Privacy policy
Last updated September 29, 2026
Mint Popups is a Shopify app made by Mint Labs ("we", "us"). It shows email signup popups on a merchant's Shopify store and adds the people who sign up to that merchant's Shopify customers. This policy explains what the app handles — about merchants and about shoppers who use a popup — why, and how it's deleted. For shopper data we act as a service provider (processor) to the merchant, who is the controller of their customer list and responsible for how they email it.
The short version
- When a shopper signs up, we pass their email address to the merchant's Shopify store and record their marketing consent there.
- We don't keep a copy of shoppers' email addresses, names or IP addresses in our own database.
- Our database holds popup settings and anonymous totals (views and signups per popup per day).
- We never sell or share data, use it for advertising, or combine it across stores. The storefront script sets no cookies.
Information about merchants
| Information | Why |
|---|---|
| Store domain and a Shopify access token | To connect to the store to save signups, create discount codes and publish popups. |
| Popup settings (text, colours, triggers, targeting, offer) and app settings | To show the popups the way the merchant configured them. |
| Daily totals of popup views and signups, and a monthly signup count | To show stats and A/B results, and to apply the Free plan's monthly limit. These are counts only. |
| Plan and subscription status | Read from Shopify to decide which features apply. Payments are handled entirely by Shopify. |
Information about shoppers who use a popup
| Information | How it's used | Stored by us? |
|---|---|---|
| Email address entered in the popup | Sent to the merchant's Shopify store to create or update the customer, with email marketing consent (subscribed or pending, the date, and single or confirmed opt-in) and the tag "mint-popups". If the merchant uses confirmed opt-in, we send one confirmation email to that address. | No — only in the merchant's Shopify store |
| Whether the consent box was ticked (if the merchant shows one) | Checked before subscribing; the consent itself is recorded on the Shopify customer. | No |
| Discount code created for the shopper (Pro unique codes) | Created in the merchant's Shopify Discounts and shown to the shopper. A tag on the Shopify customer prevents a second code. | No — only in Shopify |
| IP address (forwarded by Shopify) | Turned into a keyed one-way hash to limit repeated signups from the same connection (spam protection). | Only the hash, deleted after one hour |
| Popup views | Counted anonymously per popup, version and day for the merchant's stats. | Counts only |
| Browser storage on the shopper's device | The popup remembers in the browser's local storage whether it was closed or used and which A/B version was shown, so it isn't shown again too soon. This stays on the device and is never sent to us. | No |
Customer privacy requests
- Access requests (Shopify's
customers/data_request): we hold no shopper-level data, so there is nothing to add to what the merchant already has in Shopify. We confirm this to the merchant on request. - Erasure requests (
customers/redact): Shopify erases the customer record in the store; we hold no shopper-level data to delete. - Store deletion (
shop/redact, sent 48 hours after a merchant uninstalls): we permanently delete the store's popups, settings, stats, usage counts, rate-limit records and access tokens. - Unsubscribing: shoppers unsubscribe through the link in the merchant's marketing emails; Shopify updates their consent.
Where data is processed and how it's protected
The app runs on Cloudflare (hosting, database and, for confirmed opt-in, email sending) and connects to Shopify's APIs. Data is encrypted in transit (TLS) and at rest. Access is limited to Mint Labs staff who need it to provide support. We use no other sub-processors, analytics or trackers.
Retention
Popup settings and stats are kept while the app is installed and deleted when the store is deleted after uninstall. Rate-limit hashes are deleted after one hour. Access tokens are deleted as soon as the app is uninstalled. Subscribers remain in the merchant's Shopify store under the merchant's control.
Your rights
Depending on where you are, you may have the right to access, correct or delete information about you. Merchants can contact us directly; shoppers should contact the store they signed up with, or email us and we'll pass the request on. We respond within 30 days.
Changes
If we change this policy we'll update the date above and, for significant changes, notify merchants in the app.
Contact
Mint Labs — support@stickermint.com