Shopify app privacy policy

This policy covers the AffiliateTracking app for Shopify: what it reads from your store, why, who else handles it, how long we keep it and how deletion works. Last updated 14 Oct 2026.

You control your store's dataWe never sell personal dataDeletion within 30 days

1. Who we are

AffiliateTracking is run by SAAS SEO AGENCY LLC, a US limited liability company ("we", "us"). "You" means the merchant who installs the app on a Shopify store. This page covers the Shopify app only. Our website and our other products are covered by the main privacy policy.

2. Your role and ours

You are the controller of your customers' data and your affiliates' data. We process it for you, only to run the app for your store, as your processor under the GDPR and your service provider under the CCPA. The terms for that are in our data processing addendum. We also follow Shopify's API License and Terms of Use.

For the details of you and your staff (your store's email address, the staff who use the app, and your plan), we are the controller.

3. What we read from Shopify

The app reads only what its features need, through Shopify's APIs and webhooks, with the permissions you approve at install.

Your store: store ID, myshopify and primary domains, store name, store email, time zone, currency and your app plan.
Orders: order ID and number, dates, payment status, totals, taxes, currency, line items (product, variant, quantity and price), discount codes used, refunds, returns, edits, cancellations and Shopify Payments disputes. We use these to credit the right affiliate, work out commission on what was paid, and reverse it when a sale is refunded or disputed.
Customer fields on orders: customer ID, email, name, shipping address and the IP address the order came from. We use them to stop affiliates earning on their own purchases, to spot duplicate accounts, to keep a returning customer with the affiliate who first referred them when you turn that on, and to send referral rewards. Where a check only needs a match, we keep a keyed hash (a scrambled fingerprint) instead of the value. We don't request phone numbers.
Products and collections: so you can set commission per product or collection, and exclude products.
Discount codes: the affiliate codes the app creates, so they stay in step with changes you make in Shopify.
Theme settings: read only, to show you whether the app embed is turned on. We never edit your theme.
Inventory unit cost: only if you turn on gift cost tracking.

4. On your storefront

The app embed and the Web Pixel run on your store to link a sale to the referral click that led to it.

Nothing happens without a referral. On a visit without a referral link or a stored referral, the embed makes no request and stores nothing.
Consent comes first. In Strict mode (the default) the embed waits for the shopper's marketing consent through Shopify's Customer Privacy API before it stores anything or sends a click. In Regional mode it does the same wherever Shopify says a consent banner is needed. A shopper who has said no is never tracked, in either mode. The Web Pixel declares analytics and marketing purposes, so Shopify loads it only with that consent, and it doesn't sell data.
What's stored on the device: a signed click token in the browser's local storage and in private cart attributes, plus short-lived session storage for the referral bar. The token is a random reference with no name or email in it. We set no cookies of our own.
What a click records: the affiliate's link or code, the landing page, the referring site, a hashed IP address, the browser and device type, and whether the link carried an ad click ID (present or not, never the value).
At checkout: the Web Pixel reads Shopify's page view and checkout completed events to join the click to the order.

5. What affiliates give us

When someone applies to or joins your affiliate or refer-a-friend program, the app stores what they enter on your signup form: usually name, email, social profiles and any questions you add. Once accepted, affiliates may add:

Payout details, such as a PayPal or Wise email. These are sealed with AES-256-GCM encryption, shown only masked, and only the affiliate can change them.
Tax forms and tax details (for example a W-9 or W-8BEN, or a VAT number), when you collect them.
A shipping address, if you send them a product gift.
Messages and files they send you through the portal.
Sign-in data: sign-in links sent by email, optional Google sign-in, optional two-factor authentication, and browser push subscriptions if they turn on notifications.

Affiliate accounts also hold their links, codes, clicks, commissions, payouts and the ledger behind them.

6. What we write to your store

The app writes back to Shopify so the data stays in your admin too: it creates or updates the Shopify customer for each affiliate and referred friend and adds a tag, and it creates the discount codes for your affiliates and rewards. Only if you turn on the feature does it tag orders, create URL redirects for vanity links, issue store credit or gift cards as commission payouts, or create draft orders for product gifts.

7. Why we use it

To credit orders to affiliates and work out commission.
To prevent fraud: self-referrals, leaked codes and duplicate accounts.
To show you why each commission was credited, held or reversed.
To run your customer referral rewards and product gifts.
To pay affiliates through the methods you choose, and send the emails you set up.
To keep the app secure, give support, and meet our legal duties.

Fraud checks never make a final decision on their own. They hold a commission until a person on your team releases or rejects it. They decide nothing about your shoppers.

8. What we never do

We never sell or rent personal data, or share it for advertising.
We never use one store's data for another merchant. Data is kept in a separate database schema per store. Data moves between stores only when the same owner links their own stores, and then only as hashes.
We never send shopper data to email marketing tools. Klaviyo, Mailchimp and Omnisend, when you connect them, get affiliate data only.
We never refund your buyers or move money from your store.

