Privacy Policy
Effective date: October 24, 2026
Ratekin is a product reviews app for Shopify stores, provided by EKPK LLC ("we", "us"). This policy explains what information Ratekin processes when a merchant installs the app, how it is used, and the choices merchants and their customers have. For the personal data of a store's customers, the merchant is the controller and we act as their processor.
Information we process
| From | What | Why |
|---|---|---|
| The merchant's Shopify store | Store domain, store name and contact email; an access token Shopify issues to the app | To run the app for the store, set the default sender name and reply-to address for review emails |
| Orders (when an order is fulfilled, or when the merchant requests reviews for past orders) | Customer first and last name (from the billing address), email address, order number, and the products ordered | To send the customer one review request email, an optional reminder, and to mark their review as a verified purchase |
| People who write a review | Display name, email address (never shown publicly), star rating, review text and optional photos | To publish the review on the store and let the merchant moderate and reply to it |
| Unsubscribe requests | A keyed, one-way hash of the email address — not the address itself | To make sure someone who unsubscribed is never emailed again by that store |
| Reviews imported by the merchant | Whatever the merchant's export file contains (typically reviewer name, email, rating, text, photos and dates) | To move the merchant's existing reviews into Ratekin |
To limit spam, the address a storefront request comes from is used briefly in memory to count submissions. It is not stored.
We do not sell personal information, use it for advertising, or combine it across stores.
Where data is stored and who processes it
| Service | Purpose |
|---|---|
| Cloudflare, Inc. | Hosting and database (Cloudflare Workers and D1) |
| Shopify Inc. | The platform the app runs on; review photos are stored in the merchant's own Shopify Files |
| Resend (Plus Five Five, Inc.) | Delivering review request emails |
How long we keep data
- Reviews, review requests and settings are kept while the store has Ratekin installed, or until the merchant deletes them.
- When a merchant uninstalls Ratekin, review emails stop immediately. Shopify then asks us to erase the store's data (48 hours after uninstalling), and we delete everything we hold for that store.
- When a store's customer asks the store to delete their data, Shopify tells us and we remove that customer's details: their reviews are anonymised, their photos deleted, and their review requests removed. Only the keyed hash of an unsubscribed address is kept, so they are not emailed again.
Your rights
If you are a customer of a store that uses Ratekin, please contact that store first — it controls your data and can export or delete it. Stores receive customer data requests from Shopify, and Ratekin prepares the export for them. Every review request email also contains an unsubscribe link.
Merchants can export, edit or delete their reviews from the app at any time, and can contact us about anything in this policy.
Security
All traffic is encrypted in transit. Requests from storefronts are verified with Shopify's signatures, and Shopify webhooks with their HMAC. Access to production systems is limited to the people who operate the service.
Changes
We will post any changes to this policy on this page and update the effective date. Material changes will also be shown in the app.
Contact
EKPK LLC — support@ratekin.com