AppVerix Affiliates: Privacy Policy

Last updated: 19 October 2026

AppVerix Affiliates (“the app”) is a Shopify app published by AppVerix (“we”, “us”). This policy explains what the app collects when a merchant installs it, why, where it is kept and how to have it deleted.

For personal data of a store’s customers and affiliates, the merchant is the controller and we are the processor. Affiliates type their own name and email on the signup page.

1. What we collect and why

From the merchant’s store, through Shopify’s API and webhooks, and from forms on the app proxy:

  • Shop domain: to identify the store and open the app in Shopify Admin. Stored.
  • An access token from Shopify: so the app can stay installed and create discount codes. Stored in the login session until you uninstall.
  • Affiliate records: name, email, tracking code, discount code, status, optional commission override and notes. Stored because you run a program with those people.
  • Clicks: affiliate id, path and time. No IP address is stored.
  • Attributed orders: Shopify order id, order name, optional customer id, subtotal, commission, clawback, attribution method and discount code used. Line items are used to calculate commission and are not kept after the calculation.
  • Referral codes: customer id when Shopify sends it, email the customer typed, and the code.
  • Payout records: amount, affiliate, note and date. No bank or PayPal account.
  • Shop settings: language, cookie window, commission defaults, refer-a-friend flags.
  • Billing state from Shopify (plan active, trial or none). Stored as a cache; Shopify is the source of truth.
  • Compliance log: the topic and a short summary Shopify sent on a privacy webhook (shop id, customer id, order ids). No names or emails from that payload.

2. Cookies and the storefront

The theme embed may set a first-party cookie named avix_ref on the merchant’s domain so a later checkout can be attributed. It also writes a cart attribute _avix_ref. Those values stay on the storefront; we only see them if they arrive on an order webhook or the click tracking proxy. The marketing site sets no analytics or advertising cookies.

3. Who processes data for us

Where data leaves the EEA/UK, we rely on the provider’s Standard Contractual Clauses or other approved transfer mechanisms. Optional merchant emails use Resend only if a merchant API key is configured; that key is not set by default and we do not store the merchant’s email in our database.

  • Cloudflare (cloudflare.com): hosting for the app and its D1 database. Sees everything in section 1. Globally distributed.
  • Shopify: the platform the app runs on, which also handles billing. See Shopify’s privacy policy.

4. How long we keep it

  • Program data: while the app is installed.
  • When you uninstall: we delete the login session right away. Shopify sends a shop/redact request about 48 hours later and we then delete affiliates, orders, payouts, referrals, settings and other store rows.
  • A customer deletion request (customers/redact): we remove that customer id from attributed orders and delete matching referral rows.
  • Server logs: up to 7 days.

5. Your rights and data requests

The app supports Shopify’s three privacy webhooks: customers/data_request (we look up order ids and referral codes for that customer id), customers/redact (we delete or anonymise that customer’s rows) and shop/redact (we delete all data of the store).

Merchants can also write to support@appverix.com for a copy of their data or to have it deleted. We answer within 30 days. A store’s customers should contact the store first. If you are in the EEA/UK you may complain to your local data protection authority. In Brazil the LGPD applies; contact us at the same address.

6. Security

  • All traffic uses HTTPS (TLS).
  • The database runs on Cloudflare D1, which encrypts data at rest.
  • Webhooks from Shopify are verified by their HMAC signature; unsigned requests are rejected.
  • The app checks a Shopify session token on every admin request and uses no third-party cookies.
  • Access to production infrastructure is restricted and protected by two-factor authentication.
  • If a breach affects your data we tell you without undue delay, and within 72 hours where the law requires it.

7. Data processing agreement and security

For the personal data of a store’s customers, the merchant is the controller and we are the processor. The AppVerix Data Processing Addendum sets out our commitments (purposes, subprocessors, security, deletion, breach notification), and our security and incident response policy describes how we protect and handle data.

8. Changes and contact

If we change this policy in a way that matters, we update the date at the top and tell merchants in the app or by email. Contact: support@appverix.com