Privacy policy
Last updated October 6, 2026
Mint Request a Quote is a Shopify app made by Mint Labs ("we", "us"). It adds a "Request a quote" button and a quote list to a merchant's store: a shopper sends the products and quantities they need with their contact details, and the merchant replies, by email or (Plus) with a Shopify draft order. This policy explains what the app handles about merchants and about the merchant's shoppers, why, and when it's deleted. For shopper data we act as a service provider (processor) to the merchant, who is the controller.
The short version
- For each quote request we store what the shopper typed into the form (name, email, and the phone, company and message fields the merchant turned on), encrypted, plus the products, quantities and list prices, and the merchant's quote.
- We never store IP addresses: rate limits use a keyed one-way hash of the IP address, deleted after 30 days.
- Contact details are erased 180 days after a quote is won or lost; quotes nobody touched for a year are closed first.
- We use contact details only so the merchant can answer that request. We never sell or share data, use it for advertising, or combine it across stores.
Information about merchants
| Information | Why |
|---|---|
| Store domain and a Shopify access token | To read the requested products, save the storefront settings, and (Plus) create, update and send draft orders and read their status. |
| Store name, store email, contact email, currency, time zone, primary domain and whether the online store is password protected | The store email receives new-quote emails unless the merchant chooses other addresses; the store name and contact email are the sender name and reply-to address of the shopper's copy; the currency is used for quotes; the domain for product links. |
| Settings (texts, form fields, notification addresses, hide-price rules) | To run the quote form the way the merchant set it up. |
| Plan status | Read from Shopify to decide which features apply. Plans are chosen on Shopify's plan page and billed by Shopify. |
Information about the merchant's shoppers
| Information | How it's used | Kept |
|---|---|---|
| Contact details typed into the form: name, email, and (if the merchant asks for them) phone, company and a message. Stored together, encrypted with AES-256-GCM; plus a keyed one-way hash of the email | Shown to the merchant on the quote so they can reply; sent to the merchant in the new-quote email; the email is used for the shopper's copy and, on Plus, as the email of the draft order Shopify sends the quote to. The hash is used for rate limits and privacy requests. | Until 180 days after the quote is won or lost |
| The request: products, variants, SKUs, quantities, list prices at that moment, the store page it was sent from, the shopper's country | So the merchant can prepare the quote. | 2 years after the request, no longer linked to the shopper once the contact details are erased |
| The merchant's quote and internal note; the draft order's name, link and status (Plus) | To show where each quote stands. Draft orders themselves are stored by Shopify in the merchant's store. | Note: with the contact details. Quote: with the request |
| The customer account ID, if the shopper was logged in to the store | Shown to the merchant as "logged in"; used to find the shopper's data for privacy requests. | With the contact details |
| A keyed hash of the shopper's IP address (never the raw address) | Rate limits against automated or repeated requests. | 30 days |
| Emails waiting or sent: which email (new-quote notification, shopper copy), status and time | To send each email once and never lose one if sending fails. No message content or address is kept in this record. | 30 days after sending |
| Browser storage on the shopper's device | Local storage: the quote list (product IDs, titles, image links and quantities) until the shopper sends or clears it, and the date of a once-a-day "the button is live" signal for the merchant's setup page. No cookies. | On the device |
Emails we send
Emails are sent through Cloudflare Email Service from our sending domain (mail.stickermint.com): the new-quote notification to the merchant's chosen addresses (reply-to: the shopper), and, if the merchant keeps it on, a copy of the request to the shopper with the store's name as the sender and the store's contact email as the reply-to address. Both are about one request and say why they were sent. We send no marketing. On Plus, the quote itself is emailed by Shopify (draft order invoice), not by us.
Customer privacy requests
- Access requests (Shopify's
customers/data_request): the app home shows the request and the merchant downloads everything we hold about that shopper as a file to send them. - Erasure requests (
customers/redact): we permanently erase the shopper's contact details, IP hash, customer ID and the merchant's note from their quotes and drop any email still waiting about them. The merchant keeps an anonymous record of what was quoted. - Store deletion (
shop/redact, sent 48 hours after a merchant uninstalls): we permanently delete everything we hold for the store.
Where data is processed and how it's protected
The app runs on Cloudflare (hosting, database, message queue and email sending) and connects to Shopify's APIs. Data is encrypted in transit (TLS) and at rest; shoppers' contact details are additionally encrypted by the app with a key kept separately from the database. Access is limited to Mint Labs staff who need it to provide support. We use no other sub-processors, analytics or trackers. See our security policy.
Retention
Contact details and notes are erased 180 days after a quote is won or lost; open quotes nobody touched for a year are closed as lost first. IP hashes are deleted after 30 days. Quote records without personal data are deleted 2 years after the request. Access tokens are deleted as soon as the app is uninstalled, and everything else 48 hours later when Shopify asks us to delete the store's data. Short-lived server logs kept by Cloudflare don't contain contact details.
Your rights
Depending on where you are, you may have the right to access, correct or delete information about you. Merchants can contact us directly; shoppers can contact the store, or email us and we'll pass the request on. We respond within 30 days.
Changes
If we change this policy we'll update the date above and, for significant changes, notify merchants in the app.
Contact
Mint Labs — support@stickermint.com