Privacy Policy

Last updated: 15 October 2026

Affilyflow (“we”, “us”) provides affiliate-tracking software for Shopify merchants. This policy explains what data the Affilyflow app processes when it is installed on a Shopify store, why, and the choices available to merchants and their customers. The app is built to use the minimum data necessary: it does not access customer personal information such as names, email addresses, shipping details or payment information.

Store information at installation

When the app is installed, it reads the store’s name, store email, primary domain, currency, time zone, country and whether it is a development store. We use this to create the store’s Affilyflow account. The account belongs to the Shopify store and is opened from the app; the store email is used only for service emails about the store’s affiliate program. A merchant who already has an Affilyflow account can connect it instead with a one-time code.

Order data

When a shopper follows an affiliate link, Affilyflow records the click: a random click identifier, a short browser description (device type, operating system and browser family with major version – not the full user agent), the referring page without its query string, the country (from the network) and the landing page. The Web Pixel stores the click identifier in a first-party cookie on the store’s domain for up to 90 days – the longest attribution window a merchant can choose – so a later purchase can be credited to the right affiliate. A copy is kept in the browser’s local storage on the store’s domain together with the time of the click and is deleted 90 days after the click; a purchase is only credited within the attribution window the merchant has chosen. The Web Pixel only reports a completed order when the browser holds an Affilyflow click from the last 90 days. Then the app receives the following through Shopify’s Web Pixel:

The click identifier (a random value, not linked to a name or account)
Order identifier, total order value, subtotal, tax and shipping amounts, and currency
Purchased line items (product title, variant, quantity, price)
The store’s myshopify.com domain

We do not collect or store customer names, email addresses, phone numbers, shipping or billing addresses or payment details, and we do not store customers’ IP addresses with any click or order. Our servers use the IP address of an incoming request only briefly to block abuse, as a keyed hash that changes every day; it is deleted within 24 hours.

For an order without an affiliate click, the Web Pixel sends nothing about the order. It only asks Affilyflow whether the merchant has just opened their own test link (so a test purchase behind a storefront password can still be shown in the app); that question carries only the store’s domain.

Why we process it

To run the store’s Affilyflow account, attribute sales to the correct affiliate, calculate commissions, and show performance figures to the merchant and to the affiliate who drove the sale.

How it is stored and shared

Data is stored in the European Union (Ireland), and the servers that process it run in the European Union (Dublin). The merchant sees all order and commission data for their store. An affiliate sees the value, products and commission of the sales they generated. We do not sell data, and we do not share it with any third party for advertising purposes.

Uninstalling and deletion

When the app is uninstalled, tracking stops immediately, the store is marked as disconnected and its affiliate program is turned off, so it is no longer listed in our catalogue and no new commission is recorded. Reinstalling reconnects the account; the program is turned on again in the app. After the deletion request below, an account created by the app is still found again on reinstall, while an existing Affilyflow account that was connected with a code is connected again with a new code. 48 hours after the app is uninstalled, Shopify sends us a deletion request, and we act on it as follows:

If the Affilyflow account was created by the app and never had a real affiliate sale, an affiliate link or a payment, we delete the account and all of its data.
Otherwise we keep the account and its commission records, because commissions earned by affiliates and our bookkeeping must be documented (the Danish Bookkeeping Act requires five years). We remove the link to the Shopify store.

A merchant can ask us to delete their account at any time, and we will delete everything the law does not require us to keep. When Shopify sends a customer deletion request, we remove the line items of the listed orders and the user agent, referring page and landing page of the clicks behind them; order value and commission stay for bookkeeping. When Shopify sends a customer data request, we send the merchant, within 30 days, the data we hold for the listed orders: line items, order value and commission, and the browser type, referring page, landing page, country and device of the clicks behind them. We hold no customer names, emails or addresses.

Your rights

Merchants and data subjects in the EU/EEA may request access to, correction of, or deletion of their data, and may object to processing. To exercise any of these rights, contact us at the address below.

Contact

Affilyflow · info@affilyflow.com · affilyflow.com