Summary of Privacy Commitments
Kick Affiliate is engineered from the ground up to respect merchant, creator, and consumer data privacy. We comply with GDPR, CCPA/CPRA, PIPEDA, and the Shopify App Store Partner Requirements. We never sell or broker customer personal information.
1. Introduction & Scope
Kick Affiliate provides an affiliate, influencer, and referral marketing platform specifically designed for Shopify merchants. This Privacy Policy describes how Kick Affiliate (“the App”, “we”, “us”, or “our”) collects, uses, processes, stores, and protects personal information when:
Merchants installing and configuring the application within their Shopify administrative store.
Creators registering, accessing their Creator Portal, generating tracking links, and managing payouts.
Store visitors clicking referral links (?ref=TOKEN) or applying discount codes at checkout.
This Privacy Policy is designed to comply with the Shopify App Store Partner Requirements, European General Data Protection Regulation (GDPR), California Consumer Privacy Act / CPRA (CCPA/CPRA), the Personal Information Protection and Electronic Documents Act (PIPEDA), and other applicable global data privacy frameworks.
2. Roles Under Data Privacy Laws
Depending on the context and interaction, Kick Affiliate acts in different legal capacities:
When processing Customer order and store transaction data on behalf of a Merchant, Kick Affiliate acts strictly as a Data Processor. The Merchant is the Data Controller.
When processing Affiliate account credentials, payment setup preferences, and direct Merchant administrative contact info, Kick Affiliate acts as a Data Controller.
3. Information We Collect
A. Information Collected from Merchants
When you install and authorize Kick Affiliate via Shopify OAuth, we securely retrieve:
- Store & Account Details: Store name,
.myshopify.comdomain, custom domain, primary contact email, store currency, timezone, locale, and country. - Shopify Access Tokens: Secure, offline OAuth tokens required to interact with the Shopify Admin API.
- Subscription & Billing Info: Plan tier selections managed through Shopify’s Billing API (we do not store credit cards directly; all transactions are processed securely by Shopify).
- Store Configuration: Custom commission tiers, cookie durations, brand logos, and email templates.
B. Information Collected from Affiliates / Creators
- Account & Profile Data: Full name, email address, phone number, company name, address (city, state, zip), and social media handles.
- Authentication Credentials: Password hashes, session tokens, and account access records.
- Payout & Banking Details: Preferred payout method (PayPal email address, bank name, account name, account number, routing number) voluntarily provided for commission settlements.
- Tracking Identifiers: Assigned referral tokens (
?ref=TOKEN), Shopify discount codes, and commission history.
C. Information Collected from Store Customers / End Users
- Attribution Metadata: Unique referral token (
_ref_creator), landing URL, referring URL, cart note attributes, and applied coupon codes. - Order Financial Data: Shopify order ID, order number, subtotal, discount value, total price, currency, purchased product IDs, and fulfillment/refund status.
- Click & Anti-Fraud Telemetry: IP address (used strictly for 1-minute deduplication and fraud prevention), User-Agent header, device type, and click timestamps.
Important Shopper Privacy Protection
To protect consumer privacy, Kick Affiliate never displays Customer names, phone numbers, or delivery addresses to Affiliates or Creators. Affiliates only view obfuscated order references, subtotal amounts, and their resulting commission calculation.
4. How We Use Collected Information
We process personal and operational data exclusively for legitimate business purposes in accordance with global data protection standards:
| Purpose of Processing | Legal Basis (GDPR) | Categories of Data |
|---|---|---|
| Affiliate Link Tracking & Attribution | Legitimate Interests / Contract | Referral tokens, click timestamps, IP hash, discount codes |
| Commission Calculation & Settlement | Performance of Contract | Order amounts, product IDs, discount values, creator rates |
| Order Lifecycle Syncing | Performance of Contract | Shopify webhooks (orders/create, orders/updated) |
| Fraud Prevention & Anti-Abuse | Legitimate Interests | IP deduplication, self-referral checks, HMAC verification |
| Authentication & Account Security | Performance of Contract | Login credentials, OTP codes, session tokens |
| Shopify App Compliance | Legal Obligation | Shopify compliance webhooks (customers/redact, shop/redact) |
We do NOT sell, rent, monetize, or broker personal data to third-party data aggregators or advertising networks.
