Privacy policy
Last updated October 1, 2026
Mint Cart Drawer is a Shopify app made by Mint Labs ("we", "us"). It shows a slide-out cart drawer in a merchant's online store, with a free-shipping progress bar, optional rewards applied at checkout and optional add-ons. This policy explains what the app handles, why, and when it's deleted. For data about a merchant's customers we act as a service provider (processor) to the merchant, who is the controller.
The short version
- We don't store any customer data: no names, email addresses, phone numbers, addresses or IP addresses.
- The shopper's cart is read and changed in their browser through Shopify's own cart, on the store's domain. It is never sent to us.
- Pro analytics are counts only (drawer opens, add-ons added, free gifts added, goals reached), plus sales of add-ons from paid orders.
- No cookies, no tracking across stores or sites, no advertising, nothing sold or shared.
Information about merchants
| Information | Why |
|---|---|
| Store domain, store currency and a Shopify access token | To publish the drawer settings to the storefront, run the rewards discount, and (Pro) receive paid orders for add-on sales. |
| Settings: colours, texts, free-shipping goal, rewards (goals, amounts, chosen gift products' IDs and titles), recommended products' IDs and titles, which add-ons are on | To show the drawer the way the merchant set it up. |
| IDs of what the app created in the store: the rewards discount and the orders/paid subscription status | To keep them up to date and switch them off when needed. |
| Plan and subscription status | Read from Shopify to decide which features apply. Payments are handled entirely by Shopify. |
| When the app embed last loaded on the storefront | To show setup status in the app. |
Information about the merchant's customers and orders
| Information | How it's used | Kept |
|---|---|---|
| The shopper's cart (items, quantities, prices, discounts, order note, discount codes) | Read and changed by the drawer script in the shopper's browser with Shopify's cart on the store's domain. Free gifts and products added from recommendations carry a hidden line item property (_mint_cart_gift / _mint_cart) so the rewards and add-on sales can be recognised. Never sent to us. | In the shopper's Shopify cart |
| Cart lines at checkout | Read by the app's Shopify Function inside Shopify to apply the rewards. Functions can't send data anywhere; nothing reaches us. | Not stored |
| Usage counts (Pro, if analytics are on): drawer opens, add-ons added, free gifts added, reward goals reached | Sent as plain numbers through the store's app proxy when the shopper leaves a page, and added to the store's daily totals. No identifiers, no IP addresses stored. | Daily totals, up to 400 days |
| Paid orders (Pro, once Shopify approves the app's order access): order ID and line items | Shopify sends the order ID and line items only (no customer fields). Lines added from the drawer's recommendations are added up into daily totals (orders, items, sales). The order ID is kept so a re-sent order isn't counted twice. | Totals up to 400 days; order IDs 30 days |
| Browser storage on the shopper's device | Session storage (cleared when the browser tab closes): free gifts the shopper removed or that couldn't be added, reward goals already counted, and cached product recommendations. Local storage: the time of the drawer's last setup-status report (so it reports "live" at most twice a day). No cookies. | On the device |
Customer privacy requests
- Access requests (Shopify's
customers/data_request): we hold no customer data. If any of the customer's orders is among the order IDs kept for counting, we report those order IDs to the merchant. - Erasure requests (
customers/redact): we delete the listed orders' IDs. - Store deletion (
shop/redact, sent 48 hours after a merchant uninstalls): we permanently delete everything we hold for the store.
Where data is processed and how it's protected
The app runs on Cloudflare (hosting and database) and connects to Shopify's APIs. Data is encrypted in transit (TLS) and at rest. Access is limited to Mint Labs staff who need it to provide support. We use no other sub-processors, analytics or trackers. See our security policy.
Retention
Settings and analytics totals are kept while the app is installed and deleted 48 hours after uninstall. Access tokens are deleted as soon as the app is uninstalled. Order IDs are deleted after 30 days, daily totals after 400 days.
Your rights
Depending on where you are, you may have the right to access, correct or delete information about you. Merchants can contact us directly; customers should contact the store they ordered from, or email us and we'll pass the request on. We respond within 30 days.
Changes
If we change this policy we'll update the date above and, for significant changes, notify merchants in the app.
Contact
Mint Labs — support@stickermint.com