Privacy policy
Last updated October 4, 2026
Mint Price Match is a Shopify app made by Mint Labs ("we", "us"). It adds a "Found it cheaper?" button to a merchant's product pages: a shopper sends the link and price of the same item at another store, the merchant approves or declines, and an approved shopper gets a single-use discount code. This policy explains what the app handles about merchants and about the merchant's shoppers, why, and when it's deleted. For shopper data we act as a service provider (processor) to the merchant, who is the controller.
The short version
- For each price match request we store the shopper's email address (encrypted), the other store's link and the price they entered, an optional note, the product, and the merchant's decision and code.
- We never store IP addresses: rate limits use a keyed one-way hash of the IP address, deleted after 30 days.
- Emails, notes and links are erased 60 days after a request ends (declined, code used, expired or cancelled).
- We use email addresses only to answer the shopper's request. We never sell or share data, use it for advertising, or combine it across stores.
Information about merchants
| Information | Why |
|---|---|
| Store domain and a Shopify access token | To read the requested product's price, create and switch off price match codes, save the storefront settings and receive paid-order notifications. |
| Store name, store email, contact email, currency, time zone, primary domain and whether the online store is password protected | The store name is the sender name of shopper emails and the contact email their reply-to address; the store email receives test emails; the currency is used for code amounts; the time zone for expiry times; the domain for links back to the store. |
| Settings (competitor list, texts, policy, code rules, automatic approval rules) | To run price matching the way the merchant set it up. |
| Plan status | Read from Shopify to decide which features apply. Plans are chosen on Shopify's plan page and billed by Shopify. |
Information about the merchant's shoppers
| Information | How it's used | Kept |
|---|---|---|
| Email address (encrypted with AES-256-GCM) and a keyed one-way hash of it | To email the shopper their code or the merchant's answer, to stop duplicate requests, and to find their data for privacy requests. | Until 60 days after the request ends |
| The request: product and variant, the other store's link, the price they entered, the shopper's market country and currency, an optional note | So the merchant can review it and so the code is for the right item and amount. | Link and note: until 60 days after the request ends. Product, prices and decision: 400 days (no longer linked to the shopper) |
| Decision: approved or declined, the reason, the code, its amount and expiry, whether it was used | To show the shopper their status and keep the merchant's record of discounts given. | 400 days |
| Price check result (Pro): the prices the competitor page lists in its structured data, the page title and how it compares | To show the merchant whether the page supports the request. The page itself is never stored. | With the request |
| A keyed hash of the shopper's IP address (never the raw address) | Rate limits against automated or repeated requests. | 30 days |
| Emails waiting or sent: which email (approved, declined), status and time | To send each email once and never lose one if sending fails. No message content or address is kept in this record. | 30 days after sending |
| Paid-order notifications from Shopify (orders/paid) | Only the order ID, number, total, currency and discount codes are read, to mark a price match code as used and count it in Analytics. No customer fields are read or stored. | 400 days |
| Browser storage on the shopper's device | Local storage: the date of a once-a-day "the button is live" signal for the merchant's setup page. No cookies. | On the device |
The price check (Pro)
If the merchant turns it on, the app requests the one competitor page the shopper linked, only if that site is on the merchant's competitor list. The request comes from our servers, carries no shopper data, cookies or credentials, and identifies itself as Mint Price Match. Only the listed prices are kept.
Emails we send
Shopper emails are sent through Cloudflare Email Service from our sending domain (mail.stickermint.com), with the store's name as the sender and the store's contact email as the reply-to address: the code when a request is approved, and the merchant's reason when it's declined (if the merchant keeps that on). Both answer the shopper's own request and say why they were sent. We send no marketing.
Customer privacy requests
- Access requests (Shopify's
customers/data_request): the app home shows the request and the merchant downloads everything we hold about that shopper as a file to send them. - Erasure requests (
customers/redact): we permanently erase the shopper's email, IP hash, note and link from their requests and drop any email still waiting to them. The merchant keeps an anonymous record of the discount it gave. - Store deletion (
shop/redact, sent 48 hours after a merchant uninstalls): we permanently delete everything we hold for the store.
Where data is processed and how it's protected
The app runs on Cloudflare (hosting, database, message queue and email sending) and connects to Shopify's APIs. Data is encrypted in transit (TLS) and at rest; shopper email addresses are additionally encrypted by the app with a key kept separately from the database. Access is limited to Mint Labs staff who need it to provide support. We use no other sub-processors, analytics or trackers. See our security policy.
Retention
Emails, notes and links are erased 60 days after a request ends; requests nobody decided end after 120 days. IP hashes are deleted after 30 days. Request and order records (without personal data) are deleted after 400 days. Access tokens are deleted as soon as the app is uninstalled, and everything else 48 hours later when Shopify asks us to delete the store's data. Short-lived server logs kept by Cloudflare don't contain email addresses.
Your rights
Depending on where you are, you may have the right to access, correct or delete information about you. Merchants can contact us directly; shoppers can contact the store, or email us and we'll pass the request on. We respond within 30 days.
Changes
If we change this policy we'll update the date above and, for significant changes, notify merchants in the app.
Contact
Mint Labs — support@stickermint.com