INTRODUCTION AND APPLICATION
Shop My Shelf, Inc. (dba ShopMy) is committed to protecting your privacy and the security of your Personal Information. This privacy policy (“Privacy Policy”) applies to your use of our websites (including shopmy.us), mobile applications, and extensions and to other information we may collect online (together, the “Service”). If you are an employee, job applicant, or if we collected your Personal Information in the context of your employment at another business and you have questions about how we use your Personal Information, please contact us as provided below.
Please read our Privacy Policy and Terms of Service carefully before using the Service. By using the Service or otherwise providing Personal Information to us, you agree and consent to the collection, use, and disclosure of Personal Information in accordance with this Privacy Policy. If you do not agree, please discontinue use of the Service.
This Privacy Policy may change from time to time and it is therefore important you review it regularly. If applicable, we will provide notice of material changes to registered ShopMy Sites accounts.
In this Privacy Policy, the following terms have the following meanings (otherwise, capitalized terms used in this Privacy Policy but not defined have the meanings given to them in the Terms of Service):
“Publisher” means a Service user whose Shop includes links to external Merchants’ Websites to facilitate product purchases, applications, tracking, reporting, and receipt of commission payment.
“Merchant” means a participating brand, retailer, third-party Web site or supplier that pays a commission for a legitimate sale to a Visitor and uses the Service to facilitate purchases, sign-ups, tracking, reporting, and issuance of commission statement.
“Visitor” means any person or user that clicks on a Link or product from a Publisher’s Shop.
WHAT PERSONAL INFORMATION DO WE COLLECT, AND WHY?
“Personal Information” means information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, to an individual, and includes “Personal Data” as defined under certain privacy laws. Personal Information does not include information that is publicly available or anonymized.
We collect several different types of Personal Information for various purposes, as explained below.
Types of Data Collected:
The types of Personal Information and examples provided below may vary depending on the nature of your interactions with us, and certain categories of Personal Information may overlap.
User data and Personal Identifiers
This is the Personal Information that is provided by you (a Publisher or Visitor) when you sign up for and use the Service, and may also include other Personal Information collected from you by us or on our behalf in other contexts. Such Personal Information may include your name, address, date of birth, email address, username, hashed password, credit card and/or bank account information, city/country when signing up, any country of last sign-in, language/browser type, vertical (industry), application data (e.g., user preferences), and IP addresses.
Usage data
This includes information on how the Service is accessed and used by Visitors and Publishers, as well as usernames and passwords, internet protocol (“IP”) addresses (and geographic information from an IP address), browser types, time zone settings, the time spent on webpages, unique device identifiers, and other diagnostic data.
Geolocation data
We may use and store information about your approximate location (e.g. your country, city or postcode) using geographic information from your IP address. We use this data to provide features of the Service and to improve and customize the user experience.
Marketing data
This includes your preferences in receiving marketing communications from us.
Internet or Other Electronic Network Activity data
This includes internet or other similar activity, browsing history, search history, information on your interactions with our websites, application logs, device data and registration, social media account information, and similar information. This may also include information collected by cookies or other similar trackers (“cookies”). We use cookies and similar tracking technologies to track the activity on the Service and retain certain information. Cookies are files with small amounts of data which may include an unique identifier. Cookies are sent to your browser from a website and stored on your device. For more information see the “How do we use cookies?” section below.
Commercial Information
This includes purchasing history, browsing history, and other purchasing or consuming histories or tendencies.
Demographic Information
This includes age, marital status, date of birth, languages spoken, gender, race/ethnicity, and sexual orientation.
Health Information
This includes your parental status, intent to have children, identification as petite or plus-sized, and other similar information.
Professional and Employment-Related Information
This includes your occupation, industry, and related information.
Inferences
This includes information reflecting your preferences, characteristics, trends, or attitudes, inferred from the categories above.
Certain aspects of your Personal Information, for example user data, are required for the Service and if you fail to supply such information as requested, we may be unable to provide you with the products and services in full and your enjoyment of such products and services may be impaired.
Sensitive data
Some of the categories of information we collect, as identified above, may qualify as sensitive Personal Information under applicable law. We do not sell or share any sensitive Personal Information about you, such as details about your race or ethnic origin, political opinions or associations, religious beliefs or affiliations, philosophical beliefs, health, genetic background, biometric Personal Information, membership in a professional or trade association or union, sexual orientation or practices, and criminal record information.
Children’s data
We do not have actual knowledge that we sell or share the Personal Information of consumers under the age of 16 years old.
Our services are not intended for use by anyone under the age of thirteen (13). If you are under thirteen, please do not use the Service and do not provide us your Personal Information. If you are a parent or guardian and you are aware that an individual (of whom you are a parent or guardian) under the age of thirteen has provided us with Personal Information, please contact us. We will upon notice or discovery take all reasonable efforts to erase or destroy any personal information that may have been collected or stored by us about that individual.
If you are older than thirteen but younger than eighteen (18) years of age, you must obtain the consent of your parent or guardian to use the Service before signing up. If you are a parent or guardian and you are aware that an individual (of whom you are the parent or guardian) under the age of eighteen has provided us with personal information, please contact us. We will, upon notice or discovery, take all reasonable efforts to erase or destroy any personal information that may have been collected or stored by us about that individual.
Anonymization and De-identification
We reserve the right to convert, or permit others to convert, your Personal Information into de-identified, anonymized, pseudonymized, or aggregated, as permitted by law. If we use Personal Information in deidentified form, we will not attempt to reidentify the information, except solely for the purpose of determining whether our deidentification process satisfies legal requirements.
