Privacy Policy

This Privacy Policy explains how Affilyn (“Affilyn,” “we,” “us,” or “our”) handles information when merchants, partners, creators, storefront visitors, and support contacts use Affilyn. Affilyn is a Shopify affiliate and creator-management application.

The service helps merchants manage partners and creators, affiliate links, commissions and payout workflows, partner storefronts, product synchronization, attributed orders and analytics, social-profile information, and subscription-based access.

This Policy covers the Affilyn marketing website, embedded Shopify application, partner portal, public partner storefronts, and related support interactions. It is informational and is not legal advice.

The information Affilyn processes depends on how the service is used and which integrations a merchant enables.

Merchant and account information

• Store name, Shopify domain and identifiers, merchant contact and business-profile details.
• Installation, OAuth, session, setup-wizard and authentication records.
• Subscription plan, trial, billing status and feature-usage data.
• Support messages and operational communications.

Shopify store information

• Products, variants, pricing, images and other product metadata.
• Orders, attributed sales, refunds, fulfilment information and customer details that are included in permitted Shopify data.
• Discounts, affiliate attribution, storefront configuration and data available under the app's approved Shopify scopes.

Partner and creator information

• Name, email, phone, profile details, location and shipping address where a gifting or fulfilment workflow requires it.
• Social handles, partner tier, status, commission settings and program affiliations.
• Storefront URL and content, uploaded assets, product selections, contracts, consent and signature audit information.
• Payout method and configuration, including protected PayPal or Stripe Connect identifiers when those options are used.

Affiliate, storefront and diagnostic information

• Affiliate links, clicks, conversions, revenue, commissions, product selections and storefront activity.
• IP address or a derived hash, browser or device information, session identifiers, timestamps, logs and fraud signals where required for attribution, security or reliability.

Affilyn can store social handles and, where a supported integration has been properly configured, profile identifiers and audience statistics from services such as YouTube, Instagram/Meta or TikTok. A social handle by itself does not authorize Affilyn to access a social account.

Access to platform data depends on the relevant account owner's authorization, the permissions approved for the integration, token validity, account eligibility and the platform's API rules. Instagram and TikTok authorization capabilities may be unavailable until the required integration has been configured. Affilyn does not request social-account passwords.

We use information as reasonably necessary to:

• Provide, secure and operate Affilyn.
• Authenticate merchants, partners and creators.
• Synchronize eligible Shopify products and operate partner storefronts.
• Generate and track affiliate links, attribute orders and calculate commissions.
• Display analytics, process payout workflows and administer plan limits.
• Deliver transactional or merchant-authorized program email.
• Detect fraud, prevent abuse, troubleshoot failures and improve performance.
• Provide support, enforce our terms and meet legal obligations.
• Respond to valid Shopify privacy requests and requests submitted directly to Affilyn.

Affilyn processes Shopify data only for documented product, attribution, storefront, billing, security and support functions. We seek to limit access to information reasonably needed for those functions and apply Shopify's platform requirements to that access.

Shopify may send requests concerning access to customer data, customer erasure and shop erasure. We review valid requests, locate relevant records and provide, delete or anonymize information as required by applicable rules. Information subject to a lawful retention obligation may be isolated and retained only for that purpose.

Uninstalling the app disables merchant access and disconnects active partner relationships for that shop. Uninstalling is not, by itself, a request to erase every record immediately. A merchant or customer can submit a privacy request through [email protected].

Affilyn uses essential cookies and browser storage for partner authentication, embedded Shopify context, attribution, storefront sessions, preference storage, draft recovery, wishlists and dismissed notices. The marketing website stores a theme preference locally.

Public partner storefronts can use attribution cookies to associate a visit or purchase with a partner. Merchants may also configure third-party storefront pixels or integrations. Those merchant configurations can have separate notice or consent requirements.

We did not identify behavioral-advertising or general marketing analytics scripts on the Affilyn marketing website as of the last updated date. This Policy will be updated if those practices change.

Where a law requires a legal basis, processing may rely on performing a contract, taking steps requested before a contract, legitimate interests in operating and securing the service, consent, or compliance with legal obligations.

The applicable basis depends on the information, user relationship, feature and jurisdiction. Where processing relies on consent, consent may be withdrawn, subject to processing that remains necessary on another lawful basis.

We disclose information only as reasonably necessary to operate the service, follow user-authorized integrations, comply with law, or protect users and the service. Recipient categories may include:

• Shopify for app installation, APIs and merchant billing.
• Cloud hosting, database, cache, file-storage, logging and security providers.
• SendGrid or another configured email-delivery provider for transactional and authorized program messages.
• Stripe or PayPal when a merchant and partner use the corresponding payout workflow.
• YouTube, Meta/Instagram, TikTok, Klaviyo or Omnisend when the relevant integration is configured and used.
• Professional advisers, authorities and parties involved in a business reorganization where legally permitted.

Providers process information under their own terms and privacy practices where they act independently.

Affilyn does not sell merchant, partner or Shopify customer personal information. Affilyn does not use that information for its own cross-context behavioral advertising.

A merchant may separately configure a pixel, social integration or analytics tool for a partner storefront. The merchant is responsible for enabling it lawfully and providing any notices or consent choices required for that merchant-directed use.

We retain information only for as long as reasonably necessary to provide the service, maintain business and accounting records, resolve disputes, prevent fraud, enforce agreements and meet legal or Shopify privacy obligations.

Retention varies by record type, account status and legal context. When information is no longer required, we delete or anonymize it using reasonable procedures. A formal record-by-record retention schedule remains subject to business and legal approval; this Policy does not invent fixed periods that the service has not adopted.

Affilyn uses reasonable technical and organizational safeguards appropriate to the information handled. Measures include encryption in transit, restricted access, authenticated application routes, signed webhook validation, protected credentials, data minimization, operational logging and fraud or abuse monitoring.

Some sensitive payout identifiers are encrypted or hashed before storage. No system can guarantee absolute security. Users should protect credentials and notify us promptly of suspected unauthorized access.

Affilyn and its service providers may process information in countries outside a user's location. When required, we use legally recognized transfer mechanisms or other appropriate safeguards. The specific processing location can depend on the merchant, infrastructure and integration selected.

Depending on jurisdiction and circumstances, a person may have rights to request access, correction, deletion, portability or restriction; object to certain processing; withdraw consent; or appeal or complain to a regulator.

To submit a request, email [email protected] with the relevant Shopify store and enough information to verify the request. We may coordinate with the merchant where the merchant controls the relevant customer or partner relationship. We will not request a password or access token to verify a privacy request.

Affilyn is intended for merchants, businesses, creators and other users legally able to participate in commercial programs. It is not directed to children below the minimum age applicable in their jurisdiction. If you believe a child has submitted information improperly, contact us so we can review it.

We may update this Policy as the service, providers or legal requirements change. We will revise the “Last updated” date. For material changes, we may provide reasonable notice through the website, application or email where appropriate.

Privacy and support requests can be sent to [email protected]. The service is identified publicly as Affilyn. A legal entity name and mailing address have not yet been verified for publication and must be added after legal review.

You can also review the Terms & Conditions.