Privacy Policy

Last updated: October 9, 2026

This policy explains what data Talzo collects, why, who we share it with, how long we keep it, and what you can ask us to do with it. It covers the website at talzo.app (including the waitlist) and the Talzo app for Shopify. We've tried to keep it short and plain.

Talzo is in pre-launch and is not yet on the Shopify App Store. Today, the only data we collect is waitlist signups. The app sections below describe how the Talzo app will handle data once it launches.

Who we are

Talzo is a referral and affiliate program app for Shopify sellers. Talzo is operated by Abraham Richards, Ohio, USA. You can reach us at [email protected].

Talzo tracks referral clicks and sales, works out commissions, and writes payout files. Talzo never holds or moves money. Sellers pay their partners with their own payment tools.

Who's who

Merchants: Shopify store owners who install Talzo.
Partners: affiliates and referrers who join a merchant's program.
Shoppers: people who click a partner's link or buy from a merchant's store.
Waitlist members: people who sign up on talzo.app.

For data about a merchant's partners and shoppers, the merchant decides why that data is used, and Talzo processes it on the merchant's behalf to run their program. Merchants are responsible for their own privacy notices to their shoppers and partners.

What we collect and why

Waitlist (talzo.app)

Email (required), name (optional), and store URL (optional).
Your consent to receive launch emails, and the date and time you signed up.

Why: to email you about Talzo's launch, early access, and the founding-member early-bird deal.

Merchants (the app)

Your store's details from Shopify, such as the shop name and domain, and the contact details for your account.
Your program settings, such as commission rules, payout schedule, and fraud-check settings.
Your Talzo subscription status from Shopify billing.

Why: to set up and run your referral program and to provide the service you pay for.

Shopify order data (the app)

Only the order data needed to work out commissions: order ID, order amount and currency, line items (SKU, product name, price, quantity), any discount or coupon code used, refunds, and a customer identifier used to tell new from returning customers and to spot self-referrals.

Why: to credit the right partner for a sale, apply the merchant's commission rules, and reverse commissions when an order is refunded. Talzo does not receive or store payment card details.

Partners (the app)

Name and email.
Payout email and payout method, so the merchant can pay you.
Tax form status (for example, whether a W-9 has been submitted), your country, and only the last 4 digits of your tax ID. We never store a full tax ID.
Your referral links, coupon codes, clicks, sales, commissions, and payout history.
If you sign in with a password, we store it only as a one-way hash.

Why: to track your referrals, calculate what you've earned, help the merchant prepare payouts and keep their tax paperwork organized, and spot fraud.

Referral clicks (the app)

A referral click cookie (see Cookies below).
The time of the click, which partner link was used, the landing page, the referring site, and any ad-click ID in the link.
A hashed version of the IP address and browser (user agent). We store the hash, not the raw IP address or browser string.

Why: to credit referrals correctly and to catch fraud, such as self-referrals, fake clicks, paid-ad abuse, and duplicate partner accounts.

Legal basis

Where laws like the GDPR apply, we rely on:

Contract: to provide the app to merchants who install it, and to run programs that partners join.
Legitimate interests: to attribute referrals accurately, prevent fraud, and keep Talzo secure. We use hashing and keep only what we need to limit the impact on you.
Consent: for waitlist launch emails. You can withdraw it anytime.
Legal obligations: where we must keep or disclose data by law.

For partner and shopper data, the merchant decides the legal basis for their program, and we process the data on their instructions.

How we use data

To provide, run, and support Talzo.
To calculate commissions and prepare payout files.
To detect and prevent fraud and abuse.
To send service emails, such as sign-in links and important account notices.
To send waitlist members launch emails they've agreed to.

We don't use store or customer data for advertising, and we don't build profiles of shoppers across stores.

Sharing

We do not sell your data, and we do not share it for cross-context behavioral advertising. We share data only with:

Cloudflare, which hosts this website and the waitlist database. Hosting providers store and serve data for us and may not use it for their own purposes.
Shopify, which runs the platform the app is installed on and handles Talzo billing. We exchange data with Shopify only as needed to run the app.
The merchant whose program a partner or shopper interacts with. Merchants see their own program's data, not other stores' data.
Authorities, if the law requires it.
A successor, if Talzo is ever sold or merged. This policy would continue to apply to your data.

Data is stored and processed in the United States and wherever our hosting provider operates.

Cookies

talzo.app doesn't set tracking or advertising cookies and doesn't use third-party analytics.
Referral click cookie (the app): when a shopper clicks a partner's link, Talzo sets a first-party cookie so a later purchase can be credited to that partner. It lasts as long as the referral window the merchant chooses.
Sign-in cookies (the app): where sign-in is used (for example, the partner portal), a strictly necessary cookie keeps you signed in.

You can block or delete cookies in your browser settings. If you block the referral cookie, a purchase may not be credited to the partner who referred you.

How long we keep data

App data (merchant, partner, order, and click data): kept while the store has Talzo installed. We delete it within 30 days after the app is uninstalled or after we receive a Shopify shop/redact request, whichever comes first.
Waitlist data: kept until Talzo launches, plus 12 months, or until you ask us to remove it, whichever comes first.

We may keep a limited record longer only where the law requires it.

Shopify privacy requests

Shopify passes privacy requests from merchants' customers to apps. Talzo handles them as follows:

Customer data requests (customers/data_request): we give the merchant the data Talzo holds about that customer, so the merchant can respond to them.
Customer deletion requests (customers/redact): we delete or anonymize that customer's data.
Shop deletion requests (shop/redact): we delete the store's data.

We complete these requests within 30 days. If you're a shopper, the fastest way to make a request is to contact the store you bought from.

Your rights

Depending on where you live (for example, under the GDPR in the EU and UK, or the CCPA in California), you may have the right to:

access the personal data we hold about you and get a copy of it;
correct it;
delete it;
object to or restrict how we use it;
withdraw consent, such as for waitlist emails;
know what we collect and how we share it, and opt out of any sale or sharing (we don't sell or share data for advertising).

To make a request, email [email protected]. We may need to confirm who you are first. We won't treat you differently for using your rights. If your data came to us from a merchant's store, we may refer your request to that merchant or handle it with them. You can also complain to your local data protection authority.

Security

Data is sent over encrypted connections (HTTPS).
IP addresses and browser details from referral clicks are stored only as salted hashes.
We store only the last 4 digits of tax IDs, never the full number.
Passwords are stored only as one-way hashes.
Access to data is limited to what's needed to run Talzo.

No system is perfectly secure. If a breach affects your data, we'll notify you and the affected merchants as the law requires.

Children

Talzo is a business tool for store owners and their partners. It isn't meant for children under 16, and we don't knowingly collect their personal data. If you think a child has given us personal data, email us and we'll delete it.

Changes to this policy

If we change this policy in a meaningful way, we'll update this page and the date at the top. If a change materially affects how we handle app data, we'll also let merchants know before it takes effect.

Contact

Questions or requests: [email protected]. Talzo is operated by Abraham Richards, Ohio, USA.