Privacy Policy
Effective date: [DATE] Operator: [CheckoutFlare LLC], [registered address] (“CheckoutFlare”, “we”, “us”) Privacy contact: privacy@checkoutflare.com
This policy explains what personal data CheckoutFlare collects, why, who we share it with, and the choices you have. It covers two groups of people:
- Merchants: people who sign up for and use CheckoutFlare to run their store’s checkout.
- Shoppers: people who buy from a merchant’s store through a CheckoutFlare checkout.
1. Our role
- For merchant account data, CheckoutFlare is the controller: we decide how it is used.
- For shopper data processed through a merchant’s checkout, the merchant is the controller and CheckoutFlare is a processor acting on the merchant’s instructions. Shoppers should read the merchant’s own privacy policy, linked at the bottom of every checkout, and contact the merchant first with requests. We will help the merchant respond.
- Payments are handled by Whop, which receives card and payment details directly in its secure payment form. This applies to shoppers paying a merchant, and to merchants saving a card with us for our fees. We never see or store full card numbers. Whop processes that data under its own privacy policy.
2. Data we collect
About merchants
| Category | Examples | Source |
|---|---|---|
| Account | name, email, password (hashed), login history, team members | You |
| Business & store | business name, store domain, country, branding, checkout layouts, shipping and discount settings | You, your Shopify store |
| Connection details | Shopify app credentials and access tokens (encrypted); the Whop account ID, account name and API key you give us (the key is encrypted) | You, Shopify, Whop |
| Billing | plan, fees charged, payment status, referral details; for the card you save with us, only its brand, last 4 digits and Whop’s payment-method ID (Whop holds the card itself) | You, Whop |
| Support | messages, call notes, screenshots you send | You |
| Usage & device | pages used, actions, IP address, browser, device, cookies | Automatically |
We don’t receive your identity documents or bank details. You give those to Whop directly, in Whop, when you verify your own Whop account.
About shoppers (on behalf of merchants)
| Category | Examples |
|---|---|
| Contact | email, phone (if the merchant asks for it), marketing opt-in choice |
| Order | items, prices, discounts, shipping method, order and payment IDs, upsells accepted, subscription status |
| Addresses | delivery and billing address |
| Checkout activity | checkout started and abandoned, survey answers, time spent, A/B test or traffic-split group |
| Device & fraud signals | IP address, approximate location, browser, device, cookies |
3. How we use data
| Purpose | Legal basis (EU/UK) |
|---|---|
| Provide the Service: render checkouts, calculate totals, create orders in Shopify, sync refunds and tracking | Contract with the merchant; for shopper data, the merchant’s instructions |
| Payments, fees and billing | Contract; legal obligation |
| Automatic store readiness scans, fraud prevention and security | Legitimate interests; legal obligation |
| Support and service messages | Contract; legitimate interests |
| Analytics shown to the merchant (conversion, revenue, abandoned checkouts) | Merchant’s instructions |
| Improving the Service, using aggregated or de-identified data | Legitimate interests |
| Marketing CheckoutFlare to merchants (you can opt out anytime) | Consent or legitimate interests |
| Legal compliance and enforcing our Terms | Legal obligation; legitimate interests |
We do not sell personal data, and we do not use shopper data to market our own services to shoppers or to build profiles across different merchants’ stores.
4. Cookies and tracking
- Essential cookies keep checkouts and dashboard sessions working, remember the shopper’s cart and checkout group, and protect against fraud.
- Analytics about checkout performance are provided to the merchant.
- Merchant-enabled pixels and integrations. A merchant may switch on tools such as the Meta Pixel and Conversions API, TikTok, Google, Pinterest or Klaviyo. When enabled, we send those providers the events and data the merchant has configured (for example purchase value and hashed email). The merchant is responsible for the notices and consent this requires, and can configure the checkout to follow their store’s cookie-consent choices.
- On our own website we use essential cookies and privacy-friendly analytics. Where required, we ask for consent before setting anything non-essential.
