OmnikitOmnikit ("we", "us") is a Shopify app that adds wholesale pricing, wholesale registration, order limits, shipping protection, post-purchase upsells, back in stock alerts and product quizzes to Shopify stores. This policy explains what data the app collects when a merchant installs it, why, and how it is deleted.
1. Data we collect
- Store data: shop domain, store name, store email, owner name, currency, time zone and country, read from Shopify when the app is installed.
- Access tokens: the Shopify access and refresh tokens the app needs to call the Shopify Admin API for the store. They are cleared when the app is uninstalled.
- Plan data: the store's Omnikit plan and subscription status from the Shopify Billing API, and when its free trial started.
- Shopper emails (back in stock alerts): when a shopper asks to be told about a restock, we store their email address, the product variant they asked about, and when they were emailed.
- Wholesale registration applications: the answers an applicant sends with the merchant's registration form (their name and email, and any other fields the merchant asks for, such as phone or company), and whether the merchant approved them. When the merchant approves an applicant, the app adds the merchant's tag to that customer in Shopify, creating the customer if they are new, and emails them.
- Product quizzes: the quizzes the merchant writes, and how many times shoppers started one, finished it and added a recommended product to the cart. These are counts only: we don't store shoppers' answers or anything that identifies them.
- Settings: the shipping protection, wholesale pricing, order limit and post-purchase upsell rules the merchant creates. These are stored in the merchant's own Shopify store (metafields, a protection product, discounts and a checkout validation).
- Technical data: server logs (request paths, times and errors) and the webhook payloads Shopify sends to the app.
Omnikit does not read or store payment details, and it does not store order records from the store.
2. How we use it
- To run the features the merchant turns on, including sending back in stock and registration approval emails on the merchant's behalf.
- To authenticate requests and protect the app and stores from abuse.
- To apply the merchant's plan and its limits.
- To fix bugs and support the merchant when they contact us.
We do not sell data, and we do not use it for advertising.
3. Sharing
- Shopify: to install the app, call its APIs and bill through Shopify.
- Service providers: our hosting, database (MongoDB Atlas) and email-sending providers, only to run the app.
- Legal: when the law requires it.
4. Retention and deletion
- On uninstall, the store's access tokens are cleared at once.
- About 48 hours after uninstall, Shopify sends a shop/redact request, and we delete all of the store's data, including its shopper emails and registration applications.
- When Shopify sends a customers/redact request, we delete that shopper's back in stock requests and registration applications. When it sends a customers/data_request, we provide the data we hold about that shopper to the merchant.
5. Security
Data is sent over HTTPS. Every admin request is checked against a Shopify session token, and every webhook and storefront request is checked against Shopify's signature.
6. Your rights
Shoppers and merchants can ask to access, correct or delete their data. Shoppers should contact the store they shopped with. Merchants can email us at support@affiliomint.com.
7. Changes
We will update the date at the top of this page when this policy changes.