Privacy Policy

1. Who we are

Hypesoul is a Shopify app operated by Kirill Novak s.r.o., Nad Dalejským údolím 2690/7, 155 00 Praha, Czech Republic. We are the data controller for the personal data described below. You can reach us at Bochichenko@gmail.com.

2. What the app does

Hypesoul lets a Shopify merchant run an affiliate (partner) program. The merchant invites partners, the app creates a unique discount code and tracking link for each partner, records clicks and orders that come through those links or codes, and calculates the commission owed to the partner and the service fee owed to us.

The app is installed from the Shopify App Store and runs inside the Shopify admin. The merchant pays for the app through Shopify Billing; we never see card or bank details.

3. Personal data we process

We keep the amount of data we process as small as possible.

• Merchant account data: your shop domain (for example my-store.myshopify.com), the shop currency, your program settings (discount percentage, commission percentage) and the Shopify access token stored in your session. Your name and email may be present in the Shopify session record when you log in.
• Partner data: the partner's name, an optional email address, the partner's public code and a private invite token used to open the partner portal without a password.
• Click data: the partner code that was clicked, the shop domain, the visitor's IP address and browser user agent, and the click time. This is used to match clicks with orders and to detect fraudulent clicks.
• Order data: the Shopify order identifier and order number, the order total after discount, the discount amount, the partner commission, our service fee, the order status and timestamps.
• Payout data: the amount the merchant has paid to a partner and an optional note.
• Partner payout details: if a partner chooses to add them, the details needed to pay the partner (for example a PayPal email, an IBAN or a wallet address). They are stored encrypted, are shown only to the merchant who runs the program when paying that partner, and the partner can delete them at any time. We do not use them for any other purpose.

4. What we do not collect

We do not store shopper names, email addresses, phone numbers, shipping or billing addresses, payment details, or the contents of shopping carts. We do not store customer profiles, and we do not sell data to anyone.

Our tracking link does not set advertising cookies and does not use third-party analytics or advertising pixels.

5. Why we process data and on what legal basis

• To provide the app to the merchant — performance of our contract with the merchant (Art. 6(1)(b) GDPR).
• To calculate commissions, service fees and partner payouts — performance of the contract.
• To prevent fraud, click spam and abuse of discount codes — our legitimate interest (Art. 6(1)(f) GDPR).
• To meet accounting and tax obligations — legal obligation (Art. 6(1)(c) GDPR).
• To answer support requests — our legitimate interest or the contract, depending on the request.

6. Who we share data with

We share data only with service providers that help us run the app, and only as far as needed:

• Shopify Inc. — authentication, embedded admin, billing and webhooks. Shopify processes merchant and shopper data under its own privacy policy.
• Our hosting provider and managed PostgreSQL provider, which store the app database and run the server. They act as our processors under data processing agreements.
• Professional advisers and authorities, where the law requires it.

7. International transfers

Our servers and database are hosted in the European Union. Where a provider processes data outside the EU/EEA, we rely on the European Commission's Standard Contractual Clauses or an adequacy decision.

8. How long we keep data

• Merchant and partner data: while the app is installed and the program is active.
• Click and order records: while the app is installed, so commissions and payouts remain verifiable.
• When the app is uninstalled, Shopify sends us a shop redaction request. We delete the shop record and all related partners, clicks, orders and payouts, normally within 48 hours.
• Records we must keep for accounting (for example issued invoices) may be kept for the period required by law.

9. Your rights

If you are a merchant, a partner or a visitor whose click was recorded, you can ask us to access, correct, delete or export your data, or object to processing based on legitimate interest. Write to Bochichenko@gmail.com. We answer within one month.

If you are a shopper of a store that uses the app, the merchant is the controller of your order data. We do not hold your identity, so requests about your order should go to the store. We support the store's requests, including Shopify's customers data request and redaction webhooks.

You also have the right to complain to a supervisory authority — in the Czech Republic, the Office for Personal Data Protection (ÚOOÚ).

10. Security

Access to the app database is limited to the people who operate the app. Shopify access tokens are stored server-side and are never sent to browsers. Data in transit is protected with HTTPS. Partner payout details are encrypted at rest with AES-256-GCM. Partner portals are opened with long random invite tokens and do not expose other partners' data.

11. Cookies

The app does not set marketing, advertising or analytics cookies. The partner dashboard sets one strictly necessary sign-in cookie (HttpOnly and Secure). The embedded admin uses Shopify's session mechanism. The public tracking link records a click server-side and redirects to the store; it does not write cookies of its own. See the Cookie Notice for details.

12. Children

The app is a business tool for merchants and is not directed at children. We do not knowingly collect data from children.

13. Changes to this policy

If we change how the app handles data, we update this page and change the date at the top. Significant changes are announced to merchants in the app or by email.

14. Contact

Kirill Novak s.r.o., Nad Dalejským údolím 2690/7, 155 00 Praha, Czech Republic. Company ID (IČ): 28432797, VAT ID (DIČ): CZ28432797. Email: Bochichenko@gmail.com.

Subscription fees are charged by Shopify; the current price is €1 per month plus a 2% service fee on partner-driven orders, capped at €149 per 30 days.