5. Who we share data with
- The merchant whose store you bought from (for shopper data).
- Whop to process payments and handle refunds, disputes and shipments on the merchant’s own Whop account, and to process the card a merchant saves for our fees.
- Shopify to read store data and record orders, customers and fulfilment in the merchant’s store.
- Service providers (sub-processors) that run parts of our Service under contract:
| Provider | Purpose | Location |
|---|---|---|
| Whop, Inc. | Payments, refunds, disputes and shipment records on merchants’ own Whop accounts; our own billing | USA |
| Shopify Inc. | Merchant storefront, orders and customers | Canada / USA |
| Cloudflare, Inc. | Hosting, database, file storage, CDN, custom checkout domains, bot protection | Global edge / USA |
| [Resend or Postmark] | Transactional email | USA |
| [Sentry] | Error monitoring | USA |
| [PostHog] | Product analytics (merchant dashboard only) | [USA / EU] |
| Integrations the merchant enables (Meta, TikTok, Google, Pinterest, Klaviyo, others) | As configured by the merchant | Varies |
We keep this list current here and give merchants at least 15 days’ notice by email before adding a new sub-processor that handles shopper data.
- Legal and safety: when required by law, or to protect rights, safety and prevent fraud.
- Business transfers: if we’re involved in a merger, acquisition or sale of assets, under this policy’s protections.
6. International transfers
We and our providers process data in the United States and other countries. Where EU/UK data is transferred, we rely on Standard Contractual Clauses, the EU-US Data Privacy Framework where the provider is certified, or another lawful mechanism.
7. How long we keep data
| Data | Retention |
|---|---|
| Merchant account data | While the account is active, then deleted within 90 days of closure, except billing records |
| Billing and tax records | As long as the law requires (usually up to 7 years) |
| Shopper order data | While the merchant’s account is active (it’s also stored in the merchant’s Shopify store). Deleted within 90 days after the merchant leaves, or sooner on the merchant’s instruction |
| Abandoned checkout data | Up to 90 days |
| Security logs | Up to 12 months |
| Backups | Up to 35 days, then overwritten |
8. Security
We encrypt data in transit (TLS) and encrypt sensitive credentials and access tokens at rest. We limit staff access to what each role needs, log administrative access, and monitor for abuse. Card data is entered only into Whop’s payment form. If a breach affects personal data, we will notify affected merchants without undue delay, and within 72 hours where the law requires, so they can meet their own obligations.
9. Your rights
Depending on where you live (for example under the GDPR, UK GDPR, or California and other US state laws), you may have the right to access, correct, delete or export your data, object to or restrict certain processing, withdraw consent, and opt out of targeted advertising. We don’t sell personal data or “share” it for cross-context behavioural advertising for our own purposes.
- Merchants: email privacy@checkoutflare.com. We reply within 30 days and may need to verify your identity.
- Shoppers: contact the store you bought from. If you contact us, we’ll pass your request to the merchant and help them respond.
- You can also complain to your local data protection authority.
We won’t treat you differently for exercising your rights.
10. Data processing terms for merchants
For shopper data, we act as your processor and service provider. By using the Service you and we agree that we will:
- process shopper data only to provide the Service and on your documented instructions (these Terms, your settings and your requests);
- ensure people with access are bound by confidentiality;
- apply the security measures in section 8;
- use only the sub-processors listed above, under written terms at least as protective, and notify you of changes;
- help you respond to shopper requests and meet your security, breach-notification and impact-assessment obligations;
- delete or return shopper data when you leave, as in section 7, unless the law requires us to keep it;
- make available information reasonably needed to show compliance.
If your business needs a signed data processing agreement, email privacy@checkoutflare.com.
11. Children
The Service is for businesses. It isn’t directed at children under 16, and we don’t knowingly collect their data. Merchants must not sell to children where the law prohibits it.
12. Changes
We will post updates here with a new effective date and email merchants about material changes at least 15 days before they take effect.
13. Contact
privacy@checkoutflare.com · [CheckoutFlare LLC], [registered address]