WHY DO WE COLLECT YOUR PERSONAL INFORMATION?
Shop My Shelf uses the Personal Information we collect for various purposes, including for the most common purposes listed below. Please note we may use Personal Information for any purposes not inconsistent with this Privacy Policy, or otherwise made by us in writing at the point of collection, and not prohibited by applicable law, including the purposes identified below.
To provide and deliver the Services and to assess, maintain and improve the performance of the Services.
To ensure the Service is relevant to you and your device, to notify you about changes to our Service, and to deliver targeted content based on your user data, location and preferences.
For consumer research and to allow you to participate in surveys or interactive features of our Service when you choose to do so.
To provide customer support and to process and respond to a request or complaint that you may have.
To monitor the usage of our Service and to detect, prevent and address technical issues.
To process any of your transactions and to conduct business planning, reporting, and forecasting.
To deliver promotional materials, special offers and general information about other goods, services and events which we offer that are similar to those that you have already purchased or enquired about unless you have opted not to receive such information.
For the administration of our business including for fulfilling and exercising our obligations and rights, exercising or defending legal claims, and managing the relationship with you.
To comply with our legal obligations and law enforcement requests.
To verify your identity and to detect fraud and potential fraud, including fraudulent payments and fraudulent use of the Service.
From time to time, we may also use your Personal Information to send important notices to you, such as communications about purchases you have made, or changes to our terms and conditions or other policies. This information is important to your interactions with us, and you acknowledge that if you opt out of receiving these communications, where permitted by applicable law, we reserve the right to discontinue our services to you.
If you provide feedback on the Service, we may use such feedback for any purpose. We will collect and store any information contained in such communication and will treat the Personal Information in such communication/feedback in accordance with this Privacy Policy.
Any information, including Personal Information, which you elect to make publicly available on our Service may be available to others or the public. If you remove information that you have made publicly available on our Service, copies may remain viewable in cached and archived pages.
HOW DO WE COLLECT YOUR PERSONAL INFORMATION?
We will collect Personal Information directly from you wherever it is reasonable and practical to do so. We may collect Personal Information from you via:
your use and access of the Service, including during your registration as a Publisher;
website links, social media or through any other platform or channel where you make Personal Information available to us;
your response to any surveys or marketing materials we send out;
information and recommendations uploaded to the Services by you or by other users; and
interactions between yourself, other users of the Services, and our staff.
We may also collect your Personal Information from third parties including:
third parties who partner with us and help us provide our Services;
third parties that provide us with marketing leads;
third parties for whom we provide marketing and data analysis services; and
via public sources or when you connect with a social network service when using and accessing the Service.
If you provide us with information about another person (e.g., your employees or target audience), you will only do so if you are authorized and have permission, and you will let that other person know that we use their Personal Information in the ways set out in this Privacy Policy, and that they can access the Privacy Policy on the Service or request a copy of it from us.
The legal basis for collecting and using Personal Information will depend on the specific circumstances in which we collect that data. Generally, however, we will collect Personal Information from you where:
it is necessary for the performance of a contract to which you are a party (including in connection with the Service);
you have consented to our use of the Personal Information for one or more purposes;
the processing is in the legitimate interests pursued by us, and those interests are balanced against your rights to privacy and do not override your interests or fundamental rights to the protection of your Personal Information, particularly, we have a legitimate interest to analyze and improve the safety and security of the Service, to maintain and improve the Service, to operate the Service and provide you with certain information and communications tailored to, and in accordance with, your preferences; and/or
to comply with a legal obligation and the law.
TO WHOM MAY WE DISCLOSE YOUR PERSONAL INFORMATION?
Third party disclosure.
We may disclose your Personal Information to various third parties. These third parties are likely to include:
technology and media partners in connection with the services that these third parties perform for us, including advertising and marketing;
our lawyers, accountants and professional advisors;
other third-party service providers, such as third-party branding service providers;
to Shop My Shelf related companies;
to law enforcement authorities where we are required to do so by law or as a result of a legal process;
in the event that we sell or transfer all or a portion of our business or assets, to any transferee of such business or assets. Should such a sale or transfer occur, we will use reasonable efforts to require that the transferee uses the personal information that you have provided to us in a manner that is consistent with this Privacy Policy;
third-party payment processors.
Payment Processors.
Because we provide paid products and/or services within the Service, we use third party services for payment processing. We will not store or collect your payment card details. That information is provided directly to our third-party payment processors whose use of your Personal Information is governed by their privacy policies and their own terms and conditions. These payment processors adhere to the standards set by payment card industry data security standards (“PCI-DSS”) as managed by the Payment Card Industry Security Standards Council, which is a joint effort of brands like Visa, Mastercard, American Express and Discover. PCI-DSS requirements help ensure the secure handling of payment information. The payment processors we work with are:
PayPal. Their privacy policy can be viewed at https://www.paypal.com/us/webapps/mpp/ua/privacy-full
Stripe. Their privacy policy can be viewed at https://stripe.com/privacy
Subsidiaries. We may disclose your Personal Information to any subsidiaries, joint ventures, or other companies under common control with us (collectively, “Related Entities”), in which case we will require our Related Entities to honor this Privacy Policy and your Personal Data will only be used for the purposes set out in this Privacy Policy.
HOW DO WE USE COOKIES?
To help improve the Service, certain information is automatically collected from your browser. This information may include the IP address, browser type, language, access times, and other information. We and/or our vendors and partners may also use cookies on our websites to track pages visited, information accessed, and other information. This information is for statistical reference, site analysis, marketing and advertising, and to remember your details and preferences when you return to that website.