5. Cookies and Tracking Technologies
Kick Affiliate uses lightweight client-side storage technologies solely to attribute referral sales:
- Referral Storage (
_ref_creator): A persistent cookie or local storage item written when a visitor clicks an affiliate link (?ref=TOKEN). - Duration: Configured by the Merchant (e.g. 7, 30, 60, or 90 days; standard default is 30 days).
- Purpose: Allows attributing purchases made during subsequent visits within the active tracking window.
- Opt-Out: Shoppers may clear browser cookies or utilize standard browser privacy controls at any time to remove tracking tokens.
6. Sharing & Disclosure of Data (Sub-processors)
We share data strictly with trusted third-party infrastructure providers necessary to deliver the SaaS service:
| Sub-processor | Role / Purpose | Location & Security |
|---|---|---|
| Shopify Inc. | E-commerce platform host, OAuth authentication, Billing API & Webhook delivery | Canada / Global (SOC 2, ISO 27001) |
| MongoDB Atlas | Encrypted cloud database hosting, multi-region replication & session storage | Global (SOC 2 Type II, HIPAA, ISO 27001) |
| Hostinger / SMTP Gateway | Transactional email delivery (OTP verification, affiliate notices) | European Union / USA |
| Cloudflare / VPS Infrastructure | Reverse proxy, SSL/TLS termination, DDoS mitigation | Global Edge Network |
7. Data Retention & Deletion
- Merchant Data: Maintained for the active duration of the app installation.
- App Uninstallation: When an app uninstallation webhook (
app/uninstalled) is received, store tokens are immediately invalidated and store data is queued for permanent purge within 48 hours to 30 days. - Affiliate Data: Stored until the creator or merchant requests account deletion, subject to tax and accounting retention requirements.
- Click Telemetry: Temporary click records are aggregated and systematically pruned after 90 days.
8. Shopify Mandatory Webhooks & GDPR / CCPA Compliance
Kick Affiliate implements and automatedly handles all mandatory Shopify privacy webhooks:
Upon receiving a customer access request forwarded by Shopify, we export any attribution records connected to the customer within 30 days.
Upon receiving a deletion request, all personal identifiers associated with the shopper are permanently erased or anonymized from referral logs.
Dispatched 48 hours after store uninstallation. Kick Affiliate automatically and irreversibly purges remaining merchant settings and creator database records.
9. Data Security & Encryption
We employ industry standard technological controls to protect stored and transmitted data:
All communications between clients, Shopify APIs, and backend endpoints enforce TLS 1.2+ / TLS 1.3 with modern cipher suites.
All database storage volumes, backups, and secure credential tables are encrypted with industry-standard AES-256.
Every incoming Shopify webhook is validated cryptographically via SHA-256 HMAC headers before payload processing.
Infrastructure administrative access is locked down with strict role-based permissions and mandatory Multi-Factor Authentication.
10. Your Rights (GDPR & CCPA/CPRA)
Depending on your jurisdiction, you possess the following rights regarding personal data:
How to exercise your privacy rights:
- Store Shoppers: Please submit requests directly to the Merchant from whom you purchased (the Data Controller).
- Merchants & Creators: Contact us directly at support@kickaffiliate.io. We respond to all verified requests within 30 days.
11. International Data Transfers
Kick Affiliate operates globally. Information collected may be stored and processed in secure data centers across the United States, European Union, and allied jurisdictions. We apply adequate cross-border transfer safeguards including standard contractual clauses (SCCs) and robust encryption standards.
12. Children’s Privacy
Kick Affiliate is a commercial B2B and creator marketing platform. We do not knowingly solicit or collect data from individuals under 16 years of age. If we learn that personal data of a minor under 16 has been collected without parental consent, we will promptly delete it.
13. Changes to this Privacy Policy
We may update this Privacy Policy periodically to reflect technological improvements, new product features, or regulatory amendments. When updates occur, the “Last Updated” date at the top of this document will be modified. Continued use of Kick Affiliate constitutes acceptance of the revised terms.
14. Contact Information
For privacy inquiries, Data Protection Officer requests, or compliance questions:
Company / Developer: Kick Affiliate (Techprob)
Compliance Email: support@kickaffiliate.io
Application Website: https://kickaffiliate.com