Privacy Policy

1. Information We Collect

We collect information you provide directly to us, such as when you:

• Create an account or sign up for our service
• Install Acurrate from the Shopify App Store
• Use our influencer ROI calculator
• Subscribe to our newsletter or marketing communications
• Contact us for support or feedback

This information may include your name, email address, and any other information you choose to provide.

Shopify Store Data: When you install Acurrate from the Shopify App Store, we access the following data from your Shopify store with your explicit permission:

• Orders: Order data including order totals, subtotals, shipping costs, and order dates (including orders older than 60 days for accurate 12-month historical metrics)
• Products: Product information including titles, types, tags, and vendors (used for industry detection)
• Analytics: Store analytics data for performance metrics
• Customer data (Shopify Protected Customer Data, Levels 1 + 2): Approved by Shopify on 2026-04-22 (reference 103226). This includes customer IDs, order numbers, customer name, and customer email address from your store's orders. See Section 6 for the full detail on how this data is stored, used, retained, and deleted.

Important: Everything above is read-only: we never modify, edit or delete your products, orders, customers, analytics or store settings. Acurrate does hold three narrow write permissions, and it only ever uses them when you ask it to — write_discounts and write_price_rules to create a discount code for a creator you are working with, and write_draft_orders to raise the $0 draft order that sends a creator a product sample. Those are the only writes Acurrate can make, and it makes none of them on its own initiative. All other access is limited to what is necessary for customer-lifetime-value forecasting, returning-customer-rate analysis and creator-to-customer matching, as described in this policy.

1a. Creator Discovery Database

As part of our influencer discovery service, Acurrate maintains a database of publicly available information about content creators on third-party platforms (including Instagram, TikTok, and YouTube). This database is separate from customer account data and is collected from public sources, not from our customers.

What we collect about creators:

• Public profile information: username/handle, display name, profile picture URL, biography, external/linked URLs, stated location, verified status
• Public engagement metrics: follower count, following count, post/video counts, views, likes, comments, publication dates
• Public content metadata: captions, titles, descriptions, hashtags, tags, thumbnail URLs, video durations, music/audio identifiers
• Publicly listed contact information: business email addresses displayed on public profiles or creator-owned websites
• Derived/inferred attributes: estimated primary niche/category, estimated audience country, estimated audience age and gender distribution, authenticity/bot likelihood scores, brand affinity tags, posting cadence, and predicted performance metrics. These are inferences generated by automated analysis (including AI models) of the public data above and are estimates, not confirmed facts.

Sources: Public APIs and public web pages of third-party platforms, accessed directly or via data-provider services (including ScrapeCreators and official platform APIs such as the YouTube Data API). We do not access private accounts, private messages, or any information behind authentication walls belonging to creators who are not our customers.

YouTube API Services: Acurrate uses YouTube API Services to read public YouTube channel and video data (channel name, subscriber count, video views, likes and comments). Google's handling of that data is described in the Google Privacy Policy.

Lawful basis (UK/EU GDPR): We process this information on the basis of legitimate interests (Article 6(1)(f)) — specifically, enabling brands to identify and evaluate professional content creators who publicly offer their services for commercial collaboration. We have assessed this basis against creators' rights and interests and have taken steps to minimise intrusion (we rely on public data only, do not collect special-category data, and provide an opt-out route described in Section 8).

Automated inferences: Audience demographics, authenticity scores, and niche classifications are produced by automated systems (including large language models such as Google Gemini) analysing public content and engagement. They are estimates and may be inaccurate. They are not used to make legally or similarly significant decisions about individuals.

Who receives it: Our customers, who use it to evaluate and contact creators for commercial collaboration. Removal requests under Section 8 apply to everything we hold, however it is reached.

Creators who are also our customers: If you are both a creator in our discovery database and a registered Acurrate customer, the two records are governed by the respective parts of this policy. You may request correction or deletion of your creator record using the process in Section 8.

1b. Creator Portal

Creators who work with brands on Acurrate can sign in to see their own agreements, tracking links and discount codes, attributed sales, gifts and payments. There is no password: you enter the email address shown on your public creator profile, and we email a sign-in link to that address. Right after you sign an agreement, send a gift address or submit a draft, you can also press “Email me my sign-in link” on that page, and we send it to the same address without you typing it.