In many cases, the tools used on our website collect information in a way that does not identify you as an individual. In other cases, information may be Personal Information in which case this Privacy Policy will apply.
Below we summarize why we use cookies and the different types that we use:
Strictly Necessary cookies: Strictly Necessary cookies are always enabled and are essential for our website to function and provide you with the services you request.
Analytics/Measurement cookies: Analytics & Measurement Cookies track page performance, user behavior, traffic sources, and help improve the site.
Functional/Preference cookies: Functional/Preference cookies are used to enhance user experience, remember preferences, and improve UI.
Personalized/Targeted Advertising, Sales, and Sharing cookies: are trackers, including third-party trackers, and geolocation-based trackers, to display personalized advertising based on your browsing and profile.
The Service may also use other third-party website tools from time to time, for example data analytics, online survey tools, web beacons/pixels, embedded scripts, and device or activity monitoring. Third parties which provided these tools may have access to your Personal Information only to perform these tasks on our behalf and are prohibited from disclosing or using it for any other purpose.
Your web browser can also be configured to reject cookies. If you set up your web browser to reject cookies, certain functions of the Service may become unavailable to you.
Behavioral Advertising. We may partner with third parties to either display advertising on our websites or to manage our advertising on other sites. Our third-party partners may use technologies such as cookies to gather information about your activities on this website and other sites in order to provide you advertising based upon your browsing activities and interests.
You may also opt out of certain tracking technologies by visiting the opt-out services by the Digital Advertising Alliance in the U.S., the Canadian Digital Advertising Alliance in Canada, and the European Digital Advertising Alliance in the EU. You can visit Ad Choices (US), Your Ad Choices (Canada), or Your Online Choices (EU). Opting out through these services does not mean you will no longer receive advertising from us, or when you use the internet.
To learn more about the data Google collects and how your data is used by it and to opt out of certain Google browser interest-based advertising, please visit here. To learn about the data Microsoft collects and how your data is used by it and to opt out of certain Microsoft browser interest-based advertising, please visit here.
Depending on your device settings, you may also opt out of certain interest-based advertising through the device’s "Limit Ad Tracking" or equivalent feature. Refer to your device for more information on what this opt out affects. For instance, you can generally adjust or reset the advertising identifiers on your mobile device in the device settings. In addition, iOS and Android operating systems provide options to limit tracking and/or reset advertising IDs.
You can set your browser to refuse cookies from websites, but if you do so, you may not be able to access or use portions of our Services, and certain offerings on our Services may not function as intended or as well.
To control web beacons, most email providers have settings which allow you to prevent the automatic downloading of images, which will disable web beacons in the email messages you read.
We are not responsible for opt-out processes provided by external parties.
You may also have jurisdiction-specific rights to opt out of behavioral advertising. See Section 12 for more information.
Analytics. We and our vendors (including but not limited to Google Analytics) may use identifiers and similar tracking technologies to monitor performance and usage on the site for internal analytics and performance monitoring. These identifiers and similar tracking technologies are used to help the website collect and store information regarding your visit, such as session state and authentication tokens. Users can control the use of cookies at the individual browser level but if you choose to disable cookies, it may limit your use of certain features or functions provided through the Service.
To opt out of Google Analytics you can download a Browser Add-On.
The use of identifiers by our vendors is not covered by our Privacy Policy. We do not have access or control over these cookies.
We may use mobile analytics software to allow us to better understand the functionality of our Service on your phone. This software may record information such as how often you use the Service, the events that occur within the Service, aggregated usage, performance data, and where the Service was downloaded from. We do not link the information we store within the analytics software to any Personal Information you submit within the mobile Service.
For website visitors located in the UK, EEA, or US you may set your cookie preferences by navigating the Cookie Management Settings.
For more information about the cookies we use, please see our Cookie Policy, below.
DIRECT MARKETING COMMUNICATIONS
From time to time we may send you direct marketing communications regarding our product solutions and services. We may contact you by electronic messages (e.g. email), online (e.g. through our Service), by mail and by other means, unless you opt out or we are subject to legal restrictions from doing so. You may opt out of receiving electronic messages from us at any time by contacting us via the contact details at the bottom of this Privacy Policy or by using the opt-out mechanism included in our marketing messages.
HOW LONG DO WE RETAIN YOUR PERSONAL INFORMATION?
We will retain your Personal Information for the period necessary to fulfil the purposes outlined in this Privacy Policy and in each case in accordance with applicable law and regulation.
HOW DO WE SECURE YOUR PERSONAL INFORMATION?
We have put in place appropriate security measures to prevent your Personal Information from being accidentally lost, used or accessed in an unauthorized way, altered or disclosed.
In addition, we limit access to your Personal Information to employees, agents, contractors and other third parties who have a business need for access. They will only process your Personal Information on our instructions and they are subject to a duty of confidentiality.
While we strive to use commercially acceptable means to protect your Personal Information, we cannot guarantee its absolute security. Therefore we have put in place procedures to deal with any suspected Personal Information breach and will notify you and any applicable regulator of a breach where we are legally required to do so.
LINKS TO OTHER SITES
From time to time, our Service (including this Privacy Policy) may contain links interfacing with other websites that are not operated by us for your information or convenience. This includes Shops on our Website that are populated by the Publisher who built the Shop.
These websites operate independently from our Service and may be subject to alternative terms of use, including terms concerning the use of Personal Information. We have not reviewed these third-party websites and do not control and are not responsible for how they are operated, their content or privacy policies.
If you decide to access or interact with any of these third-party websites, you do so at your own risk. As such, we strongly encourage you to review the privacy policy of every website you visit.
