Legal

Privacy Policy

Last updated: July 15, 2026

Sprout Affiliate ("Sprout," "we," "us") is an affiliate-marketing app for Shopify, operated by [Your Company Legal Name]. This policy explains what data the app processes when a merchant installs it, how we use that data, and the choices you have. It covers the Sprout app and the sproutaffiliate.com website.

Sprout is a tool that merchants run for their own affiliate programs. For the shoppers and affiliates involved in a program, the merchant is the data controller and Sprout is a processor acting on the merchant's behalf.

Information we process

Merchant & store data

Your store's domain and the Shopify access token issued at install, used to call the Shopify API on your behalf.
Order data needed to calculate commissions: order numbers, dates, totals, discount codes, and order attributes. We do not need or store customer payment card data.
App settings you enter: support email, program rules, payout timing, and your PayPal API credentials (see Security).

Affiliate data

Information affiliates submit when they join a program: name, email, their chosen discount code, payout method, and payout details (for example a PayPal email or bank information).
A per-affiliate ledger of referred orders and commission amounts, so payouts are accurate and never doubled.

Storefront referral data

When a shopper arrives with an affiliate's referral link, the app stores the affiliate's referral code in the browser and on the resulting cart/order (as the "Sprout Ref" attribute) so the sale is credited. No other browsing data is collected.

Website data

If you contact us through the website, we receive the details you send (such as your name, email, and message).

How we use it

To run the app's core functions: tracking referrals, calculating commissions, and paying affiliates.
To provide support and respond to your messages.
To operate, secure, and improve the service, and to meet legal obligations.

We do not sell personal information, and we do not use your store's data to build advertising profiles.

Sharing and third parties

We share data only with the services required to deliver the app:

Shopify, the platform the app runs on and reads order data from.
PayPal, for automatic payouts. The payout amount and the recipient's PayPal identifier are sent to PayPal to complete the payment.
Our hosting and database provider, which stores the app's data on our behalf under confidentiality obligations.

We may also disclose information if required by law, or as part of a merger or sale of the business, in which case we will notify affected merchants.

Security

Data is transmitted over TLS. Sensitive secrets (your PayPal API secret and affiliates' payout details) are encrypted at rest using AES-256-GCM before they are stored. Access to production systems is restricted.

Data retention and deletion

We keep data only as long as needed to run your program:

When you uninstall the app, we retain your data briefly in case you reinstall, then honor Shopify's shop/redact request (about 48 hours later) by permanently deleting all of your store's data.
On a Shopify customers/redact request, we anonymize the affiliate's personal information while keeping the anonymized commission records needed for your financial history.
On a customers/data_request, we compile the data we hold about that person for you to share with them.

You can also email us to request access to, correction of, or deletion of your data at any time.

Your rights

Depending on where you live, you may have rights under the GDPR, UK GDPR, or CCPA/CPRA, including the right to access, correct, delete, or port your data, and to object to certain processing. To exercise these rights, contact us using the details below. Affiliates should contact the merchant whose program they joined; we will assist that merchant in responding.

International transfers

We may process data in countries other than yours. Where required, we use appropriate safeguards for those transfers.

Children

Sprout is a business tool and is not directed to anyone under 16. We do not knowingly collect data from children.

Changes to this policy

We may update this policy as the app evolves. Material changes will be reflected by the "Last updated" date above and, where appropriate, communicated in the app.

Contact

Questions or requests: support@sproutaffiliate.com.