Compliance & Data Protection

Our architecture is built on Amazon AWS controls. We process the minimum personal data required to provide app functionality and are designed to support GDPR obligations.

For how we handle personal information, see the Privacy Policy.

Referral tracking

Server-side link tracking can inject a signed HMAC token on referral clicks. Client-side tracking sets a cookie only when Shopify customer privacy APIs allow it. Checkout information sent for attribution includes order id and clicker metadata (IP, user agent, click time).

Hosting and encryption

Data and backups use AWS RDS and S3 in the United States. S3 uses SSE-S3. RDS uses AWS-managed keys. Browser traffic uses TLS.

Staff access and incidents

Production access is role-based and logged. We maintain incident response procedures classified by severity.

Last updated: August 13, 2026