Privacy Policy

1. Data we collect

From merchants

When you install Udeely, Shopify provides us with your shop domain, store name, contact email, and an OAuth access token scoped to the permissions you grant. We do not collect billing information; subscription billing is handled by Shopify.

From affiliates

When someone joins a merchant's referral program through Udeely, we collect: name, email address, payout method preference (PayPal email, Wise account identifier, or manual bank instructions), and the merchant's commission program assignment. Affiliates set their own password to access their dashboard.

If a merchant chooses to pay an affiliate with Shopify store credit, we look up or create a customer record for that affiliate in the merchant's Shopify store — using the affiliate's own name and email — so the credit can be issued, and we retain the resulting Shopify customer identifier so we don't re-create it on later payouts. This customer access is used solely to pay affiliates; we do not browse or store any other shopper's customer record.

From customers

We process a one-way cryptographic hash (HMAC-SHA256) of customer email addresses on order events. The raw email is never stored. The hash is used solely to detect self-referral fraud — i.e., to verify that the person placing an order is not the same person who owns the referral link. The hash cannot be reversed to recover the email.

We do not request or store customer names, phone numbers, addresses, order history, or any other customer-identifying data.

2. Why we collect it

We do not use any of this data for marketing, profiling, advertising, or sale to third parties.

3. Where it's stored

• Database: PostgreSQL hosted by Neon (US-East region), AES-256 encryption at rest, TLS 1.2+ in transit, point-in-time recovery enabled.
• Application: Fly.io (compute), TLS 1.3 on udeely.com and udeely.fly.dev.
• Background queues: Upstash Redis (encrypted in transit and at rest).
• Transactional email: Postmark (sender: noreply@udeely.com).
• CSV payout files: Cloudflare R2 (private buckets, signed-URL access only).
• Error monitoring: Sentry, configured with sendDefaultPii: false so user identifiers are stripped before transmission.
• Logs: Axiom (log aggregation).
• Merchant support chat: Telegram. When a merchant uses the in-app support widget, the message plus the shop domain and subscription plan are relayed to our private Telegram support workspace so we can identify and answer the request. Used only for support; not used for affiliate or customer data.
• Support-chat translation: Google Cloud (Vertex AI). Support-widget messages are sent to Google's Gemini model to translate between the merchant's language and English. Used only to translate support messages; not used to train models, and not applied to affiliate or customer data.

Production credentials live in Fly.io secrets and are not accessible to any human outside the operator.

4. Sub-processors

We use the following sub-processors. Each has its own privacy policy and DPA, available on their websites.

We will give 30 days' notice before adding a new sub-processor that processes affiliate or customer data.

Udeely SEO & Ads and Google data

Google account connections are coming soon. The following explains how we will handle your Google data when you choose to connect an account.

What we access, only if you connect it

• Google Ads: campaign, keyword, search term and conversion reports, and budgets.
• Google Analytics: aggregate traffic, device and checkout reports.
• Google Merchant Center: product titles, prices, availability and identifiers.

Why

To show you where your advertising money goes, check product pages and stock, and suggest changes for you to review. We read data; we change an ad account only after you approve that specific change.

What we don’t do

We don’t sell Google data, use it for advertising, or share it with other merchants. We don’t send data from your Google accounts to AI providers, and we don’t use it to develop, improve or train AI or machine-learning models.

Udeely's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Storage and retention

Imported Google data is stored encrypted in the database described above, and access tokens are encrypted. Data is refreshed daily. You can disconnect any time. When you disconnect an account or close your Udeely account, we revoke our access and delete its imported Google data within 30 days.

Other data in SEO & Ads

We also use product details you add, public web pages and reviews our research reads, and search-volume data from DataForSEO. DataForSEO receives keywords only, no personal data. Our Anthropic research agent receives product facts you provide and public web content only, never data from your Google accounts.

5. Retention

6. GDPR / customer redaction

When Shopify sends a customers/redact request, we replace the relevant customerEmailHash value with the literal string "REDACTED" and retain the rest of the conversion record (financial data required by law). When Shopify sends a shop/redact request (48 hours after a merchant uninstalls), we cascade-delete every row tied to that shop, including all customer email hashes and affiliate records.

If you are an affiliate and want your data deleted before the 7-year retention period ends, email the address below. We will delete your account, but conversion records linked to your referral code may be retained in anonymized form (the affiliate ID is unlinked, but the commission amounts remain in the merchant's ledger).

7. Your rights

Depending on where you live, you may have the right to:

• Access the data we hold about you
• Request correction or deletion
• Object to specific processing
• Lodge a complaint with your local data protection authority

To exercise any of these rights, email us. We will respond within 30 days.

8. Changes to this policy

We will update this page when we change how we collect, use, or store data. The “Last updated” date at the top reflects the most recent change. Material changes (new sub-processors handling affiliate or customer data; expanded data collection) will be communicated to merchants via the in-app inbox and to affiliates via email.

9. Contact

Privacy questions: privacy@udeely.com.