Privacy policy
Last updated October 7, 2026
Mint Sales Popup is a Shopify app made by Mint Labs ("we", "us"). It shows small popups on a merchant's online store about the store's real recent purchases ("Someone bought this product 2 hours ago"). This policy explains what the app handles, why, and when it's deleted. For anything about the merchant's customers and visitors we act as a service provider (processor) to the merchant, who is the controller.
The short version
- From the store's orders the app keeps only: the order's ID, when it was placed, whether it was a test order, which products were bought (up to 3 per order) and, only if the merchant turns on "Show the buyer's country", the country the order ships to.
- The app never reads or stores customer names, email addresses, phone numbers, street addresses, cities, ZIP codes or customer IDs. Popups say "Someone".
- Order rows are deleted after 30 days, when an order is cancelled or deleted, on a customer erasure request, and when the app is uninstalled.
- We never sell or share data, use it for advertising, or combine it across stores. The app sets no cookies.
Information about merchants
| Information | Why |
|---|---|
| Store domain and a Shopify access token | To read recent orders and product details, keep the order webhooks set up and save the storefront settings. |
| Store name, primary domain, app installation ID | The app home and links to the store; the installation ID owns the storefront settings. |
| Settings: on/off, placement, country and test-order switches, pages, hidden products (ID and title), order age, timing, colours, wording | To show popups the way the merchant set them up. |
| Plan (Free or Pro) and its dates | Read from Shopify to decide which features apply. Payments are handled entirely by Shopify. |
| Daily counts of popup views and clicks, per product | The Free daily limit, the app home and Analytics. |
| When the app embed was last seen working | The setup checklist on the app home. |
Information from orders
| What | Details | Kept |
|---|---|---|
| Order ID, time placed, test flag | To know which sales are recent, to drop an order when it's cancelled or deleted, and to answer erasure requests. Order IDs are never shown on the storefront. | 30 days |
| Products bought | Product ID, plus the product's title, handle and featured image from the catalogue. Only products that are active on the online store are shown; gift cards never are. | 30 days |
| Shipping country code (optional) | Only while the merchant has "Show the buyer's country" on. Read from the order's shipping address country (no other address field). Switching the option off deletes every stored country at once. | 30 days, or until switched off |
Order webhooks deliver only the order ID; the app then asks Shopify for exactly the fields above. Nothing from orders is written to logs except counts.
Information about shoppers who see popups
| What happens | Details | Kept |
|---|---|---|
| Popup state | Whether the shopper closed the popup and how many they've seen, in the browser's sessionStorage (no identifier). This is what keeps a closed popup closed. | Until the tab is closed, in the browser only |
| Popup views | Each view adds 1 to the store's daily count (and the product's). Nothing about the shopper is stored. | 90 days (counts) |
| Clicks | Counted only when the shopper allows analytics in the store's cookie banner (Shopify's Customer Privacy API). Count per product and day only. | 90 days (counts) |
| Rate limits | Counters keyed by a salted, daily-changing one-way hash of the visitor's IP address (never the address itself). | Up to 1 day |
Shopify includes the shopper's customer ID in app proxy requests when they're logged in; the app ignores it and never stores or logs it.
Customer privacy requests
- Access requests (
customers/data_request): the app holds nothing linked to a customer. For the orders Shopify lists, it holds at most the order ID, time, products and (if switched on) shipping country described above; the merchant can ask us for these and we provide them. - Erasure requests (
customers/redact): every row for the orders Shopify lists is deleted. - Store deletion (
shop/redact, sent 48 hours after a merchant uninstalls): we permanently delete everything we hold for the store, including settings and counts.
Where data is processed and how it's protected
The app runs on Cloudflare (hosting and database) and connects to Shopify's APIs. Data is encrypted in transit (TLS) and at rest. Access is limited to Mint Labs staff who need it to provide support. We use no analytics or trackers. See our security policy.
Retention
Order rows are kept for 30 days at most. Access tokens, order rows and product details are deleted as soon as the app is uninstalled, and everything else when Shopify sends the store deletion request 48 hours later. View and click counts are kept for 90 days; rate-limit counters for up to a day.
Your rights
Depending on where you are, you may have the right to access, correct or delete information about you. Merchants can contact us directly; shoppers should contact the store, or email us and we'll help. We respond within 30 days.
Changes
If we change this policy we'll update the date above and, for significant changes, notify merchants in the app.
Contact
Mint Labs: support@stickermint.com