1. Who we are
Ostia is a product of Creste LLC, a Washington, USA limited liability company. Creste LLC is the company responsible for this policy.
- Address: Creste LLC, Washington, USA
- Contact: our contact page
Ostia detects AI agents that visit online stores. It shows the store owner which AI agents visit and what they read, lets the store allow or block each agent, and reports agent visits, contact attempts and orders linked to agents, including in a weekly email.
2. Our two roles
For store visitors (shoppers and AI agents), the store is in charge of its own site. The store decides to install Ostia and why. We process visit data on the store's behalf and on its instructions. In GDPR terms, the store is the controller and Creste LLC is the processor. In CCPA terms, we act as the store's service provider. If you are a shopper, the store's own privacy notice applies to you as well, and the store is your first point of contact.
For store owners and people who contact us (our customers, people who ask about Enterprise, waitlist and audit sign-ups), Creste LLC decides what to collect and why. For this data we are the controller.
3. What we collect from store visits
Ostia runs through one of four installs: a Cloudflare Worker, a WooCommerce plugin, a Shopify app, or a script tag. Each sends visit data to our backend on Cloudflare. We classify each visit as AI agent or person using request and browser information.
Used in memory only, never stored
- IP address. Used only in memory, to classify the visit and to make a daily session key (below). It is then dropped and never stored.
- Full user-agent string and request headers. Used to classify the visit. We keep a short visitor label (for example the name of an AI agent), not the string itself.
Stored for each visit
- Time, store ID and the kind of event (page view, asset, timing summary and similar).
- The visitor label described above, instead of the raw user agent, and the cloud provider's name when the visit came from a data center (for example "AWS").
- A daily session key: a one-way hash of the date, a secret salt, the IP address and the user agent. It lets us group one visit's requests together on the same day. It changes every day, and without the secret the IP cannot be worked back out of it. It is still a pseudonymous identifier, and we treat it as personal data.
- Country code (two letters), when the install passes it on.
- A short technical summary of the request: yes/no flags and coded values that describe the browser software, not the person, and the referring site's host name or the
utm_sourcetag (never the full referring URL). - From the browser script, a summary of how the page was used, as counts and timings only. No positions, no keys typed, no text, no form contents and no element names leave the page.
- A few yes/no flags about the browser environment.
- The page type (for example "product" or "cart").
- Contact attempts, by kind only. When a visitor clicks a WhatsApp, chat, phone, email or contact-page link, we count it under that kind. We never record the number, address, message or anything typed.
- The holdout group ("doorman" or "holdout"), when a holdout test is running.
Stored as store business events
- Event time and kind, the agent operator (for example "OpenAI"), visitor type (agent or person), page path, rule result, agent offer code used, and holdout group.
- Orders linked to an AI agent: the store's order ID, order total, currency, agent operator, agent code and holdout group. On WordPress we also receive the order number and the session key with the order, and do not store them.
What we never collect or store
We do not store IP addresses, full user-agent strings, page content, customer names, email addresses, phone numbers, shipping or billing addresses, card details or payment credentials. We do not build profiles of shoppers across stores.
On this website we count page views with the referring site and campaign tags, and store no IP addresses or identifiers.
Data the store keeps on its own systems
- WooCommerce: for orders that came from an agent session, the plugin saves hidden order fields in the store's own database: session key, agent class, operator, holdout group and whether the order was sent to us.
- Shopify: the app embed adds hidden cart attributes (offer token, visit ID, agent class, operator, holdout group). Shopify copies them onto the order. The app reads them from the
orders/createwebhook.
4. What we collect from store owners and people who contact us
- Store accounts: store ID, domain, platform, the owner's report email, and when you sign in with Google, your name and the URL of your Google profile picture (we store the link, not the image, and show it in the account menu), and a hash of the store's API key (never the key itself). Agent rules the store turns on or off.
- Shopify app: Shopify session records (the shop's domain and access token), shop settings (holdout percent, approved store facts) and a log of privacy requests Shopify sends us.
