Privacy Policy

Last updated: 22 July 2026

This Privacy Policy explains how Distil Technology Limited, trading as Shop This Room ("Shop This Room", "we", "us", or "our") collects, uses, and protects information when you install and use the Shop This Room Shopify Sales Channel application (the "App").

Distil Technology Limited is a company incorporated in England and Wales (company number 15452977). Our contact address is available at the foot of this policy.

1. Who this policy applies to

This policy applies to Shopify merchants who install the Shop This Room App via the Shopify App Store ("Merchants"). It does not govern the separate privacy practices of individual Shopify merchants in relation to their own customers.

Distil does not directly collect or store personal data from end-customers (the consumers who browse or purchase through a Shop This Room-powered storefront). End-customer data is processed by the Merchant and by Shopify under their respective privacy policies.

2. What data we collect

When a Merchant installs the App, we collect and store the following information:

Shop domain — the myshopify.com domain of the Merchant's store, used to identify and authenticate the Merchant.
OAuth access token and scopes — issued by Shopify on installation, used to make authorised API calls on behalf of the Merchant.
Storefront access token — created on the Merchant's store after installation, used to attribute sales to the Shop This Room channel.
Billing subscription identifier — the Shopify App Subscription ID used to record usage-based commission charges via Shopify Billing.
Commission rate — the agreed commission percentage applied to orders placed through the Shop This Room channel (default 15%).

When an order is placed through the Shop This Room storefront and a Merchant has granted the necessary permissions, we receive an orders/paid webhook from Shopify. We process only the order total value and order identifier from this event to calculate and record the applicable commission. We do not store or process customer names, email addresses, postal addresses, telephone numbers, or payment information from order data.

3. How we use this data

We use the data listed above solely for the following purposes:

Authenticating and maintaining the Merchant's installation of the App.
Displaying the Merchant's channel status and storefront configuration within the App dashboard.
Calculating and recording commission charges for orders placed through the Shop This Room storefront, billed via Shopify Billing.
Registering the Distil Sales Channel on the Merchant's store and attributing sales correctly.

We do not use Merchant or order data for advertising, profiling, or any purpose beyond the operation of the App.

4. Data sharing and sub-processors

We do not sell or rent data to third parties. We use the following sub-processors to operate the App:

Shopify Inc. — the platform through which the App is distributed and through which billing is administered.
Supabase Inc. — our hosted database provider, used to store session and merchant configuration data. Data is stored in the EU West (Ireland) region.
Render Inc. — our application hosting provider. The App backend runs in the US region. Data in transit is encrypted using TLS.

5. International data transfers

Shop This Room (Distil Technology Limited) is based in the United Kingdom. Some sub-processors listed above operate outside the UK and EEA. Where data is transferred internationally, we rely on Standard Contractual Clauses or equivalent transfer mechanisms as recognised under UK GDPR and the EU GDPR to ensure an adequate level of protection.

6. Data retention

Merchant session and configuration data is retained for as long as the App is installed on the Merchant's store. When a Merchant uninstalls the App, we delete the associated session data within 48 hours of receiving Shopify's uninstall notification. Order data (order ID and total value used for commission calculation) is retained for a maximum of 7 years for financial record-keeping purposes.

7. Your rights

Under UK GDPR and EU GDPR, Merchants have the right to:

Access the personal data we hold about them.
Request correction of inaccurate data.
Request erasure of their data, subject to our legal retention obligations.
Object to or restrict our processing of their data.
Request a portable copy of their data.

To exercise any of these rights, please contact us at the address below. We will respond within 30 days.

8. Security

All data is transmitted over encrypted connections (TLS). Access tokens are stored in an encrypted database. Access to production data is restricted to authorised personnel only. We do not store customer payment information at any point.

9. Changes to this policy

We may update this policy from time to time. Material changes will be communicated to Merchants via the App or by email. Continued use of the App after changes constitutes acceptance of the updated policy.

10. Contact

If you have questions about this policy or wish to exercise your data rights, please contact:

Distil Technology Limited
Company number: 15452977
Email: ben@thisroom.shop