.
• Correct inaccurate Personal Information.
• Opt out of the sale or sharing of your Personal Information. We do not sell your Personal Information, and we do not share it for cross-context behavioral advertising: our website uses no advertising cookies or tags.
• Limit the use of sensitive Personal Information to what is necessary to perform the Services.
• Non-discrimination for exercising your privacy rights.

Categories of Personal Information collected: as described in Section 1, identifiers (name, email address, IP address), commercial information (store, order and billing data) and internet activity information (activity and usage records), for the business purposes described in Section 2. To submit a verifiable consumer request, contact us at support@appricot.ai. You may also designate an authorized agent to make a request on your behalf. We do not have actual knowledge that we sell or share the Personal Information of consumers under 16 years of age.

10.3 Virginia (VCDPA)

If you are a Virginia resident, the Virginia Consumer Data Protection Act ("VCDPA") gives you the right to access and confirm whether we process your Personal Information, correct inaccuracies, delete it, obtain a portable copy, and opt out of processing for targeted advertising, sale or profiling. We do not sell your Personal Information, use it for targeted advertising, or profile you in furtherance of decisions that produce legal or similarly significant effects. If we decline your request, you may appeal by contacting us at support@appricot.ai, and if you are not satisfied with the outcome, you may contact the Virginia Attorney General.

10.4 Colorado (Colorado Privacy Act)

If you are a Colorado resident, the Colorado Privacy Act ("CPA") gives you rights similar to those described for Virginia, including the right to access, correct, delete and obtain a portable copy of your Personal Information, and to opt out of targeted advertising, sale or certain profiling. You may exercise these rights by contacting us at support@appricot.ai. If we decline your request, you may appeal, and if you are not satisfied, contact the Colorado Attorney General.

10.5 Other jurisdictions

We comply with the data protection laws that apply where we operate, including Israel's Protection of Privacy Law and Singapore's Personal Data Protection Act. If your jurisdiction grants you privacy rights not listed above, contact us at support@appricot.ai and we will respond in accordance with applicable law.

11. Updates to this Privacy Policy

We may change this policy from time to time, so please revisit this page. We will notify you of substantial changes by notice in the Service or by email, and they will take effect seven (7) days after that notice. All other changes take effect on the "Last updated" date shown above, and your continued use of the Services after that date constitutes acceptance of them.

12. General information

This Privacy Policy, its interpretation, and any claims and disputes related to it, are governed by the laws of the State of Israel. Any such claims and disputes shall be brought in, and decided exclusively by, a court of competent jurisdiction in Tel Aviv, Israel.

This Privacy Policy was written in English and may be translated into other languages for your convenience. If a translated version conflicts with the English version, the English version prevails.

13. Questions?

If you have questions or comments about this Privacy Policy, email us at support@appricot.ai, and we will reply within a reasonable time. Appricot is operated by Kimonix Ecommerce Ltd., Aluf Kalman Magen St 3, Tel Aviv-Yafo, 6107075, Israel.