Privacy policy
Last updated September 30, 2026
Mint Delivery Date is a Shopify app made by Mint Labs ("we", "us"). It lets a merchant's customers choose a delivery or pickup date (and time slot) in the cart, and shows the merchant their upcoming deliveries. This policy explains what the app handles about merchants and the merchant's customers, why, and when it's deleted. For customer data we act as a service provider (processor) to the merchant, who is the controller.
The short version
- We don't store or read customers' names, email addresses, phone numbers or addresses.
- For orders with a delivery date we store the order ID and order number (like #1001), the chosen method, date and time slot, and whether the order was cancelled — to list deliveries and count orders against the merchant's limits.
- The chosen date is saved in the shopper's cart by Shopify (cart attributes) and becomes part of the order in the merchant's store.
- We never sell or share data, use it for advertising, or combine it across stores. No cookies, no tracking.
Information about merchants
| Information | Why |
|---|---|
| Store domain and a Shopify access token | To publish the delivery rules to the storefront and checkout, receive order updates, and tag orders with their date. |
| Settings: delivery and pickup rules (lead time, cut-off, closed weekdays and dates with the merchant's own notes, time slots, order limits), checkout messages, tagging on/off | To run the date picker and the checkout check the way the merchant set them up. |
| The store's time zone | Dates, cut-offs and lead times are worked out on the store's clock. |
| Plan and subscription status | Read from Shopify to decide which features apply. Payments are handled entirely by Shopify. |
| When the storefront picker last loaded | To show setup status in the app. |
Information about the merchant's customers and orders
| Information | How it's used | Kept |
|---|---|---|
| Cart attributes chosen by the shopper: Delivery date, Delivery time, Delivery method | Saved in the shopper's Shopify cart by the storefront picker; Shopify copies them onto the order. They are part of the merchant's order data in Shopify. | In the merchant's store, under their control |
| For orders with a date: order ID, order number, method, date, time slot, cancelled or not, the date tag the app added, and when the order was last updated | Received from Shopify's order webhooks (we ask Shopify for only the order ID, number, note attributes and timestamps — no customer fields) to list deliveries by date, count orders against daily and time-slot limits, and keep the order's date tag correct. | Until 90 days after the delivery date; cancelled orders 30 days after they were recorded |
| Order tags like “delivery-2026-10-06” | Added to the order in Shopify (if the merchant keeps tagging on) so orders can be filtered by date. | In the merchant's store |
| Cart contents and cart attributes at checkout | Read by the app's Shopify Function inside Shopify to check the date (Pro). Functions can't send data anywhere; nothing reaches us. | Not stored |
| Browser storage on the shopper's device | The picker saves the time of its last setup-status report in local storage, so it tells us "the picker is live" at most once a day. No cookies. | On the device |
Customer privacy requests
- Access requests (Shopify's
customers/data_request): the app home shows the request and the merchant downloads what the app holds for that customer's orders (dates, time slots, order numbers) as a file to send them. - Erasure requests (
customers/redact): we permanently delete the delivery records of the orders Shopify lists. - Store deletion (
shop/redact, sent 48 hours after a merchant uninstalls): we permanently delete everything we hold for the store.
Where data is processed and how it's protected
The app runs on Cloudflare (hosting and database) and connects to Shopify's APIs. Data is encrypted in transit (TLS) and at rest. Access is limited to Mint Labs staff who need it to provide support. We use no other sub-processors, analytics or trackers. See our security policy.
Retention
Settings are kept while the app is installed and deleted 48 hours after uninstall. Delivery records are deleted 90 days after their delivery date (cancelled orders 30 days after they were recorded). Data requests are deleted 30 days after they arrive. Access tokens are deleted as soon as the app is uninstalled.
Your rights
Depending on where you are, you may have the right to access, correct or delete information about you. Merchants can contact us directly; customers should contact the store they ordered from, or email us and we'll pass the request on. We respond within 30 days.
Changes
If we change this policy we'll update the date above and, for significant changes, notify merchants in the app.
Contact
Mint Labs — support@stickermint.com