- Stores started without an account: the store address you typed, the free audit it came from, and a hash of a random token kept in your browser's cookie, so only that browser can open the store. If you save your dashboard to an email, we keep a hash of the email to attach the store to you at your first sign-in, and, for stores saved while sign-in was not open yet, an encrypted copy to send you one email when it opened. The encrypted copy is deleted when you sign in.
- Sign-up and Enterprise request forms: company, store URL, platform, email, plan interest and notes.
- Contact form: name, email, company and message.
- Waitlist and alerts sign-up: email address and sign-up time.
- Free audit: if you ask for a follow-up, your email, company, the audited URL and its result, with your consent. To limit abuse, the audit tool counts requests per day under a salted hash of the IP address, not the IP itself.
- Emails you send us and our replies.
- Payments: paid plans are billed through Stripe. When the Shopify app is live, stores that pay in the app are billed through Shopify. Stripe or Shopify handles card details; we do not see or store them. We keep your plan, its billing status and the Stripe customer and subscription IDs.
5. Why we use it, and our legal bases
| Purpose | Data | Legal basis (GDPR / UK GDPR) |
|---|---|---|
| Telling AI agents from people and applying the store's allow or block rules | Visit data | Processed for the store. The store's basis applies, usually its legitimate interest in running and measuring its shop. |
| The store's dashboard and weekly report | Visit data, business events, orders linked to agents | Processed for the store, as above |
| Running the service, billing and support for store owners | Store account data | Performance of our contract with the store |
| Answering sign-up and Enterprise requests, contact messages, waitlist and audit follow-ups | Contact details you give us | Steps you asked for before a contract, and our legitimate interest in replying. Audit follow-ups: your consent. |
| Security, abuse prevention and fixing faults | Hashed rate-limit keys, short-lived service logs | Our legitimate interest in keeping the service safe |
| Improving detection | See section 7 | Our legitimate interest, and only as described there |
| Meeting legal duties | Records we must keep | Legal obligation |
We only use your email to contact you about Ostia. We do not sell personal information, and we do not share it for cross-context behavioral advertising.
6. Cookies and browser storage
Ostia sets no advertising cookies and no third-party cookies. Stores that use a cookie banner should list the cookies below.
| Name | Set by | Purpose | Lasts | When |
|---|---|---|---|---|
doorman_arm | Browser script, WordPress plugin | Which test group the visit is in: "doorman" or "holdout". No ID. | 60 days | Only while the store runs a holdout test. Measurement cookie. |
doorman_agent | WordPress plugin | Links an AI agent's visit to its order, so the order can be counted. Holds the session key, agent class, operator and holdout group, signed. HttpOnly. | 1 day | Only for visits classified as AI agents. |
lab | Cloudflare Worker | A test label | 1 hour | Only when a link carries one of our own test labels. Used for our testing. |
doorman:sent (session storage) | Shopify app embed | The last cart attributes it wrote, so it does not write them again | Until the tab closes | On Shopify stores with the app embed. |
__Host-dm_start | This site, on /start | Lets this browser open the store it set up before sign-in opened. A random token; we keep only its hash. HttpOnly. | 90 days | Only after you set up a store without an account. |
In the EU, UK and similar places, a measurement cookie such as doorman_arm usually needs the shopper's consent. Stores can run Ostia in observe-only mode, which sets no holdout cookie.
7. Aggregated data and improving detection
Stores can opt in to shared reputation. It is off by default. For opted-in stores, we keep one row per day with counts only, under one-way hashes. It holds no session keys, IPs or user agents. These rows are deleted after 7 days. We also tune detection on labeled test visits that we create ourselves.
We may keep anonymous, aggregated totals from plans (for example how many agent visits and orders a store saw). These totals do not identify the store, its visitors or its customers.
We do not use shopper data from one store to profile shoppers on another store.
