Privacy — Referclan

Effective date: 10 November 2026

1. Who we are

Referclan ("we", "us") provides a Shopify app that runs creator affiliate and customer-referral programmes for Shopify merchants, plus the website referclan.com. Referclan is operated by Hassan Javed, an individual based in Lahore, Punjab, Pakistan. Referclan is not established in the EU or the UK. Contact: hello@referclan.com.

2. Whose data this covers, and our role

Merchants and their staff who install or use the Referclan app. For their account data we are the controller.
People in a merchant's programme: creators (affiliates) and customers who refer friends.
A merchant's shoppers, whose orders Referclan reads to attribute referrals.

For creators, referrers and shoppers, Referclan processes data on behalf of the merchant who runs the programme. The merchant decides who takes part and why; Referclan acts as the merchant's processor (a "service provider" under US state privacy laws). Our Data Processing Terms with the merchant govern that processing, and the merchant's own privacy policy explains its use of the data.

Website visitors and beta applicants: see section 8.

3. What we collect, and why

Data	Where it comes from	Why we use it
Store identity: shop domain, Shopify shop ID, store name, currency, timezone and store contact email	Shopify, when the app is installed	Creating and running the merchant's account; service emails to the merchant
A Shopify access token	Shopify, at install	Reading orders and managing the merchant's Referclan discount codes. Stored encrypted; revoked when the app is disconnected or uninstalled
Order data: order ID, totals, discount codes used, landing page path, payment and refund state, and the customer's Shopify ID	Shopify webhooks and catch-up reads	Deciding which creator or referrer an order belongs to; calculating commissions and rewards; handling refunds
A shopper's email address and lifetime order count (Shopify protected customer data, email only)	Shopify	Customer-referral enrolment; checking that a referred friend is a first-time customer; preventing self-referral and duplicates; sending the referral emails the programme promises
Creator name, email and optional profile link	The merchant's invitation or import, or the creator's application	Running the creator's programme membership, portal sign-in and payout records
Referral click evidence (privacy-minimised)	The storefront referral link	Attributing link referrals, within the programme's attribution window
Staff email address	The store owner's invitation	Letting directly invited staff sign in with single-use emailed links
Payout records and exports	Generated by Referclan	Showing what a merchant owes and has paid. Referclan collects no bank details: payments are made by the merchant outside Referclan
Security and access logs	Generated by Referclan	Protecting accounts and investigating misuse

We do not request shoppers' names, phone numbers or addresses. We do not sell personal information, or share it for cross-context behavioural advertising. We do not use it for advertising or for profiling unrelated to the merchant's programme, and we make no automated decisions with legal or similarly significant effects.

4. Emails we send

Sign-in links for creators, referrers and staff. These are single-use and short-lived.
Service emails, such as invitations, payouts paid and reward available.
Referral promotion emails, sent only when the shopper is subscribed to the merchant's marketing in Shopify, with an unsubscribe link.
Programme emails show the merchant's name ("[Store] via Referclan").

Provider	Purpose
Shopify	The platform the app runs on; the source of commerce data
Railway	Application hosting and database (United States)
Cloudflare R2	Private file storage for imports and exports
Resend	Sending email, including sign-in links
Tally	The private-beta application form on our website

We share data only as needed for these purposes. We may also disclose data where the law requires it.

6. How long we keep data

Record	Retention
Successful raw Shopify webhook payloads	30 days
Failed or quarantined payloads	Up to 180 days
Attribution, commission, reward and payout records	While the merchant uses Referclan, subject to redaction requests
Creator, referrer and shopper email	While needed for the programme, then deleted or pseudonymised
Sign-in and invitation secrets	Stored only as hashes
Sign-in attempt records and debug logs	30 days
Security and protected-data access logs	12 months
Database backups	About 4 weeks, rolling (point-in-time recovery archive)
Ad-hoc exports	7 days

7. Your rights and Shopify privacy requests

Shopper requests: Shopify passes these on through its privacy webhooks (customer data request, customer redaction, shop redaction), and Referclan handles them. A redaction removes or pseudonymises the person's identity and keeps the money totals the merchant's accounts need. A redaction is re-applied if a backup is ever restored.
Creators and referrers can ask the merchant who runs their programme, or contact us. Where we act for a merchant, we pass the request to them.
Your rights. Depending on where you live, you may have the right to access, correct or delete your personal data, to object to or restrict its use, to receive a copy, and to complain to your data-protection authority. We do not discriminate against anyone for exercising these rights. Contact hello@referclan.com.

8. Website and beta applications

The marketing site does not use advertising trackers. The private-beta application form is hosted by Tally, and its answers are used only to assess and contact applicants. We are the controller of this data. We keep it only while needed to assess the application and keep in touch about the beta, and for no more than 12 months after the application is decided unless you become a merchant. Please do not submit customer data, order exports or credentials through the form.

9. Security

Data is encrypted in transit. Shopify tokens are encrypted at rest with application encryption.
Each merchant's data is isolated by database row-level security.
Staff access follows roles. Internal operator access is time-limited, has a reason, and is logged.
Our hosting and storage providers encrypt data, backups and recovery archives at rest (AES-256).
No system is perfectly secure. If a breach affects your data, we notify the merchant without undue delay, and we notify you or the regulator where the law requires us to.

Privacy Policy