Privacy Policy

This policy applies to Shopify merchants who install the Distil App via the Shopify App Store (“Merchants”). It does not govern the separate privacy practices of individual Shopify merchants in relation to their own customers.

Distil does not directly collect or store personal data from end-customers (the consumers who browse or purchase through a Distil-powered storefront). End-customer data is processed by the Merchant and by Shopify under their respective privacy policies.

When a Merchant installs the App, we collect and store the following information:

• Shop domain— the myshopify.com domain of the Merchant’s store, used to identify and authenticate the Merchant.
• OAuth access token and scopes — issued by Shopify on installation, used to make authorised API calls on behalf of the Merchant.
• Storefront access token— created on the Merchant’s store after installation, used to attribute sales to the Distil channel.
• Billing subscription identifier — the Shopify App Subscription ID used to record usage-based commission charges via Shopify Billing.
• Commission rate — the agreed commission percentage applied to orders placed through the Distil channel (default 15%).

When an order is placed through the Distil storefront and a Merchant has granted the necessary permissions, we receive an orders/paid webhook from Shopify. We process only the order total value and order identifier from this event to calculate and record the applicable commission. We do not store or process customer names, email addresses, postal addresses, telephone numbers, or payment information from order data.

We use the data listed above solely for the following purposes:

• Authenticating and maintaining the Merchant’s installation of the App.
• Displaying the Merchant’s channel status and storefront configuration within the App dashboard.
• Calculating and recording commission charges for orders placed through the Distil storefront, billed via Shopify Billing.
• Registering the Distil Sales Channel on the Merchant’s store and attributing sales correctly.

We do not use Merchant or order data for advertising, profiling, or any purpose beyond the operation of the App.

We do not sell or rent data to third parties. We use the following sub-processors to operate the App:

• Shopify Inc. — the platform through which the App is distributed and through which billing is administered.
• Supabase Inc. — our hosted database provider, used to store session and merchant configuration data. Data is stored in the EU West (Ireland) region.
• Render Inc. — our application hosting provider. The App backend runs in the US region. Data in transit is encrypted using TLS.

Distil Technology Limited is based in the United Kingdom. Some sub-processors listed above operate outside the UK and EEA. Where data is transferred internationally, we rely on Standard Contractual Clauses or equivalent transfer mechanisms as recognised under UK GDPR and the EU GDPR to ensure an adequate level of protection.

Merchant session and configuration data is retained for as long as the App is installed on the Merchant’s store. When a Merchant uninstalls the App, we delete the associated session data within 48 hours of receiving Shopify’s uninstall notification. Order data (order ID and total value used for commission calculation) is retained for a maximum of 7 years for financial record-keeping purposes.

Under UK GDPR and EU GDPR, Merchants have the right to:

• Access the personal data we hold about them.
• Request correction of inaccurate data.
• Request erasure of their data, subject to our legal retention obligations.
• Object to or restrict our processing of their data.
• Request a portable copy of their data.

To exercise any of these rights, please contact us at the address below. We will respond within 30 days.

All data is transmitted over encrypted connections (TLS). Access tokens are stored in an encrypted database. Access to production data is restricted to authorised personnel only. We do not store customer payment information at any point.

We may update this policy from time to time. Material changes will be communicated to Merchants via the App or by email. Continued use of the App after changes constitutes acceptance of the updated policy.

If you have questions about this policy or wish to exercise your data rights, please contact:

• Distil Technology Limited
• Company number: 15452977
• Email: ben@bydistil.com