Privacy policy
Last updated September 29, 2026
Mint Wholesale is a Shopify app made by Mint Labs ("we", "us"). It gives a merchant's wholesale customers their own prices: customers with a tag the merchant chooses get a discount calculated by Shopify at checkout, and can apply for a wholesale account. This policy explains what the app handles about merchants and the merchant's customers, why, and when it's deleted. For customer data we act as a service provider (processor) to the merchant, who is the controller.
The short version
- We don't store customers' names, email addresses, phone numbers or addresses. Names and emails are fetched from Shopify when the merchant views them.
- For wholesale applications we store only the Shopify customer ID and the status (pending, approved or declined) with dates. What the customer typed in the application is saved on their customer record in the merchant's Shopify store.
- Wholesale prices are worked out by Shopify Functions inside Shopify's checkout from the customer's tags; that data doesn't reach our servers.
- We never sell or share data, use it for advertising, or combine it across stores. No cookies, no tracking.
Information about merchants
| Information | Why |
|---|---|
| Store domain and a Shopify access token | To create and update the wholesale discount and checkout rule, save settings for the theme blocks, list tier customers and tag approved applicants. |
| Settings: price tiers (names, customer tags, rates, collection and product rules, volume breaks, minimums), checkout texts, application settings, store currency | To run wholesale pricing the way the merchant set it up. |
| Plan and subscription status | Read from Shopify to decide which features apply. Payments are handled entirely by Shopify. |
| When the storefront blocks last loaded; whether our last email succeeded | To show setup status and email problems in the app. |
| The store's name and contact email (read from Shopify when sending, not stored) | To send approval emails in the store's name with replies going to the store, and new-application notices to the merchant (both optional). |
Information about the merchant's customers
| Information | How it's used | Kept |
|---|---|---|
| Wholesale application status: Shopify customer ID, pending / approved / declined, the tier approved into, submission and decision dates | To list applications for the merchant to review and prevent duplicate applications. | Pending: until decided. Decided: 90 days after the decision |
| Application answers: business name, website, tax / VAT / resale ID and a message, typed by a signed-in customer | Saved directly on the customer's record in the merchant's Shopify store (app fields visible on the customer page) so the merchant can decide. Not stored on our servers. | In the merchant's store, under their control |
| Customer tags (for example “wholesale”, “wholesale-pending”) | Added or removed on the customer record in Shopify when the merchant approves, declines or moves a customer between tiers. | In the merchant's store |
| Names, email addresses, order counts and amount spent | Shown to the merchant on the Customers and Applications pages, fetched live from Shopify. The email address is also used to send an approval email if the merchant has that on. | Not stored |
| Rate-limit counters keyed by Shopify customer ID | To stop repeated application submissions. | 1 hour window, deleted within a day |
| Cart contents and customer tags at checkout | Read by the app's Shopify Functions inside Shopify to price items and check minimums. Functions can't send data anywhere; nothing reaches us. | Not stored |
| Browser storage on the shopper's device | The storefront script saves today's date in local storage so it reports "the block is live" to us at most once a day. No cookies. | On the device |
Emails
Two optional, transactional emails, both off-switchable by the merchant: an approval email to a customer whose application was approved (sent in the store's name, replies go to the store), and a notice to the merchant that an application is waiting (no customer details in it). They are sent through Cloudflare Email Service. We don't send marketing email and don't keep copies or logs of addresses.
Customer privacy requests
- Access requests (Shopify's
customers/data_request): the app home shows the request and the merchant downloads what the app holds about that customer (application status) plus the application fields it saved on their record, as a file to send them. - Erasure requests (
customers/redact): we permanently delete the customer's application status and any pending request. - Store deletion (
shop/redact, sent 48 hours after a merchant uninstalls): we permanently delete everything we hold for the store.
Where data is processed and how it's protected
The app runs on Cloudflare (hosting, database and email sending) and connects to Shopify's APIs. Data is encrypted in transit (TLS) and at rest. Access is limited to Mint Labs staff who need it to provide support. We use no other sub-processors, analytics or trackers. See our security policy.
Retention
Settings are kept while the app is installed and deleted 48 hours after uninstall. Pending applications are kept until the merchant decides; decided ones are deleted 90 days later. Access tokens are deleted as soon as the app is uninstalled. Rate-limit counters are deleted within a day.
Your rights
Depending on where you are, you may have the right to access, correct or delete information about you. Merchants can contact us directly; customers should contact the store they applied to, or email us and we'll pass the request on. We respond within 30 days.
Changes
If we change this policy we'll update the date above and, for significant changes, notify merchants in the app.
Contact
Mint Labs — support@stickermint.com