Shopify app sub-processors
These are the companies that handle personal data for the AffiliateTracking app for Shopify, what each one does and where. Last updated .
Each provider is bound by a written agreement with data protection terms at least as protective as our data processing addendum. Shopify itself is where your store's data comes from, under your own agreement with Shopify, so it isn't listed as our sub-processor.
1. Always used
| Provider | What it does | Where |
|---|---|---|
| Hetzner Online GmbH | Runs the one dedicated server that hosts the app, its database and its daily backups, in separate, isolated containers. The database is on an encrypted volume. Backups are encrypted with a key that isn't kept on the server, so only we can decrypt them. | Germany (EU) |
| Cloudflare, Inc. | DNS and TLS for our domains, protection against attacks, and the encrypted tunnel that carries all traffic to our server, including Shopify webhooks. Also hosts our website. | Cloudflare's global network. US company |
| Resend, Inc. | Sends app email: affiliate sign-in links, payout notices, your program emails and notices to you. | USA |
We don't send app data to outside logging, monitoring, analytics or error tracking services. Logs and metrics stay on our server. If that changes, we'll add the provider here first, as described in section 4.
2. Used only when turned on
These are used only when you or an affiliate choose the feature.
| Provider | When and what |
|---|---|
| Google LLC | When an affiliate signs in with Google. Google confirms their email address to us. |
| Meta Platforms (Instagram) and TikTok | When an applicant proves they own an Instagram or TikTok account. We receive the account's username only. |
| Browser push services (Google, Mozilla, Apple, Microsoft) | When an affiliate turns on portal notifications. Each message is encrypted for their browser, so the push service can't read it. |
3. Services you connect
These run through your own account with the provider, under your agreement with them. They're your providers, not our sub-processors. The app sends each one only what the feature you set up needs, and never sends shopper data to email marketing tools.
- Payouts: PayPal, Wise and Tremendous receive the payout details the affiliate gave (such as their PayPal or Wise email) and the amount, for payouts you approve.
- Email marketing: Klaviyo, Mailchimp and Omnisend receive affiliate data only, following each affiliate's marketing consent.
- Automation and API: Zapier, Shopify Flow, and webhooks or API keys you create receive the events you choose.
- Live chat in the affiliate portal: Crisp, Tawk.to or Tidio, if you add one.
- Link shortening: Bitly receives affiliate link addresses, if you add a Bitly token.
- Meta Conversions API: an affiliate's own Meta pixel receives order value, currency and a hashed order reference, never a shopper's details.
4. Changes to this list
Before we add or replace a sub-processor, we update this page and email the store address of every store using the app. If you object, tell us at support@affiliatetracking.co. If we can't resolve it, you can uninstall the app, and your data is deleted as described in the privacy policy.
Related: privacy policy, terms of service, data processing addendum.