8. How long we keep data
| Data | How long |
|---|---|
| IP address, full user agent, request headers | Not stored. In memory for the request only. |
| Visit events and business events of a store | While the plan runs: 13 months (395 days), then an automatic job deletes them. When the plan ends, all of the store's data is deleted within 30 days. We delete sooner if the store asks. Reports and dashboards only read the last 30 days. |
| Shared reputation rows (opt-in only) | 7 days |
| Anonymous, aggregated totals | May be kept, since they identify no one (section 7) |
| Shopify store data | Deleted when Shopify sends the shop/redact request, 48 hours after the app is uninstalled. App sessions are deleted at uninstall. |
| Store set up before sign-in opened, never installed or saved | 7 days, then an automatic job deletes it and everything tied to it |
| Store account | Deleted with the store's data, within 30 days after the plan ends. |
| Sign-up and Enterprise requests, contact messages, waitlist, alerts and audit leads | 13 months (395 days) after you sign up, then an automatic job deletes them. Sooner if you ask. |
| Service logs at our hosting provider (Cloudflare Workers Logs) | Our own log lines hold an event name, the service name and counts or error types. They hold no IP addresses, user agents, request headers, URLs, email addresses or store keys. Cloudflare's automatic per-request logs are turned off for our services. Cloudflare keeps these logs for 3 days on its Workers Free plan and 7 days on Workers Paid. |
| Cookies | See section 6 |
9. Who we share data with
We share data only with the service providers below, and only so they can run Ostia for us. We stay responsible for them.
| Provider | What for | Where | Status |
|---|---|---|---|
| Cloudflare, Inc. | Hosting of our Workers and D1 databases and the Shopify app (planned), service logs, and email sending for weekly reports | Global network, USA | In use |
| Shopify Inc. and affiliates | For Shopify stores: app installs, webhooks and app billing | Canada, USA and others | Planned, app not live |
| Stripe, Inc. | Plan payments outside Shopify | USA | In use |
We may also disclose data if the law requires it, or to a buyer of the business, who would be bound by this policy.
10. International transfers
Creste LLC is in the United States, and our providers process data in the US and other countries. When we receive personal data from the EU, the UK or Switzerland, we rely on the European Commission's Standard Contractual Clauses (with the UK addendum where needed), which are part of our Data Processing Addendum. For Israeli data, we rely on the transfer conditions in Israel's Privacy Protection (Transfer of Data to Databases Abroad) Regulations, including a written commitment to protect the data.
11. Your rights
Depending on where you live, you may have the right to access, correct, delete, or get a copy of your personal data, to object to or restrict its use, and to withdraw consent. California residents have the right to know, delete and correct, and not to be treated differently for using these rights. Israeli residents have the right to review and correct information held about them.
Shoppers: please contact the store first, because the store controls this data. We help the store answer. You can also write to us. Note that we usually cannot link visit data to you, because we keep no IP address or name and the session key changes daily. If we cannot identify you, we will say so.
Store owners and other contacts: write to us through our contact page. We answer within 30 days. We may ask you to confirm who you are.
You can also complain to your data protection authority, such as your EU or UK supervisory authority or Israel's Privacy Protection Authority.
12. Children
Ostia is a business service for store owners. It is not directed at children, and we do not knowingly collect data about children. Visit data contains no names or contact details, so we cannot tell a visitor's age.
13. Security
Data is sent over HTTPS. Store API keys are stored only as hashes. Every store query is limited to the authenticated store. Secrets live in our hosting provider's secret store. Shopify webhooks are checked against Shopify's signature. Access to production systems is limited to Creste's owner. No system is perfectly secure. If a breach affects a store's data, we will tell that store within 72 hours of becoming aware of it, and tell others as the law requires.
14. Changes
We will post changes on this page with a new date. If a change materially affects how we use store data, we will email store owners at least 30 days before it takes effect.
15. Contact
Creste LLC, Washington, USA. Reach us through our contact page.
See also our terms of service and data processing addendum.