This agreement is for merchants who connect a Shopify store to Organically Affiliated, which is operated by Ascending Humans. It describes the personal data we receive from your store, what we do with it, and what you can ask us to do. It supplements our Terms of Service and our Privacy Policy. Where they conflict, the Terms govern.

You are the controller of your customers' personal data. We process it on your behalf and only for the purposes set out below.

1. What we receive

When an order is paid in your store, Shopify notifies us. We keep seven things from that notification and nothing else: the order's Shopify identifier, the order's email address, the subtotal after any discount, the currency, the date the order was created, the discount codes used on it, and whether it is paid.

The email address is the only personal data in that list. The notification also carries your customer's name, phone number, shipping and billing addresses, line items and payment details. We store none of it. What we keep is a fixed list, so anything else in the notification, including anything Shopify adds to it in future, is discarded before we write anything down.

2. What we do with it

The email address is used for two things:

• Attribution. Matching a returning customer to the partner who first referred them, so that partner is credited.
• Self referral checks. Comparing the order's email to a partner's own account email, so a partner buying through their own code can be flagged, where you have asked us to.

We do not use it for marketing or advertising. We do not sell it, share it or transfer it to any third party. We do not profile your customers, and nothing we decide changes what a customer sees, pays or receives.

3. How we protect it

• Everything is transmitted over HTTPS.
• Data at rest is encrypted by our database provider.
• Your store's access token is separately encrypted with AES-256-GCM before it is stored, so reading the database is not enough to use it.
• Access to production systems is limited to one person.
• Every read, creation and deletion of customer data through the application is written to an audit log. That log records which record was touched, by whom and when. It never stores an email address.

4. How long we keep it

• While your store is connected and active.
• After you uninstall the app, email addresses are anonymised within 90 days.
• If a customer asks you to delete their data and Shopify passes that request to us, we anonymise their address within 30 days.
• Sale and commission records are kept for financial reporting, with the customer identifier anonymised.

5. What you can ask us to do

• Stop. Uninstall Organically Affiliated from your Shopify admin. We stop receiving order data immediately and stop crediting your partners. Shopify gives us no access to your store after an uninstall, so the partner discount codes we created stay in your store until they expire on their own, within 7 days. You can delete them sooner from Discounts in your Shopify admin.
• Delete. Email us and we will delete your customers' data rather than waiting for the retention period.
• Ask. Any question about how we handle this data.

Everything above goes to support@organicallyaffiliated.com.

6. Sub processors

We use Supabase for our database, Railway for hosting, and Resend for email. Each is bound by its own data protection terms and each receives only what it needs. The list in our Privacy Policy is authoritative and is kept current.