What we process, why, and for how long.

Operated by Kiricode (Estonia) · Last updated 5 September 2026

VIP Pass acts as a data processor on behalf of the merchant who installs it; the merchant remains the data controller for their customers' data. This page lists exactly what the app touches and what happens to it.

1. Data we process

Merchant data

Store domain, store name, contact email, currency and timezone (from the Shopify Admin API).
Campaign settings you configure in the app and your weekly-report preferences.
Billing status of your VIP Pass subscription (handled entirely by Shopify Billing; we never see payment details).

Order and customer data (received through Shopify order webhooks)

Order id and number, order subtotal, currency, payment and fulfilment status, discount codes used, and the title of the first line item.
For the buyer who receives a pass: first name, email address, phone number (if present) and Shopify customer id.
For a friend who uses a pass: email address and Shopify customer id.

We do not receive or store payment card data, full addresses, or order line-item details beyond the first product title.

2. Why we process it

To create a single-use friend discount for each order and attribute the friend's order back to the person who shared it.
To issue and email a thank-you discount to the referrer once the friend's order qualifies.
To detect self-referrals and returning customers, and to reverse credit when an order is refunded or cancelled.
To report referral performance to the merchant in the app and in an optional weekly email.
To calculate usage-based fees on the merchant's Shopify invoice.

3. Storefront visitors

When someone opens a VIP Pass link, the storefront embed verifies the pass with our servers and stores the pass code and its expiry in the visitor's browser storage so the countdown persists between pages. No tracking cookies, advertising identifiers or analytics scripts are used. The Shopify discount is applied through Shopify's standard discount link, and referral visits carryutm_source=vip_pass so the merchant can see the channel in their own analytics.

4. Sub-processors

Railway — application hosting, PostgreSQL database and Redis queue.
Resend — transactional email delivery (referrer thank-you emails, weekly merchant reports, data-request exports).
Shopify — all discount, order and billing operations run through the Shopify Admin API; refunded fees may be credited through the Shopify Partner API.

5. Retention and deletion

Pass and order records are kept while the app is installed so referral history and clawbacks work correctly.
When the app is uninstalled, access tokens are deleted immediately and all store data is permanently deleted when Shopify sends the mandatory shop/redact notice 48 hours later.
Customer deletion requests (customers/redact) anonymise every record tied to that customer within the app.
Customer data requests (customers/data_request) are compiled automatically and sent to the merchant so they can pass them on to the customer.

6. Security

Data is encrypted in transit (TLS) and at rest. Shopify webhooks are verified with HMAC signatures, storefront requests are verified with Shopify's app-proxy signature, and admin access uses Shopify session tokens. Personal data is never written to application logs. Access to production systems is limited to the app operator.

7. Contact

Questions or requests: support@kiricode.dev. We answer within one business day.