Caffeine Checkout Suite — Privacy policy

Last updated 25 October 2026. Applies to the Caffeine Checkout Suite app installed from the Shopify App Store.

Caffeine Checkout Suite ("the app") is a Shopify app operated by Caffeine Commerce. It adds checkout and thank-you page blocks, post-purchase offers, storefront recommendations, bundle discounts, A/B experiments and revenue attribution to a merchant's Shopify store. The merchant who installs the app is the controller of their customers' data; we process it on the merchant's behalf to run the features they turn on.

What the app collects

• Store information: the store's myshopify.com domain, Shopify plan, currency, and the access token Shopify issues at install.
• Order information: order and line-item ids, products, quantities, prices, discounts, refunds and cancellations from Shopify order webhooks, used to apply offers and attribute revenue. Post-purchase offers also record the order's destination country and checkout reference ids. We do not receive or store payment card data.
• Pseudonymous visitor and session identifiers: a random visitor id in a first-party cookie (_cc_vid, one year) and browser storage (cc_vid, cc_assign, cc_exp_written), and session ids that join a storefront, checkout or post-purchase session to the order it led to. Where the store uses Shopify's Customer Privacy API, these are set only with the visitor's consent.
• Storefront and checkout events from the app's Shopify web pixel: page and checkout funnel events, checkout token, order id and totals, ad click ids, and a device type derived from the browser's user agent (the user agent itself is not stored). IP addresses are used briefly for rate limiting and are not stored.
• Merchant staff information: the email address of staff who sign in to the standalone portal (sign-in link or Sign in with Shopify) and a record of the changes they make. Inside Shopify admin the app uses Shopify session tokens, not our cookies; the standalone portal uses a sign-in cookie.
• Content merchants upload, such as images for checkout blocks.

The app does not collect customer names, email addresses, phone numbers or shipping addresses for its features.

How we use it

To run the features the merchant turned on, measure which blocks, offers and experiments led to orders, show the merchant analytics, keep the service reliable (logging and error reporting), and contact the merchant about their account. Billing is handled by Shopify on the merchant's Shopify invoice. We do not sell data, use it for advertising, or combine visitors across different stores.

Retention

A scheduled job deletes expired rows about once a day. When a merchant uninstalls the app, we delete its Shopify access token straight away. Shopify then sends a store-deletion request about 48 hours later, and we delete that store's data. A customer deletion request removes or anonymises that customer's identifiers and events.

Privacy requests

We handle Shopify's mandatory privacy webhooks (customer data request, customer redaction and shop redaction). A customer data request is prepared for the merchant to fulfil; we do not send it to the customer directly. Customers should contact the store they bought from; merchants can contact us below.

Service providers

Security

Data is sent over HTTPS, Shopify webhooks are verified by signature, and each store's data is kept separate by store.

Contact

Caffeine Commerce — login@caffeinecommerce.com