SELLING AND SHARING FOR TARGETED ADVERTISING
We may sell or share the following categories of Personal Information with third parties for the purposes of cross-context behavioral advertising: identifiers, internet or other electronic network activity, approximate geolocation data, and inferences. We sell and/or share this Personal Information with third parties for advertising purposes. The third parties to whom this Personal Information was sold and/or shared are advertisers and analytics vendors. When we use the terms sell, sold, or sale, we mean for valuable consideration and not monetary value. We offer you the ability to opt out of sales and sharing of your Personal Information as set forth in the “What are your rights in relation to Personal Information?” section below.
WHAT ARE YOUR RIGHTS IN RELATION TO PERSONAL INFORMATION?
Depending on your residence and citizenship, and subject to limitations and restrictions under applicable law, you may have the right to submit certain requests relating to your Personal Information as described below. To exercise your rights, please submit a request by email to legal@shopmy.us. You may designate an authorized agent to make a request on your behalf; however, you may still need to verify your identity directly with us before your request can be processed.
Right to Know and Delete: Access, Update, or Delete Your Personal Information
You may have the right to know what Personal Information we have collected about you, which includes:
The categories of Personal Information we have collected about you, including:
The categories of sources from which the Personal Information was collected.
Our business or commercial purposes for collecting, selling, or sharing Personal Information.
The categories of recipients to which we disclose Personal Information.
The categories of Personal Information that we sold and shared, and for each category identified, the categories of third parties to which we sold and shared that particular category of Personal Information.
The categories of Personal Information that we disclosed for a business purpose, and for each category identified, the categories of recipients to which we disclosed that particular category of personal information.
The specific pieces of Personal Information we have collected about you.
A list of third parties to which we have disclosed Personal Information.
Obtaining a copy of Personal Information you have provided to us in a portable format.
Whenever made possible, you can access, update or request deletion of your Personal Information directly within your account settings section.
To request deletion of your account, please complete this form.
If you are unable to perform these actions yourself, please contact us for assistance using the contact details at the bottom of this Privacy Policy.
Right to Correction/Rectification
You may have the right to have your Personal Information rectified if that information is inaccurate or incomplete.
Right to Object
You may have the right to object to our processing of your Personal Information for direct marketing purposes.
Right of Restriction
You may have the right to request that we temporarily or permanently restrict the processing of your Personal Information.
Right Not to be Subject to Automated Decision Making
You may have the right to not be subject to a decision based solely on automated decision making, including profiling, where the decision would have a legal effect or produce a significant effect on you.
Right to Withdraw Consent
You may also have the right to withdraw your consent at any time where we relied on your consent to process your Personal Information.
Right to Opt Out of Sales and Sharing of Personal Information
You may have the right to opt out of the sale or sharing of your Personal Information and to request that we do not share your Personal Information for cross-context behavioral advertising. To opt out of the sale or sharing of your Personal Information via cookies and other tracking technologies, please click on the “Do Not Sell or Share My Personal Information” link in the footer of our website. You may also opt out of the sale or sharing of your Personal Information through an opt-out preference signal like Global Privacy Control.
Right to Limit Use and Disclosure of Sensitive Personal Information
We do not use or disclose sensitive Personal Information for purposes to which the right to limit use and disclosure applies under California law.
California Shine the Light
We do not share personal information with third parties or affiliates for those third parties’ or affiliates’ own direct marketing purposes. Californians may request information about our compliance with this law by contacting us at legal@shopmy.us.
Right to Non-Discrimination for the Exercise of Your Rights
If you choose to exercise any of the privacy rights described above, we will not discriminate against you.
If you reside in Canada, you have the right to request how we use your Personal Information and the recipients to which it has been disclosed. If you live in Canada and would like to receive written information about our policies and practices regarding service providers outside of Canada, please submit your request via email per the instructions provided below in this section.
If you reside in Italy and are an individual with a direct interest in a deceased user’s personal information, or are a representative of a deceased user acting to protect the deceased user or his/her family interests, then you have the right to exercise the rights described above except for the right to delete.
If you reside in France, you may designate a person to carry out specific or general instructions on how to store, delete, or communicate the personal information relating to you after your death. If the instructions relate only to the personal information we hold about you, you may choose to directly notify us such instructions.
If you reside in Portugal, you may appoint someone who can exercise your rights or to give instructions not to exercise them at all after your death regarding special categories of Personal Information or data related with private life, images, or communications.
Please note that in order to verify your request or the applicability of any of these right to your circumstances, we may ask you for further information and to verify your identity before responding to such requests.
If you have any questions about these privacy rights, or how to exercise them, please contact us using the contact details at the bottom of this Privacy Policy.
You may have the right to complain to your local data protection authority about our collection and use of your Personal Information. See Section 13 for more information on complaints.
DO NOT TRACK
Your web browser may have a setting that permits you to automatically transmit a “Do Not Track” signal to our Websites when using them. Shop My Shelf does not currently alter its data collection practices in response to “Do Not Track” signals.
COMPLAINTS
We take your privacy concerns seriously. If you have a complaint regarding our handling of your Personal Information or concerning our privacy practices, you may file a complaint with us using the contact details set out at the bottom of this Privacy Policy. We will confirm receipt of your complaint and, if we believe necessary, we will open an investigation into your complaint.
We may need to contact you to request further details of your complaint. If an investigation has been opened following a complaint made by you, then we will contact you with the result of that complaint as soon as possible. In the unlikely circumstances we are unable to resolve your complaint to your satisfaction, you may contact the local privacy and data protection authorities in your jurisdiction.
