Privacy Policy

Last updated: 30 April 2026.

Who we are

Kahu apps are published by Ikaika Creative Pty Ltd, an Australian company ("Kahu", "we", "us"). For privacy questions, email support@kahuhq.com.

Scope

This policy covers data we process when a Shopify merchant installs a Kahu app (currently Kahu Loyalty) and when their shoppers interact with surfaces our app provides (storefront blocks, customer-account extensions, checkout extensions).

What we collect

From the merchant's Shopify store

• Shop domain, shop ID, and the OAuth session for the granted scopes.
• Customer identifiers (Shopify customer ID, email) needed to attribute points to the right shopper.
• Order events (order ID, line items, totals, refunds, cancellations, edits) used to award and adjust points.
• Discount codes and checkout context required to redeem points at checkout.

From shoppers

• Points-balance reads triggered by the storefront and customer-account surfaces.
• Redemption requests during checkout.

We do not collect payment-card data. All payments flow through Shopify checkout.

Why we process this data

• Run the loyalty engine (award, adjust, redeem points).
• Honour refunds, chargebacks, edits, cancellations, and customer merges so balances stay correct.
• Provide merchant admin tooling and audit history.
• Comply with Shopify's mandatory webhooks and our legal obligations.

How we store it

Data lives in Neon Postgres (canonical store) and Cloudflare D1 (session storage), processed by Cloudflare Workers. We retain order and points data for as long as the merchant uses the app, plus a short window for support and dispute resolution.

Sharing

We do not sell personal data. We share data only with sub-processors required to run the service:

• Cloudflare (hosting, edge compute, session storage).
• Neon (managed Postgres).
• Shopify (the platform our apps run on).

GDPR and shopper rights

Kahu honours Shopify's mandatory privacy webhooks:

• customers/data_request — we return data we hold for the named customer.
• customers/redact — we delete or anonymise data for the named customer 48 hours after the request, per Shopify's contract.
• shop/redact — we delete shop data 48 hours after a merchant uninstalls.

Shoppers should direct access, deletion, or correction requests to the merchant whose store they shopped on. The merchant can forward verified requests to us via support@kahuhq.com.

Changes

We will update this page when our practices change and revise the "Last updated" date above.