This privacy policy governs the Checkout Links Shopify application ("App") operated by Edinson & P AB. It describes how personal information is collected, used, and shared when you install or use the App, and when your customers use the links you create with it.
Company Details
- Organization: Edinson & P AB
- Location: Sweden
- Brand: Checkout Links
- Contact: hello@checkoutlinks.com
Information We Collect
About your store
When you install the App, we access and store the following from your Shopify account:
- Store name, URL, plan, and Shopify identifiers
- The store owner's name and email address
- The name and email address of each staff member who uses the App
- The links you create, with their products, discounts, promotions, and settings
- Product, collection, and discount data, read from Shopify when you create or edit links
About your customers
Checkout Links keeps as little about your customers as the features you use require:
- Orders: order details stay in Shopify. The App only receives orders placed through Checkout Links, and keeps their order ID, date, and totals to count sales and enforce usage limits.
- Once-per-customer limits: if a link may be used only once per customer, we store a hashed form of the customer's email address and their Shopify customer ID in your store, so the limit can be checked at checkout.
- Personalized links: a customer's name, email, phone, and address are read from Shopify at the moment a personalized link is opened, to prefill checkout. They are not stored by us. A personalized link identifies the customer with an encrypted token, which we store on the customer in your store.
- Klaviyo: if you connect Klaviyo, we add each customer's personalized link token to their Klaviyo profile, and create an email template and flow in your Klaviyo account.
- Link clicks: for each click we record the date, the link, UTM parameters, the referring channel, country, and device type. We do not record IP addresses or anything else that identifies the shopper.
We do not process or store payment card information.
How We Use Your Information
We use the collected information to:
- Provide and maintain the Checkout Links service
- Create and manage checkout links, discounts, and promotions
- Provide analytics and attribution reporting
- Offer customer support and respond to inquiries
- Send product communications and updates
- Analyze performance and improve our service
- Ensure security and prevent fraud
Data Sharing
We use the following third-party services to operate the App:
- Cloudflare: Hosting, data storage, content delivery, and sending support email
- Shopify: The platform the App runs on, and billing
- Sentry: Error monitoring
- Slack: Internal notifications to our team about store activity, such as the store and owner name, plan, and link performance
- Klaviyo: Only if you connect it, as described above
We do not sell, rent, or trade your personal information. We may share information to comply with applicable laws and regulations, respond to lawful requests, or protect our rights.
Data Security
We implement industry-standard security measures including:
- HMAC-SHA256 signed discount configurations to prevent tampering
- Encrypted data transmission (HTTPS/TLS)
- Access controls and authentication via Shopify OAuth
- Regular security reviews aligned with Shopify's development standards
Data Retention and Deletion
- Links and store data: Deleted when you uninstall the App, and again when Shopify asks us to erase your store's data (48 hours after uninstalling)
- Click records: Kept for 90 days, then summarized into daily totals per link. The daily totals contain no information about shoppers and are kept after that.
- Support records: Retained for up to three years after last interaction
- Legal requirements: Some data may be retained as required by law
Your Rights
You have the right to:
- Access the personal data we hold about you
- Request correction of inaccurate data
- Request deletion of your data
- Request data portability
- Withdraw consent where applicable
- Restrict processing (GDPR users)
GDPR Rights
If you are in the EU/EEA, you have additional rights under the General Data Protection Regulation, including the right to lodge a complaint with a supervisory authority. We process your information based on legitimate interest and contract performance. For your customers' data, we act as a processor on your behalf.
US State Privacy Rights
Residents of California (CCPA/CPRA), Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), and Utah (UCPA) have specific privacy protections under their respective state laws.
International Data Transfers
Data may be transferred and processed in locations outside your jurisdiction, including the United States and the European Union. We implement appropriate safeguards to ensure your data remains protected during transfer.
Cookies
The App uses session tokens provided by Shopify to keep you signed in, and measures its page performance with Cloudflare Web Analytics, which does not use cookies. When a shopper opens a link that leads to your store, the link page sets your store's own cart cookie so that the cart the link built is the one they see. Our marketing website measures visits with Ahrefs Web Analytics, which does not use cookies, and with Google Analytics. Visitors in the EEA, the UK and Switzerland get Google Analytics cookies only after accepting them in the cookie banner; until then it sends cookieless measurements. The website uses no advertising cookies.
Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes to our practices or for operational, legal, or regulatory reasons. Material changes will be communicated via email or app notification. Continued use of the App after changes constitutes acceptance.
Contact Us
For questions about this Privacy Policy, to exercise your rights, or to make a complaint, please contact us at hello@checkoutlinks.com.
Edinson & P AB
Sweden