If you would like to submit a complaint about our processing of your Personal Information or our response to your requests regarding your personal information, you may contact us at legal@shopmy.us or submit a complaint to a data protection regulator. EEA residents can find information about your data protection regulator here. The data protection regulator for residents of the UK is the Information Commissioner’s Office. If you live in Switzerland, you can lodge a complaint with the Federal Data Protection and Information Commissioner, via the contact details located here. In Canada, the regulators are the Data Protection Authorities in the provinces of British Columbia, Alberta and Quebec.
THIRD-PARTY ACCOUNT INFORMATION
YOUTUBE CONNECTION (OPTIONAL):
If users choose to connect their YouTube account with our API client, the following privacy terms apply:
YouTube API Services: We use YouTube API services to provide features and functionality. By connecting your YouTube account, you agree to YouTube’s Terms of Service.
Google Privacy Policy: The connection to YouTube is subject to Google’s Privacy Policy. You can review Google’s Privacy Policy at Google Privacy Policy.
Revoking API Client’s Access: You can revoke our API Client’s access to your YouTube data at any time through your Google Security Settings. Please refer to Google Security Settings Page for more information.
GOOGLE ACCOUNT INTEGRATION (OPTIONAL):
If you integrate your Google account with the Service, we will have access to limited Google account information. For example, we will have read-only access to certain Gmail information, including email headers and the body of receipt/order-confirmation/invoice emails, which will be used to identify qualifying purchases and award loyalty points/tiers.
Google API Services User Data Policy: Notwithstanding anything else in this Privacy Policy, our use of integrated Google account information will adhere to the Google API Services User Data Policy, including the limited use requirements. In particular, we:
only use Google account information to provide and improve the Services;
do not transfer Google account information to third parties except as necessary to provide or improve the Services, as required by law, or in connection with a merger, acquisition, or sale of assets where we provide notice to users;
do not sell the Google account information or use it for serving advertisements; and
do not permit anyone other than intended recipients, if applicable, to read Google account information, except (a) if we obtain your affirmative consent, (b) as necessary for security purposes or to comply with applicable law or (c) our use is limited to internal operations and the Gmail account information (including derivations) has been aggregated and anonymized.
iOS KEYBOARD EXTENSION (OPTIONAL)
Overview. ShopMy provides an optional keyboard extension (“ShopMy Keyboard” or “Keyboard Extension”) that you can install through iOS settings. If you install and enable the Keyboard Extension, this section describes how it collects, uses, and handles data. The Keyboard Extension operates as a separate process from the main ShopMy app. You are not required to install or enable the Keyboard Extension to use ShopMy.
What the Keyboard Captures. The ShopMy Keyboard does not log or transmit the characters you type in any other application. It only captures input you enter directly into the Keyboard Extension’s own built-in search field, for example, a product name or brand you type to find an affiliate link. Even when Full Access is enabled, text you type in other apps while the Keyboard Extension is active is never read, stored, or transmitted. link creation and retrieval functionality will be unavailable.
Network Access and Full Access. The Keyboard Extension requests “Allow Full Access” (also known as “Open Access”) in iOS Settings. This permission is required by iOS for any keyboard that communicates with the internet. ShopMy uses this access solely to authenticate you and to fetch or create your affiliate links. It is not used to read content from other apps or monitor your activity outside the Keyboard Extension. The Keyboard Extension remains functional as a basic keyboard input tool without Full Access enabled; however, its affiliate link creation and retrieval features will be unavailable unless Full Access is granted. You may enable or disable Full Access at any time through your iOS device settings (Settings > General > Keyboard > Keyboards > ShopMy).
Data Collected by the Keyboard Extension. The Keyboard Extension collects and transmits only the data necessary to provide its link creation and retrieval functionality, solely to enhance the functionality of the Keyboard Extension on your iOS device, in compliance with Apple’s App Store Review Guidelines. Specifically, the Keyboard Extension may collect and transmit to ShopMy’s servers (api.shopmy.us) over encrypted HTTPS connections: (a) search queries you enter into the keyboard’s search bar, used to return relevant affiliate links from your ShopMy account; (b) product URLs you paste or enter into the keyboard, used to generate an affiliate link on your behalf; (c) your ShopMy account credentials (specifically, a secure account token stored in your device’s Keychain), used to authenticate requests to ShopMy’s servers; and (d) basic usage events (e.g., “keyboard opened,” “link inserted”), used to understand how the keyboard feature is used and to improve it over time.
Keystroke and Text Data. The Keyboard Extension does not collect, store, or transmit the content of text you type into other applications. The Keyboard Extension does not log keystrokes, read clipboard contents, or access any text input outside of the Keyboard Extension’s own interface.
Data Sharing and Third Parties. ShopMy does not sell keyboard data or share it with third parties, except as described in this Privacy Policy. For example, aggregated usage events may be processed by analytics providers such as Amplitude, who are contractually required to provide equivalent data protection. The Keyboard Extension does not share data with any other third parties beyond what is described in this Privacy Policy. All network communications from the Keyboard Extension are made solely to ShopMy’s servers to support link creation and retrieval.
Data Retention. Search queries entered into the keyboard are used only to fulfill the immediate request and are not stored independently of the affiliate link or pin created as a result. Usage events are retained in accordance with ShopMy’s standard analytics retention policy.
