Privacy Policy

Seedr, last updated: September 7, 2026

1. Introduction

This Privacy Policy describes how INFLUXX IO LLC (“we,” “us,” or “our”) collects, uses, stores, and protects information through Seedr (“the App”), available on the Shopify App Store. By installing or using the App, you (“Merchant”) agree to the practices described in this policy.

Seedr is an affiliate marketing platform that helps Shopify merchants create and manage affiliate programs. This policy covers data practices for both merchants who install the App and affiliates who participate in merchant programs.

2. Information We Collect

2.1 Merchant Data (Collected via Shopify)

When you install Seedr, we access the following data through Shopify’s API with your explicit consent:

• Store information: Shop name, domain, email, currency and storefront domain, and your Shopify access token
• Order data: Order and line item IDs, order number, totals, currency, dates, discount codes, order tags, the App’s own attribution attributes on the order, and Shopify’s customer ID for the buyer together with whether they had ordered from you before. This is what attribution and commission arithmetic need. The order note and any other cart attribute a customer typed are not kept.
• Product data: Product IDs, titles and prices, read when you pick products to seed or to set a product-level rate
• Discount data: The discount codes the App creates for your creators

We do not store your customers’ names, email addresses, phone numbers or postal addresses. The App has Shopify’s customer ID and nothing else that identifies a buyer, which is all attribution needs.

2.2 Creator Data (Collected via the Creator Portal)

When creators sign up through a merchant’s portal, or a merchant adds them, we collect:

• Account information: Name, email address, and a password stored only as a bcrypt hash
• Payment information: PayPal email address, and any payout details the creator enters, so the merchant knows where to send the money
• Profile information: Social media handles, website URL, promotional methods
• Activity data: Referral link clicks, attributed orders, commission history, login timestamps
• The merchant’s note: A private note the merchant can write against a creator. It is shown to the merchant only and is never displayed in the creator’s portal.

2.3 Tracking Data

To attribute sales to creators, the App collects:

• Referral cookies: First-party cookies set on the store’s own domain when a customer arrives on a creator’s link (duration set by the merchant, 30 days by default)
• UTM parameters: Campaign tracking parameters from referral URLs
• A visitor identifier: A random value generated by the App and stored in a first-party cookie. It identifies a browser so a click can be matched to a later order. It is not derived from anything about the person, and it is not linked to a name, an email address or a Shopify customer record.
• Landing page and referring URLs: The page a referred customer first visited, and the site they arrived from

The App does not collect or store IP addresses, browser user agents, device fingerprints, or any customer name, email address, phone number or postal address. The tracking runs as a Shopify Web Pixel on the store’s own domain, and the creator portal loads nothing from a third-party server: its font is served from our own domain rather than from a font provider. The one exception is reCAPTCHA, which loads Google’s script on the creator signup form, and only if the merchant has switched it on with their own keys. See section 4.

2.4 Technical Data

• Session data: Shopify OAuth access and refresh tokens, so the App can read your orders while you are not looking at it, and a signed cookie holding the identifier of the signed-in creator
• Webhook receipts: A record that Shopify delivered something, narrowed to the fields listed under 2.1. See retention in section 6.

IP addresses are used in memory to rate limit requests and are not written down. Application logs record what happened and which store it happened to, not who was buying.

3. How We Use Your Information

We use collected information to:

• Operate the App: Track referrals, calculate commissions, record payouts, manage creator accounts
• Prevent duplicate attribution: Identify repeated clicks from the same browser so a single referral is not counted many times
• Send notifications: A welcome email when a creator signs up or is added, a password reset link when one is asked for, and a note to a creator when they earn a commission
• Provide support: Diagnose issues and respond to support requests

We do not:

• Sell personal data to third parties
• Use merchant or creator data for advertising
• Share data between different merchants’ creator programs
• Access data beyond what the approved Shopify API scopes allow
• Run any analytics, tracking or telemetry on our own screens

4. Data Sharing

These are every party that receives data, and what each one gets:

• Between a merchant and their creators: Merchants can see their creators’ performance. A creator can see their own clicks, commissions and payouts for that merchant, and nothing about anybody else.
• Render: Our hosting provider. The App and its PostgreSQL database run on Render in the United States, so Render holds everything described above as part of running them.
• Resend: Our email provider. Resend receives the recipient’s email address and the contents of the message whenever the App emails a creator.
• Google: reCAPTCHA, and only on a store whose merchant has switched it on in Settings with their own keys. It runs on the creator signup form and Google receives what reCAPTCHA collects about that browser. No merchant or creator record is sent to Google, and nothing else in the App loads anything from Google.
• PayPal: No longer used. An earlier version of the App could send payout batches through PayPal, and PayPal received the creator’s PayPal email address and the amount. That was switched off, and the App now sends nothing to PayPal at all. If your store saved PayPal credentials while it worked, they are still in our database, read by nothing; write to support@getseedr.app and we will clear them.
• Legal Requirements: We may disclose data if required by law, court order, or governmental regulation.

