RallyCrew is a Shopify app made and run by Jamie Farrell through TFC Business Solutions LLC, Orlando, Florida ("I" and "me" below). This policy explains what RallyCrew stores when a merchant installs it on a Shopify store, why, where it is kept and how it is deleted. It is written for the merchant who installs the app and for the people who shop at that store.
For shoppers' data, the merchant decides what the program is for, and I process that data on the merchant's behalf. If you are a shopper, the store you bought from is your first point of contact. You can also email me.
RallyCrew deals with two groups of people: the creators a merchant works with, and the store's shoppers. It stores data about creators. It stores no personal data about shoppers.
What RallyCrew stores
About the store
- The store's Shopify domain, name, currency and plan, the program settings the merchant chooses, and the IDs of the discount codes RallyCrew created, so a paused creator's code can be switched off.
- For orders that used a creator code: order ID and number, subtotal, commission and refund amounts. Not who bought, what they bought, or how they paid.
- Payout records the merchant enters: amount, method, note and date.
About creators
| Data | Why |
|---|---|
| Name and email | So the merchant can send their link and reply to an application |
| What they wrote on the application form | So the merchant can decide |
| Their payout method and handle, such as a PayPal email or Venmo handle | So the merchant knows where to send money |
| Click counts on their link, with a one-way hash of the visitor's IP address and browser string | To tell a page refresh from a second visitor. The raw IP address is not stored, and the hash is never shown to anyone |
RallyCrew never asks a creator for bank account numbers, card numbers or government IDs, and has no field to store them. Merchants pay creators directly, outside the app.
About shoppers
RallyCrew stores no shopper names, emails, addresses, phone numbers or payment details. When an order with a creator code is paid, RallyCrew reads the order's email and the buyer's order count from Shopify for a moment, only to block a creator from earning commission on their own purchase and to apply a "first order only" rule. It compares them and discards them. Nothing is saved.
A creator's private page shows order numbers, dates and amounts. Never who bought.
Why, and the Shopify access it asks for
RallyCrew uses this data only to run the merchant's creator program and to work out its 1% usage fee. It asks Shopify for access to read customers (for the self-purchase and first-order checks above), create discounts (to issue creator codes) and read orders (to count codes and commission).
Where data is kept and who sees it
The copy of RallyCrew you install from the Shopify App Store runs at rallycrew.shoplyft.online on shared web hosting from Spaceship, my hosting provider, and keeps its data in a database file on that server. I also run private copies of the app for a few stores I work with directly. Those run on Railway, which says it encrypts the data it stores. Data travels only between Shopify and the app, and every connection is served over HTTPS.
Shopify is the platform the app runs on. To bill the 1% usage charge, the app sends Shopify the store's ID and an amount, nothing about shoppers. Apart from Shopify and those two hosts, there are no sub-processors. For merchants, the data processing agreement sets out how I handle this data on your behalf.
Studio keeps a log of each time someone opens a list or record with personal data in it, or downloads an export: what was opened, when, and the staff account when Shopify provides it. I keep each entry for 180 days, then delete it, and the whole log goes sooner if the store's data is erased.
What I never do
- I never sell data or share it with advertisers.
- There are no third-party trackers, analytics tools or advertising pixels in the app or its storefront blocks.
- The app stores no phone numbers and no payment details. Shopify handles payments.
Cookies
When a shopper arrives through a creator link, RallyCrew's storefront script sets two first-party cookies on the store's own domain: rallycrew_ref, which holds only the creator's code, and rallycrew_click, which marks that the click was already counted. They expire after the window the merchant sets, 30 days by default. Shopify's own discount link is what carries the code to checkout.
The script checks Shopify's customer privacy settings first: it sets these cookies, and lets the app keep the one-way visitor hash, only where the store does not need to ask for consent or the shopper has said yes, and the click still counts and the creator's code still works at checkout either way.
Keeping and deleting data
RallyCrew keeps creator data while the app is installed. A merchant can delete a creator in Studio at any time, which removes their record, clicks, order rows and payout history and switches off their page link.
- When a customer asks to be deleted. Shopify sends the app a redact request. RallyCrew holds no shopper data. If the customer's email matches a creator, RallyCrew removes that creator's name, email, application note and payout handle, clears the notes on their payouts, pauses them and switches off their old page link. Commission and payout amounts stay for the merchant's records. Any data request file prepared for them is deleted too.
- When a merchant uninstalls. The app stops working on the storefront right away. Shopify asks apps to erase a store's data 48 hours after uninstall. When that request arrives, the app deletes everything it holds for the store.
- Data requests. When a customer asks a merchant for their data, Shopify tells the app. RallyCrew gathers everything it holds about that customer into a file, and the merchant downloads it from Studio (Program, under Customer data requests) and sends it to the customer. Nothing goes to the customer automatically. I will help if asked. I keep the file for 30 days after the merchant first downloads it, or 90 days if it is never downloaded, then delete it.
This website
The website at shoplyft.online sets no cookies, runs no analytics and loads nothing from other servers. It uses your device's own fonts. My web host may keep standard server logs, such as IP addresses and the pages requested, to keep the site running.
Changes and contact
If this policy changes, I will update this page and the date at the top. Questions or requests: him@thejamiefarrell.com, or write to TFC Business Solutions LLC, Orlando, Florida.