Data Deletion and Revocation. You may request deletion of data collected through the Keyboard Extension by submitting a data deletion request through ShopMy’s standard account data request process (as described in this Privacy Policy). You may also revoke Full Access at any time through your iOS device settings, which will prevent the Keyboard Extension from accessing the network. You may add, disable, or remove the Keyboard Extension at any time through your iOS device settings (Settings > General > Keyboard > Keyboards). Removing the Keyboard Extension or revoking Full Access will not affect any data previously transmitted to ShopMy’s servers, which will continue to be handled in accordance with this Privacy Policy.
iOS SAFARI EXTENSION (OPTIONAL)
Overview. ShopMy provides an optional Safari web extension (the "Safari Extension") that you can install and enable through iOS Settings. If you install and enable the Safari Extension, this section describes how it collects, uses, and handles data. The Safari Extension operates within Safari as a separate component from the main ShopMy app. You are not required to install or enable the Safari Extension to use ShopMy.
Website Access Permission. To function, the Safari Extension requires permission to access the websites you visit in Safari, which you grant through Safari's extension settings (and which iOS lets you scope to "All Websites" or to specific sites, and revoke at any time). This permission is required by iOS for any Safari extension that interacts with web page content. ShopMy uses this access to detect linkable products on the pages you choose to use it on, to display your applicable commission rate, to let you create affiliate links, and — for product pages — to personalize your product recommendations (see (v)). It is not used to read pages for purposes unrelated to these features, and it does not capture the contents of the pages you visit.
What the Safari Extension Accesses. On pages where you have granted access, the Safari Extension reads the page's address (URL) and looks for publicly available product information on the page — for example, a product's title, images, price, and structured product data — in order to determine whether the page contains a product you can link to and to display your commission rate. The Safari Extension does not read, store, or transmit the full contents of the pages you visit, form inputs, passwords, or any text unrelated to product detection. It does not operate on ShopMy's own websites, and it only runs on sites where you have granted access.
Data Collected by the Safari Extension. The Safari Extension collects and transmits only the data necessary to provide its commission-rate, link-creation, and recommendation functionality, solely to enhance functionality on your iOS device, in compliance with Apple's App Store Review Guidelines. Specifically, the Safari Extension may collect and transmit to ShopMy's servers (apiv3.shopmy.us) over encrypted HTTPS connections: (a) the URL of a page you are viewing, used to determine whether the merchant is linkable, to calculate your applicable commission rate, and — for product pages — to identify the product and personalize your recommendations (see (v)); (b) product details (such as title, image, and product URL) and any caption or collection you select, transmitted only when you actively choose to create a link; (c) your ShopMy account credentials (specifically, a secure account token stored in your device's Keychain), used to authenticate requests to ShopMy's servers; and (d) basic usage events (e.g., "rate shown," "link created"), which may include the merchant's domain, used to understand how the Safari Extension is used and to improve it over time. In addition, the Safari Extension stores limited data locally on your device that is not transmitted to ShopMy — specifically cached commission rates, the floating button's on-screen position, and a short-term (24-hour) record of pages on which you have created a link (used to show you a link-created confirmation). This on-device data is cleared when you remove the Safari Extension.
Browsing Data. The Safari Extension is not used to monitor your general web browsing, and ShopMy does not use it to track you across sites for advertising. When you view a product page on a site where you have granted access, ShopMy uses the page's URL to identify the product and may record that product view to personalize your product recommendations and to maintain and improve ShopMy's product catalog. URLs for pages that are not product pages are used only momentarily to check whether the merchant is linkable and to calculate your commission rate, and are not recorded for personalization.
Data Sharing and Third Parties. ShopMy does not sell Safari Extension data or share it with third parties, except as described in this Privacy Policy. For example, aggregated usage events may be processed by analytics providers such as Amplitude, who are contractually required to provide equivalent data protection. All network communications from the Safari Extension are made solely to ShopMy's servers to support commission-rate display, link creation, and recommendations.
Data Retention. URLs for pages that are checked only for merchant eligibility and commission rates (including non-product pages) are used to fulfill the immediate request and are not stored independently. For product pages, ShopMy may retain a record of the product view to personalize your recommendations and to maintain its product catalog, in accordance with ShopMy's standard retention policy. Affiliate links you create are retained as part of your ShopMy account. Usage events are retained in accordance with ShopMy's standard analytics retention policy.
Data Deletion and Revocation. You may request deletion of data collected through the Safari Extension by submitting a data deletion request through ShopMy's standard account data request process (as described in this Privacy Policy). You may also revoke the Safari Extension's website access at any time, or disable or remove the Safari Extension entirely, through your iOS device settings (Settings > Apps > Safari > Extensions, or Settings > Safari > Extensions). Removing the Safari Extension also clears the data it stored locally on your device. Revoking access or removing the Safari Extension will not affect any data previously transmitted to ShopMy’s servers, which will continue to be handled in accordance with this Privacy Policy.
TRANSFERS OF PERSONAL INFORMATION
We are based in the United States, and, unless we expressly agree otherwise, we may host, transfer, and process data, including Personal Information, in the United States and in other countries through ShopMy and third parties that we use to operate and manage the Service. These countries may have data protection laws that are different from those of your country of residence. When you access or use the Service, or otherwise provide information to us, you understand and acknowledge that the processing and transfer of information in and to the United States and other countries which may have different privacy laws from your or their country of residence. ShopMy takes appropriate measures to ensure such transfers are in compliance with applicable laws
Where we transfer your Personal Information to countries and territories outside of the EEA, the UK, Canada, and/or Switzerland, we will ensure that it is protected and transferred in a manner consistent with legal requirements. For example, we rely on the relevant “adequacy decisions” from the European Commission, “adequacy regulations” from the Secretary of State in the UK, and the adequacy assessment from the Swiss Federal Council, as applicable (together referred to as “EEA/UK/Swiss adequacy decisions”).