5. Data Storage and Security

• Storage location: One PostgreSQL database, managed by Render, in their Oregon region in the United States.
• Encryption: In transit over TLS, and at rest by Render, who encrypt their managed database volumes.
• Access controls: The database is reachable only by the App’s own service over Render’s private network.
• Password hashing: Creator passwords are stored as bcrypt hashes. We cannot read them, and neither can the merchant.
• Separation between stores: Every query the App makes is scoped to one store’s id, and a signed-in creator’s session is checked against the store whose portal they are on.
• Session management: Shopify OAuth tokens are held in the database and refreshed as Shopify requires. The creator portal’s cookie is signed and http-only, so it cannot be read or forged by a script, and resetting a password signs out every device that was already signed in.

6. Data Retention

Every window below is enforced by a job that runs every night, not by a person remembering.

• Merchant and creator data: Kept while the App is installed. When a merchant uninstalls, everything belonging to that store is deleted 30 days later: creators, their codes and payout details, the commission history, the webhook receipts and the App’s copy of the Shopify access token. Reinstalling inside those 30 days restores it; after that it is gone and cannot be recovered. A merchant can also delete an individual creator at any time.
• Click records: Deleted once both conditions hold: the referral window set by the merchant has closed, and the click is at least 90 days old. The 90-day floor exists because the merchant’s reporting covers the last 30 days and a shorter cookie duration would otherwise make yesterday’s figures shrink. A click record holds the referral code, a random visitor identifier, the landing page, the referring URL and any UTM parameters. It holds no IP address and no user agent.
• Webhook receipts: Kept 30 days, which outlasts Shopify’s own retry window. A receipt keeps only the fields the App reads: order and line item IDs, order number, amounts, currency, dates, discount codes, tags, the App’s own attribution attributes, and Shopify’s customer ID with whether that customer had ordered before. The shopper’s name, email address, phone number, shipping address and billing address are dropped before the receipt is written, and so are the order note and every cart attribute the shopper typed, so nothing a shopper wrote at checkout is stored at all.
• Tracking cookies: Expire on the merchant’s configured referral window, 30 days by default. They live in the visitor’s own browser and we cannot delete them; clearing cookies removes them.

7. Your Rights

For Merchants (Data Controllers):

• Access: View all data the App stores via the admin interface
• Export: Export affiliate lists, commission reports, and payout history as CSV
• Deletion: Uninstall the App to trigger data deletion; or contact us for immediate deletion
• Portability: Request a full data export in machine-readable format

For Creators (Data Subjects):

• Access: View your data through the portal dashboard
• Correction: Update your profile and payment information at any time
• Deletion: Request account deletion through the merchant or by contacting us directly
• Email: The App sends you a welcome message, a reset link when you ask for one, and a note when you earn a commission. It sends no marketing, so there is nothing to unsubscribe from; ask the merchant to remove your account and it stops.

For EU/EEA Residents (GDPR):

In addition to the above, you have the right to:

• Lodge a complaint with your local data protection authority
• Withdraw consent at any time (without affecting prior lawful processing)
• Request restriction of processing

To exercise any rights, contact us at support@getseedr.app.

8. International Data Transfers

Data is processed in the United States. For EU/EEA users, transfers are conducted under Standard Contractual Clauses (SCCs) as approved by the European Commission, ensuring adequate data protection.

9. Children’s Privacy

Seedr is not intended for use by individuals under 18. We do not knowingly collect personal information from children. If we become aware that we have collected data from a child, we will delete it promptly.

10. Cookies

Cookie	Purpose	Duration
affhub_ref	The creator code the visitor arrived on, so a later order can be attributed	The merchant’s referral window, 30 days by default
affhub_vid	A random identifier for the browser, so one click is not counted many times	The merchant’s referral window, 30 days by default
__portal_session	Keeps a creator signed in to the portal. Signed and http-only.	30 days
Shopify session cookies	Authenticate merchant sessions in the Shopify admin	Set by Shopify

The first two are first-party cookies on the merchant’s own storefront domain. No third-party tracking cookies are used, and the App sets no cookie for advertising.

11. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated via the App’s admin interface and/or email. Continued use of the App after changes constitutes acceptance.

12. Contact Us

For privacy-related questions or requests:

• Email: support@getseedr.app
• Company: INFLUXX IO LLC
• Address: Scottsdale, Arizona, United States

For Shopify-specific data questions, contact Shopify at privacy@shopify.com.