KW Tech Affiliate Privacy Policy

Last updated: 26 October 2026

KW Tech Affiliate (the “App”) is operated by Nexus Haven Limited, a company registered in New Zealand and trading as KW Tech (“we”, “us”). It lets Shopify merchants run affiliate and referral programs. This policy explains what information the App handles for merchants, their affiliates and their customers.

1. Information we collect

• Store information: shop domain, name, currency, time zone, contact email for notifications, and the access token Shopify issues so the App can work with the store.
• Affiliates: name, email, the website or social profile and message they give when applying, their referral code, the payout method they choose and their payout details (PayPal email or bank account), and sign-in records for the affiliate dashboard.
• Referred orders: for orders credited to an affiliate, the order number, date, amounts and items needed to calculate commission. We store the buyer’s Shopify customer ID (or, if there is none, their email address) with the order, only to check whether a refer-a-friend order is a new customer’s first order. We read the order’s email address to detect self-referrals. We do not store customers’ names, addresses or payment details.
• Lifetime customers: if the merchant turns on lifetime customers, we keep the customer ID and email address of a referred customer together with the affiliate who referred them, so their later orders credit the same affiliate. Affiliates never see these details.
• Clicks: a daily count of clicks per affiliate link. We do not store visitors’ IP addresses or browsing history.
• Access logs: when affiliate profiles or payout details are viewed, we log the time, store and viewer type, not the details themselves.

2. How we use information

• to credit referred orders to affiliates, calculate commissions and take refunds and cancellations into account;
• to create each affiliate’s Shopify discount code;
• to show affiliates their links, sales and payouts, and to send them sign-in links and notifications;
• to tell merchants about new applications.

We do not sell personal information and do not use it for advertising or for our own purposes.

3. Cookies on the store

When a visitor arrives through an affiliate link, the App’s theme embed stores the referral code in a first-party cookie on the store’s domain, only if the visitor has allowed marketing cookies under Shopify’s consent settings. Otherwise the code is kept for that visit only. The code is also added to the visitor’s cart so the order can be credited.

4. Sharing

• The merchant sees its affiliates’ profiles, sales and payout details so it can run the program and pay them.
• Affiliates see only their own sales, with order numbers partly hidden and no customer details.
• Shopify receives the discount codes the App creates in the store.
• Email delivery: emails are sent through Google’s email service (Gmail SMTP).
• Hosting: the App and its database run on servers operated by us in New Zealand. Traffic reaches them over HTTPS through Tailscale’s encrypted relay.

The App never holds or transfers money. Merchants pay affiliates directly. We may disclose information if required by law.

5. Retention and deletion

• Program, affiliate and commission records are kept while the App is installed, so merchants can keep accurate payout records.
• Daily click counts are kept for 13 months. Expired sign-in links and sessions are deleted daily.
• Lifetime customer links last for the period the merchant chooses (or with no end date if the merchant chooses “forever”), and are deleted when the customer asks for erasure or the App is uninstalled.
• When a customer asks the merchant to erase their data, Shopify notifies us and we delete their customer ID and email address from referred orders, remove their lifetime customer link and, if they are also an affiliate, delete that affiliate.
• When the App is uninstalled, we delete all of the store’s data within 48 hours of Shopify’s redaction request.
• Daily backups are kept for 14 days and then deleted.

6. Security

Data is transmitted over HTTPS. Servers and backups are stored on encrypted disks, and affiliates’ payout details are additionally encrypted with AES-256. Affiliate dashboard sign-in uses one-time email links; only hashes of sign-in tokens are stored. Access to production systems is limited to our authorized staff, protected by strong passwords and two-step verification, and access to personal data is logged. We follow a written security incident response process and will notify affected merchants and Shopify without undue delay, and within 72 hours, if a breach affects personal information.

7. Your rights

Merchants, affiliates and customers may request access to, correction of or deletion of their personal information, in line with the New Zealand Privacy Act 2020, the GDPR and the CCPA where applicable. Affiliates can update their payout details in their dashboard or ask the merchant to remove them; we will help merchants respond to such requests.

8. Changes

We may update this policy and will change the “Last updated” date when we do.

9. Contact

Nexus Haven Limited (KW Tech), Auckland, New Zealand
Email: contact@kwtech.co.nz