Where the transfer is not subject to an adequacy decision or regulations, we take appropriate safeguards to ensure your Personal Information will remain protected. The safeguards we use under GDPR, include the European Commission’s Standard Contractual Clauses (“SCCs”) as issued on 4 June 2021, in the form of modules 1 (controller to controller), module 2 (controller to processor), module 3 (processor to processor) and/or module 4 (processor to controller), as appropriate depending on our relationship with the recipient(s). We incorporate the UK’s International Data Transfer Addendum to the EU Commission SCCs as permitted under Article 46 of the UK GDPR, when transferring Personal Information protected under UK GDPR and the Swiss Addendum to the SCCs as provided by the FDPIC in its statement of 27 August 2021. Our SCCs can be provided on request. Please note some sensitive commercial information may be redacted.
In exceptional circumstances, Personal Information may also be transferred to countries that are not subject to an adequacy decision or regulations on the basis of a derogation. A derogation may apply, for example, in case of legal proceedings abroad, if transfer is necessary for the performance of a contract, if you have consented to the transfer, or if the data has been made generally available by you and you have not objected to the processing.
You may obtain more details of the protection given to your Personal Information when it is transferred outside the UK, EEA, Switzerland, and/or Canada (including, as applicable to your jurisdiction, a copy of the standard data protection clauses which we have entered into with recipients of your Personal Data) by contacting us as described below.
COOKIE POLICY
Like most websites, we use cookies on ShopMy.us and related websites (“ShopMy Sites”). This cookie policy tells you more about our use of cookies and the choices you have.
Strictly Necessary Cookies
Name
Provider
Domain
Type
Description
Expiration
shopmy_session
ShopMy
.shopmy.us
First-party
Stores the user's authenticated session data. Required for maintaining logged-in state across page requests.
Session
shopmy_csrf_token
ShopMy
.shopmy.us
First-party
Cross-Site Request Forgery (CSRF) protection token. Validates that form submissions originate from the ShopMy website to prevent malicious attacks.
Session
Shopmy_access_token
ShopMy
.shopmy.us
First-party
Authentication token used for API requests. Required for authenticated user actions on the platform.
Session
cg_uuid
CHEQ
cheqzone.com
Third-party
CHEQ fraud detection cookie used to detect when the same device is used in separate browser sessions. No personal information such as user identity is transmitted or collected.
Up to 1 year
_cq_duid
CHEQ
.shopmy.us
First-party
CHEQ fraud detection cookie used to detect when the same device is used in separate browser sessions. No personal information such as user identity is transmitted or collected.
3 months
_cq_suid
CHEQ
.shopmy.us
First-party
CHEQ fraud detection cookie used to detect when the same device is used in separate browser sessions. No personal information such as user identity is transmitted or collected.
Session
_cq_tuid
CHEQ
.shopmy.us
First-party
CHEQ fraud detection cookie used to identify the same device within a single browser tab session (sessionStorage). No personal information such as user identity is transmitted or collected.
Tab session
_cq_check
CHEQ
.shopmy.us
First-party
CHEQ cookie used to detect whether the device supports cookies. Deleted immediately after insertion.
Immediate
Analytics/Measurement Cookies
Name
Provider
Domain
Type
Description
Expiration
_ga
Google Analytics
.shopmy.us
First-party
This cookie name is associated with Google Universal Analytics - which is a significant update to Google's more commonly used analytics service. This cookie is used to distinguish unique users by assigning a randomly generated number as a client identifier. It is included in each page request in a site and used to calculate visitor, session and campaign data for the sites analytics reports.
1 year 1 month
_ga_*
Google Analytics
.shopmy.us
First-party
Google Analytics 4 property- specific cookie. Used to persist session state and store session/event data specific to the GA4 measurement ID. Pattern: _ga_{measurement_id}
13 months
_gid
Google Analytics
.shopmy.us
First-party
This cookie is set by Google Analytics. It stores and update a unique value for each page visited and is used to count and track pageviews.
1 day
__kla_id
Klaviyo
.shopmy.us
First-party
Identifies and tracks site visitors through an auto-generated ID. Enables Klaviyo to track when someone clicks through a Klaviyo email to the website and monitor on-site behavior for email marketing optimization,
2 years (7 days on Safari/iOS due to ITP)
AMP_*
Amplitude
.shopmy.us
First-party
Amplitude Analytics user session cookie. Contains device ID, user ID, and session metadata necessary for the Amplitude SDK to function. Pattern: AMP_{first_10_chars_of_api_key}
1 year
AMP_MKTG_*
Amplitude
.shopmy.us
First-party
Amplitude marketing campaign cookie. Stores UTM parameters, referrer information, and campaign attribution data for marketing analytics and source tracking. Pattern: AMP_MKTG_{first_10_chars_of_api_key}
1 year
_hp2_id.*
Heap Analytics
.shopmy.us
First-party
Stores a unique user identifier for Heap Analytics. Used to track user behavior, interactions, and journeys across sessions for product analytics. Pattern: _hp2_id. {environment_id}
2 years
_hp2_props.*
Heap Analytics
.shopmy.us
First-party
Stores user properties and custom attributes for Heap Analytics. Used to segment users and analyze behavior patterns based on user characteristics. Pattern: _hp2_props.{environment_id}
2 years
Functionality/Preference Cookies
Name
Provider
Domain
Type
Description
Expiration
hasLoggedInBefore
ShopMy
.shopmy.us
First-party
Tracks whether a user has previously logged into the platform. Used to customize the user experience for returning visitors.
Persistent.