9. Who else handles it

We use a short list of providers to host and run the app. The full list, with what each one does and where, is on the sub-processor page. In short: Hetzner runs the server in Germany that hosts the app and its database, Cloudflare carries all traffic to that server and runs our DNS and website, and Resend sends email. We don't use outside logging or monitoring services.

Some services are used only when you or an affiliate turn them on, such as Google sign-in. Others connect through your own account, such as PayPal, Wise, Tremendous, Klaviyo, Mailchimp, Omnisend and Zapier. Those are your providers, and they get only the data needed for the task you set up.

10. Where it's stored and how

The app and its database run on one dedicated server operated by Hetzner Online GmbH in Germany, in the EU. They run in separate, isolated containers, and traffic reaches the server only through Cloudflare. We're a US company, and Cloudflare and Resend are US companies, so your data is also accessed from and sent to the US. That happens under the safeguards in our DPA.

All traffic over the internet uses TLS. Inside the server, the app reaches its database over a private network that can't be reached from outside.
The database is stored on an encrypted volume (LUKS2).
We back up the database every day. Each backup is encrypted with a key that isn't kept on the server, and is deleted after 14 days. Backups are kept on the same server for now. A copy in a second location is planned.
There's no point-in-time recovery. If we had to restore a backup, up to one day of data could be lost.
Shopify access tokens and payout details are sealed with AES-256-GCM.
Only our founder can reach the production server, with an SSH key. The server has no passwords. Our support team sees your store's data only if you add us as staff in your Shopify admin.
The app shows customer details masked. Every reveal, privacy request download and API read of them is logged.
Logs carry IDs, not names, emails, addresses or payout details.
Our test system runs on the same provider, kept separate, with fictional data only.

11. How long we keep it

Each period is enforced automatically. Most are enforced by a job that runs every day for every store.
Data	Kept for
Raw clicks and IP hashes	90 days. Daily totals without IPs stay.
Order IP hash	90 days
Checkout join records from the pixel	90 days
Shopper email and address hashes, and raw shopper email where used	Until the commission's hold period ends, plus 30 days
Referred friend's email	Until the reward is settled, then replaced by a hash 30 days later
Raw Shopify webhook messages	7 days
Affiliate profile, payout details and files	While the affiliate exists, or until a deletion request
Tax forms and files	7 years after the tax year of the affiliate's last payout
Creator prospects in the CRM	12 months after the last change
Spam signups	30 days
Email log	12 months
Log of staff access to customer data	2 years
Customer data request files	30 days after they're ready
Database backups	14 days
Server logs	Rotated by size, oldest first. They carry IDs, not personal details.
Commission amounts and the ledger	While you use the app. On a deletion request the person's identity is replaced with an anonymous marker, so your books still add up.

12. Data requests and deletion

Shopify passes customer privacy requests to the app through its mandatory privacy webhooks. We record each request when it arrives and finish it well inside Shopify's 30-day limit.

Customer data request: we gather every record about that person in your store, as a shopper and as an affiliate, into one sealed file. You download it in the app under Settings, Privacy requests, and we email your store address when it's ready. We never send it to the customer ourselves. You do. The file is deleted 30 days after it's ready.
Customer deletion: when Shopify sends the request, we remove the person's name, email, address, hashes and linked click data across your store's data, delete their profile, payout details, files and messages if they're an affiliate, and delete earlier request files about them. Commission amounts stay under an anonymous marker so your ledger stays correct. Tax records are kept for their legal period, then deleted.
Store deletion: see the next section.

Deleted data can stay in an encrypted backup until that backup is deleted, at most 14 days later.

13. When you uninstall

Billing stops.
We email your store address a one-click export (affiliates, codes, commissions, payouts and the ledger, as CSV). The link works for 7 days.
Shopify sends us its store deletion request 48 hours after you uninstall. We wait until the export link has expired, then delete your store's database schema, files and tokens. We keep one record that your store was installed and deleted, with the dates, as proof. Deletion finishes within 30 days of Shopify's request.
Encrypted backups that still hold your data are deleted within 14 days after that.
If you reinstall before deletion runs, nothing is deleted.
Affiliate discount codes stay active in your Shopify store until you turn them off.

14. Rights and contact

If you're a shopper or an affiliate of a store that uses the app, the store is in charge of your data. Contact the store to see, correct, export or delete it, and we'll help them do it. If you contact us directly, we'll pass your request to the store.

If you're a merchant, email us about your own data or this policy and we'll reply within 30 days. People in the EU and UK can also complain to their data protection authority.

If we change this policy, we'll update the date at the top. If a change affects data we already hold, we'll email your store address first. The app isn't meant for anyone under 16.

SAAS SEO AGENCY LLC
145 W 25th St, Fl 7
New York, NY 10001, United States
Email: support@affiliatetracking.co