Privacy policy
Last updated September 30, 2026
Mint Downloads is a Shopify app made by Mint Labs ("we", "us"). It stores a merchant's digital product files and delivers them, and license keys, to the merchant's customers after they pay. This policy explains what the app handles about merchants and about the merchant's customers, why, and when it's deleted. For customer data we act as a service provider (processor) to the merchant, who is the controller.
The short version
- We never store customers' names, email addresses, phone numbers or postal addresses.
- A buyer's email address is read from Shopify only to send them their download email, and is not stored or logged. If email sending isn't available, nothing is sent and the address isn't kept.
- To deliver an order we keep Shopify order and line IDs, the order number, item titles, the files and license keys delivered, and how often each file was downloaded.
- To count downloads we keep a keyed one-way hash of the downloading device's IP address and browser for up to 24 hours — never the address itself.
- We never sell or share data, use it for advertising, or combine it across stores. Our pages set no cookies and use no analytics or trackers.
Information about merchants
| Information | Why |
|---|---|
| Store domain and a Shopify access token | To read paid orders and products from Shopify and receive order notifications. |
| Store name and the store's contact email (from Shopify) | To name the store in download emails and on download pages, and as the reply-to address of download emails. |
| Files the merchant uploads, with their names, sizes and types | To deliver them to buyers. Stored privately; only reachable through a signed download link for an order. |
| License keys the merchant imports | To give one key to each item bought. |
| Products and variants chosen in the app (IDs, titles, images) and their settings | To know what each product delivers and to show it in the admin. |
| Settings: download limit, link expiry, email texts, cancellation behaviour | To deliver orders the way the merchant set them up. |
| Plan and subscription status | Read from Shopify to decide which features apply. Payments are handled entirely by Shopify. |
Information about the merchant's customers
| Information | How it's used | Kept |
|---|---|---|
| Paid orders that contain a digital product: Shopify order ID, order number, line IDs, item titles and quantities, whether it's a test order | To deliver the right files and license keys once, and to list delivered orders for the merchant. | While the order's downloads can be used; see Retention |
| A keyed one-way hash of the order's confirmation number (never the number itself) | To check that a Thank you or Order status page asking for an order's downloads is that buyer's own page. | With the order |
| Downloads: per file, how many times it was downloaded and when last | To apply download limits and show the merchant whether a buyer got their files. | With the order |
| A keyed one-way hash of the downloading device's IP address and browser (user agent) | So that one download that is paused, resumed or fetched in parts is counted once per device per 6 hours. | 24 hours |
| License keys assigned to order lines | To show the buyer their key and the merchant which key went to which order, and so a key is never given out twice. | While the store uses the app |
| The buyer's email address and the link to their order status page | Read from the order notification or from Shopify only to send the download email. | Not stored or logged |
| Whether the download email was sent (sent, failed, not available) and when | So the merchant can see and resend it. | With the order |
| Order notifications from Shopify (orders paid, cancelled, refunded — they include personal details) | Only the IDs, titles, quantities, payment state and confirmation number listed above are read. | Not stored |
Download emails
When a merchant has download emails on (the default), the buyer receives one transactional email with their download links and license keys, sent in the store's name with replies going to the store. We send no marketing email. Emails are sent through Cloudflare Email Service.
Customer privacy requests
- Access requests (Shopify's
customers/data_request): the app home shows the request and the merchant downloads what we hold about the listed orders as a file to send to the customer. - Erasure requests (
customers/redact): we permanently delete the listed orders' delivery and download records. License keys given to those orders stay marked as used, without any personal data, so they're never issued to someone else. - Store deletion (
shop/redact, sent 48 hours after a merchant uninstalls): we permanently delete everything we hold for the store, including its files.
Where data is processed and how it's protected
The app runs on Cloudflare (hosting, database, file storage and email sending) and connects to Shopify's APIs. Data is encrypted in transit (TLS) and at rest. Files are stored privately and served only through signed, expiring links. Access is limited to Mint Labs staff who need it to provide support. We use no other sub-processors, analytics or trackers. See our security policy.
Retention
- Device hashes for download counting: 24 hours.
- Download records of a file whose download period has ended: deleted 90 days after it ends. Orders with nothing left to deliver are then removed.
- Downloads without an end date and license key assignments: kept while the store uses the app, so buyers can download again later.
- Unfinished uploads: 3 days.
- Access tokens: deleted as soon as the app is uninstalled. Everything else, including files: deleted when Shopify sends the store deletion request 48 hours later. Buyers' links keep working until then.
Your rights
Depending on where you are, you may have the right to access, correct or delete information about you. Merchants can contact us directly; customers should contact the store they ordered from, or email us and we'll pass the request on. We respond within 30 days.
Changes
If we change this policy we'll update the date above and, for significant changes, notify merchants in the app.
Contact
Mint Labs — support@stickermint.com