Privacy policy
Last updated September 29, 2026
Mint Affiliates is a Shopify app made by Mint Labs ("we", "us"). It lets a merchant run an affiliate program: affiliates get referral links and discount codes, paid orders are credited to them, and the merchant records commission payouts. This policy explains what the app handles about merchants, affiliates and shoppers, why, and when it's deleted. For affiliate and shopper data we act as a service provider (processor) to the merchant, who is the controller of their program.
The short version
- We store no shopper names, email addresses, phone numbers, postal addresses or Shopify customer ids.
- For referred orders we keep the order number and amounts needed to calculate commission, nothing about who bought.
- Affiliates' details (name, email, PayPal email, website) are kept for the merchant's program and deleted when the merchant removes the affiliate.
- Referral link visits are counted as daily totals, without IP addresses or visitor identifiers.
- We never move money, never sell or share data, never use it for advertising or AI training, and never combine it across stores.
Information about merchants
| Information | Why |
|---|---|
| Store domain and a Shopify access token | To connect to the store: receive order webhooks and create, pause and delete affiliates' discount codes. |
| Store name, contact email, currency and primary domain | To name the store in affiliate emails and pages, set the store's email as the reply-to address, show amounts, and build referral links. |
| Program settings | Commission rates, discount settings, referral window, signup page text, dashboard branding and share links, as the merchant configures them. |
| Plan and subscription status | Read from Shopify to decide which features apply. Payments are handled entirely by Shopify. |
Information about affiliates
| Information | How it's used | Kept |
|---|---|---|
| Name, sign-in email, PayPal email (optional), website or social handle (optional), application note (optional) | Entered by the affiliate on the store's signup page, or by the merchant. Shown to the merchant to review and manage the affiliate, used to email sign-in links and approval, and (PayPal email) included in the merchant's payout file. | While the affiliate is in the program. Declined applications: deleted 30 days after being declined. |
| Referral code, status, commission rate, merchant's private notes | To run the program: attribute orders, calculate commission, show the affiliate their dashboard. | While the affiliate is in the program |
| Commission history and payouts (order number, date, amounts) | Shown to the merchant and, without order numbers, to the affiliate on their dashboard. | Until the store is deleted after uninstall (amounts are kept after an affiliate is deleted, without their personal details, so the merchant's records add up) |
| Sign-in links and dashboard sessions | Single-use sign-in links expire after 15 minutes (email) or 72 hours (a link the merchant sends). Signing in sets one strictly necessary, HttpOnly cookie on the affiliate's device for up to 30 days. We store only one-way hashes of links and sessions. | Deleted after they expire |
| IP address and email address used on the signup or sign-in form | Turned into keyed one-way hashes to limit repeated attempts (spam and abuse protection). | Hashes only, deleted after one hour |
Emails to affiliates are transactional (sign-in link, application received, approval) and are sent through Cloudflare's email service on the merchant's behalf, with the store's email as the reply-to address. We send no marketing emails.
Information about shoppers
| Information | How it's used | Stored by us? |
|---|---|---|
| Referral cookie ("mint_ref") in the shopper's browser | Holds the affiliate code from a referral link for the merchant's referral window (1–180 days), so an order placed later is credited to that affiliate. By default it's only set when the store's cookie banner allows marketing and attribution, and it's removed if that consent is withdrawn. | No, it stays on the device |
| Hidden cart attribute ("_mint_ref") | The same affiliate code, copied into the shopper's cart so Shopify carries it onto the order. | No, it's part of the order in Shopify |
| Referral link visits | Counted per affiliate per day. The browser remembers for the current session that a visit was counted, so reloads aren't counted again. | Daily totals only, no IP address or identifier |
| Orders (from Shopify order webhooks) | When an order is paid, cancelled or refunded, we read its discount codes, referral attribute, line items and amounts to calculate commission. For orders credited to an affiliate we store the order id and number, date, amounts, product and line item ids and refunded quantities. The rest of the order, including any customer details, is not stored or logged. | Order numbers and amounts only, for referred orders (refund notices for other orders are deleted after 7 days) |
Privacy requests
- Affiliates can see and update their PayPal email on their dashboard. To access or delete their data they can ask the merchant (who can delete them in the app at any time) or email us and we'll pass the request on.
- Shopper access requests (Shopify's
customers/data_request): we hold no shopper personal data, and we confirm this to the merchant on request. - Shopper erasure requests (
customers/redact): we hold no shopper personal data; we also replace the order number of that customer's referred orders with "Redacted order". - Store deletion (
shop/redact, 48 hours after a merchant uninstalls): we permanently delete everything we hold for the store, including affiliates, commission history, payouts and settings. Access tokens and affiliate sessions are deleted as soon as the app is uninstalled.
Where data is processed and how it's protected
The app runs on Cloudflare (hosting, database and email sending) and connects to Shopify's APIs. Data is encrypted in transit (TLS) and at rest. Access is limited to Mint Labs staff who need it to provide support. We use no other sub-processors, analytics or trackers. Payout files are downloaded by the merchant; we don't send data to PayPal. See our security policy.
Your rights
Depending on where you are, you may have the right to access, correct or delete information about you. Merchants can contact us directly; affiliates and shoppers should contact the store, or email us and we'll pass the request on. We respond within 30 days.
Changes
If we change this policy we'll update the date above and, for significant changes, notify merchants in the app.
Contact
Mint Labs — support@stickermint.com