__stripe_mid
Stripe
.shopmy.us
First-party
This cookie is set by Stripe to distinguish users and enable secure payment processing during interactions with the website.
1 year
__stripe_sid
Stripe
.shopmy.us
First-party
This cookie is set by Stripe to manage and process payments securely, allowing temporary storage of session related information during a users visit to the website.
29 minutes 53 seconds
__stripe_orig_props
Stripe
.shopmy.us, .stripe.com, m.stripe.net
First-party / Third-party
Stores referrer and origin information for Stripe to track payment flow sources and maintain session context during checkout.
1 year
machine_identifier
Stripe
.shopmy.us, .stripe.com, m.stripe.net
First-party / Third-party
Device fingerprinting cookie used by Stripe for fraud prevention during payment processing. Helps identify returning devices.
1 year
private_machine_identifier
Stripe
.shopmy.us, .stripe.com, m.stripe.net
First-party / Third-party
Additional encrypted device identifier used by Stripe for enhanced fraud detection and prevention.
1 year
stripe.csrf
Stripe
.shopmy.us, .stripe.com, m.stripe.net
First-party / Third-party
CSRF protection token for Stripe payment forms and API requests.
Session
m
Stripe
m.stripe.net
Third-party
This cookie is generally used for performance and optimization of payment processing services, facilitating caching of content on the browser to make pages load faster.
1 year
kl_csrftoken
Klaviyo
.shopmy.us
First-party
CSRF protection token for Klaviyo email marketing forms and subscription requests.
Session
intercom-device-id-*
Intercom
.shopmy.us
First-party
Stores a unique device identifier for Intercom Messenger. Used to determine unique devices interacting with the chat widget and prevent abuse. Pattern: intercom- device-id-{app_id}
9 months
intercom-session-*
Intercom
.shopmy.us
First-party
Maintains Intercom Messenger session state to keep track of ongoing chat conversations. Sessions auto-extend during active Messenger use. Pattern: intercom- session-{app_id}
7 days
il_gc
LinkedIn
.linkedin.com
Third-party
Stores user consent preferences for LinkedIn cookies to comply with GDPR and other privacy regulations.
6 months
Personalized/Targeted Advertising, Sales, and Sharing Cookies
Name
Provider
Domain
Type
Description
Expiration
_tt_enable_cookie
TikTok Pixel
.shopmy.us
First-party
Set by TikTok Pixel to check if cookies can be stored on the browser for TikTok advertising functionality. Enables TikTok's first-party cookie tracking for ad measurement, conversion tracking, and audience building.
13 months
_ttp
TikTok Pixel
.shopmy.us,.tiktok.com
First-party / Third-party
Set by TikTok Pixel for advertising purposes. Used to show personalized ads from advertisers whose websites you've previously visited. Enables measurement and optimization of TikTok advertising campaigns, conversion attribution, and retargeting audience creation.
13 months
ttcsid
TikTok Pixel
.shopmy.us
First-party
TikTok Click Session ID. Recognizes and matches click events for TikTok advertising campaigns. Used for conversion attribution, click tracking, and ad optimization.
13 months
ttcsid_*
TikTok Pixel
.shopmy.us
First-party
Property-specific TikTok session identifier. Used for tracking conversions and events specific to the advertiser's TikTok Pixel. Pattern: ttcsid_{pixel_id}
13 months
_fbp
Meta (Facebook) Pixel
.shopmy.us
First-party
Set by Meta Pixel for advertising purposes. Identifies browsers to deliver targeted advertisements, measure ad effectiveness, and enable real-time bidding from third-party advertisers. Used to build advertising audiences and track conversions from Facebook/Instagram ads.
3 months
bcookie
LinkedIn
.linkedin.com
Third-party
Set by LinkedIn Insight Tag. Recognizes browser IDs through LinkedIn share buttons and ad tags. Used to identify users for LinkedIn advertising, retargeting, and conversion tracking.
1 year
lidc
LinkedIn
.linkedin.com
Third-party
Set by LinkedIn to facilitate data center selection. Routes user interactions with LinkedIn share buttons and ad tags to the appropriate data center for processing.
24 hours
_gat_gtag_*
Google Analytics
.shopmy.us
First-party
Used by Google Analytics to throttle request rate. Prevents data collection overload on high- traffic pages. Can be used in conjunction with Google Ads for conversion tracking. Pattern: _gat_gtag_{tracking_id}
1 minute
Your Rights
You can block or disable non-essential cookies on your device at any time by indicating this in the preferences or options menus in your browser. You can also delete the cookies that are stored on your device. However, blocking, disabling or deleting cookies may limit your ability to view all the pages of a site or use online services that require registration. You can find more information about cookies at www.allaboutcookies.org and www.youronlinechoices.com.
In certain circumstances, subject to certain exceptions and applicable law, you may have rights in relation to Personal Information collected through cookies. Please see Section 12 for more information.
CHANGES TO THIS PRIVACY POLICY
We may update our Privacy Policy from time to time and it is therefore important you review it regularly. We will notify you of any changes by posting the new Privacy Policy on the Service. We will let you know via email and/or a prominent notice on our Service prior to the change becoming effective and update the “effective date” at the top of this Privacy Policy. Changes to this Privacy Policy are effective when they are posted on this page unless otherwise set out in the email and/or prominent notice.
CONTACT US
If you have any questions about this Privacy Policy, our privacy practices or if you would like to make a request about any Personal Information we may hold about you, including correction of Personal Information, please contact us:
By email to: legal@shopmy.us
SHOPMY PRIVACY POLICY
Effective: July 14, 2026