Privacy Policy

1. What Tellaff Does

Tellaff helps merchants create affiliate codes and links, track referral clicks and Shopify orders, detect refund and traffic-quality signals, maintain an append-only commission ledger, onboard payout recipients, and authorize creator payouts.

2. Information We Collect

• Merchant account data: name, email address, authentication identifiers, store domain, program configuration, and settings.
• Affiliate data: affiliate name, email address if supplied, affiliate type, referral code, commission rate, status, and merchant-defined metadata.
• Referral and click data: referral code, landing URL, timestamp, first-party referral cookie, visitor identifier, and limited technical signals such as IP-derived or user-agent-derived hashes where used for fraud and attribution analysis.
• Shopify order data: order ID, order name, discount code, subtotal, total, currency, refund or cancellation status, customer identifier hash, shipping region or ZIP where available, item count, SKU count, and product titles where available.
• Ledger and decision data: commission entries, reversals, payout status, audit events, merchant decisions, and the numbers used to support affiliate quality recommendations.
• Payout recipient data: recipient identity, country, entity type, Stripe recipient identifier, onboarding and capability status, payout amount, currency, and payment status. Stripe-hosted onboarding collects bank-account and required verification details directly; Tellaff does not receive or store complete bank-account credentials.
• Support and operational data: messages you send us, deployment logs, security events, and diagnostic data needed to run and debug the service. We do not intentionally log raw payment details, passwords, or full customer PII.

3. How We Use Information

• Provide affiliate code generation, referral links, attribution, and dashboard analytics.
• Attribute Shopify orders to affiliates and reverse commissions when orders are refunded or cancelled.
• Detect fraud and quality signals such as refund-rate spikes, suspicious click-to-conversion velocity, code leakage, and traffic concentration.
• Secure accounts, verify Shopify webhooks, prevent duplicate webhook processing, and maintain audit trails.
• Send operational emails or product notices where enabled.
• Improve reliability, product workflow, and merchant-facing recommendations.
• Create Stripe-hosted recipient onboarding sessions and, only after an authorized merchant confirms, initiate and reconcile creator payouts, failures, cancellations, and returns.

4. Cookies and Tracking

Referral links may set a first-party cookie such as tellaff_ref on tellaff.com, and — when a merchant enables the TellAff attribution theme app embed — a first-party storefront cookie/localStorage value and cart attribute with the same name so a later order can be attributed if the discount code is removed at checkout. The default attribution window is 90 days on tellaff.com (about 30 days for the storefront embed storage) unless configured differently by the merchant. Tellaff does not use this cookie to sell personal information or to run cross-site advertising profiles.

5. Vendors and Integrations

Tellaff uses service providers to operate the product. Stripe provides recipient verification, hosted payout onboarding, and Global Payouts payment processing. Tellaff sends Stripe the recipient and transaction information needed to provide those services, and Stripe processes that information under its own privacy terms. Other providers support application data, secure account access, Shopify integration, hosting, and email.

6. Sharing

We share data only as needed to operate the service, comply with law, protect rights and security, or complete a business transaction such as a merger, acquisition, or asset sale. We do not sell merchant customer lists or affiliate lists.

7. Merchant Responsibilities

Merchants are responsible for giving their customers and affiliates legally required notices about referral tracking, cookies, discounts, commissions, and any use of Tellaff with their Shopify store. Merchants must not upload sensitive information that is unnecessary for affiliate tracking or payout decisions.

8. Shopify Protected Customer Data

Tellaff requests the minimum Shopify data needed to provide affiliate attribution, commission calculation, refund and cancellation reversal, fraud-quality analysis, and merchant reporting. Tellaff does not need customer names or phone numbers for normal operation.

• Protected data used: Shopify order data, discount codes, order status, refund or cancellation status, customer ID or email only to create a hashed repeat-customer identifier, and shipping region or ZIP where available for aggregate performance reporting.
• Protected fields requested: Email may be used only as a fallback source for a hashed customer identifier. Address access, if enabled, is limited to region or ZIP-level reporting. Tellaff does not require raw name or phone fields.
• Purpose limits: Customer data is used only for affiliate attribution, commission analytics, refund reversal, fraud-quality signals, merchant reporting, security, and legally required compliance handling.
• No unrelated sale or sharing: Tellaff does not sell customer data, build unrelated advertising profiles, or share merchant customer data with third parties for their independent use.

9. Shopify Privacy and Deletion Requests

Tellaff verifies Shopify privacy webhooks before processing them. For a customer data request, Tellaff prepares customer-associated order-attribution data that it holds and makes it available to the verified store owner through the embedded Tellaff dashboard. For a customer redaction request, Tellaff deletes customer hashes and customer-associated order, attribution, commission, refund, and related audit records. For a shop redaction request, Tellaff deletes the shop's operational data and access tokens. Tellaff keeps only a minimal completion record for the compliance request itself, without the customer's raw identifiers or exported data.

When a merchant uninstalls Tellaff, access tokens are revoked from Tellaff immediately. Shopify may later send a shop-redaction request, which completes deletion of the store data.

10. Data Retention

Tellaff applies retention periods so personal data is not kept longer than needed. Referral cookies expire after the merchant's attribution window, normally 90 days. Shopify customer identifiers are stored as hashes where possible. Order attribution, commission ledger, refund, audit, and security records may be retained while needed for merchant reporting, accounting, fraud prevention, dispute handling, legal compliance, and security review. Merchants may request deletion, export, or deactivation, subject to legal, financial, fraud-prevention, and security limits.

11. Security

Tellaff uses technical and organizational safeguards such as authentication, HTTPS encryption in transit, encrypted Shopify access tokens, signed Shopify webhook verification, idempotency checks, access controls, separate production and development environments, audit events, dependency checks, and limited staff access to protected customer data. Operational access requires strong account authentication. Security events and webhook deliveries are logged to support investigation and incident response. No system is perfectly secure, and merchants should protect their own credentials, Shopify access, and dashboard accounts.

12. Consent, Opt-Out, and Automated Decisions

Tellaff supports merchant obligations by limiting processing to affiliate attribution and merchant reporting. Tellaff does not use protected customer data for legally significant automated decisions about customers. If a merchant or customer submits a valid opt-out, deletion, or data-access request through Shopify or directly through the merchant, Tellaff will support the request subject to applicable legal, accounting, fraud-prevention, and security limits.

13. Your Choices and Rights

Depending on where you live, you may have rights to access, correct, delete, export, or object to certain processing of personal information. Merchants and affiliates can contact Tellaff through the in-product support channel or legal contact designated by the merchant agreement. Customers of a merchant should usually contact the merchant directly first because the merchant controls the Shopify customer relationship.

14. Children

Tellaff is a business tool and is not directed to children under 13. We do not knowingly collect personal information from children.

15. Changes

We may update this policy as Tellaff changes. The effective date above shows when the latest version took effect. Material changes may be communicated in-product or by other reasonable means.