• What we use: the email address you enter, matched against the creator records described in Section 1a. We show you only the records that carry that address. If none match, we send nothing, and our reply does not reveal whether the address is known.
• Sign-in links expire after 15 minutes and work once. To enforce that we keep a random identifier for each used link, never the link itself or your email address.
• Payout setup: when a brand that has a signed agreement with you wants to pay you and you have no payout account yet, we email the address on your profile a link to set one up with Stripe. It works once and expires after 3 days. We send it only when that address belongs to you alone, at most once a day per brand, and the brand sees only a masked version of the address.
• Payment notices: when a brand’s payment to you through Acurrate goes through, we can email the address on your profile to tell you the amount and the brand, only when that address belongs to you alone.
• Security check: the sign-in form, and the “Email me my sign-in link” button, run Cloudflare Turnstile to confirm a person is asking, so nobody can use them to flood creators with email. The button loads the check only when you press it. Cloudflare sees your IP address and browser signals for that check only.
• Session: a signed-in browser holds one strictly necessary, http-only cookie for up to 7 days. The portal carries no analytics or advertising cookies and asks search engines not to index it.
• Minors: the portal is not offered to creators we know to be under 18.
• Brands: signing in does not share anything new with any brand.

Lawful basis (UK/EU GDPR): legitimate interests (Article 6(1)(f)): letting you see and check the records of collaborations brands run with you through Acurrate. You can stop at any time by not signing in; signing in is never required to be paid. Your rights, including deletion, are in Section 8.

2. How We Use Your Information

We use the information we collect to:

• Provide, maintain, and improve our services
• Calculate accurate influencer ROI metrics using your store's historical data
• Process your calculations and store your data securely
• Calculate metrics including Average Order Value (AOV), Conversion Rate, and Returning Customer Rate (RCR) using aggregated data
• Send you technical notices, updates, and support messages
• Send you marketing communications (with your consent)
• Respond to your comments and questions
• Analyze usage patterns to improve our platform
• Manage team memberships and seat access for your store
• Operate the creator discovery database described in Section 1a — including indexing, search, filtering, and displaying public creator information to our customers
• Generate automated inferences (niche, audience estimates, authenticity, brand affinity) to help customers evaluate creators for potential collaboration

Customer Data Usage: Under Shopify Protected Customer Data Levels 1 + 2, we use your customers' customer IDs, order numbers, names, and email addresses for the following purposes only:

• Repeat-purchase analysis. Count unique customers, frequency of orders, and repeat-customer ratio.
• Customer lifetime value (LTV) forecasting. Compute per-customer first-order revenue, 90-day revenue, and lifetime revenue to power the forecast-mode toggle in the product.
• Creator-to-customer matching ("Your Customers"). Match customer email addresses (and, as a fallback, names) against our public creator-discovery database to identify which of your existing customers already follow a given creator. Used only to inform creator selection; we never share customer identity with creators or with any third party.
• Campaign attribution. Tie specific orders to specific creator campaigns using promo codes and UTM links, so we can attribute revenue correctly over time.

Storage, retention, and deletion: Raw Protected Customer Data (names, emails, customer IDs, order numbers) is stored encrypted at rest in our Supabase database (currently hosted in the United States, AWS us-east-1) and is deleted no later than 30 days after its last sync from your Shopify store. Aggregated, non-identifying metrics (LTV numbers, returning customer rate, segment counts) may be retained indefinitely because they no longer contain personal data. Every access of Protected Customer Data is recorded in a mutation-restricted audit trail while the store is active; erasure retains only a de-identified compliance receipt.

Never used for: Marketing emails to your customers, advertising, resale, or disclosure to any third party. We do not transmit customer Protected Data to AI providers, analytics services, or external tools. We do not access physical addresses, phone numbers, geolocation, IP addresses, or browser data from your customer records.

3. Information Sharing and Disclosure

We do not sell, trade, or otherwise transfer your personal information to third parties without your consent, except as described in this policy:

• Service Providers: We may share information with trusted service providers who assist us in operating our platform, including: Supabase (database and authentication, currently hosted in the United States, AWS us-east-1), Shopify (app hosting and billing), Stripe (payment processing for direct customers), Loops (email marketing), Resend (transactional email, including delivery of requested data exports), Sentry (error monitoring, EU data region), Google Cloud / Google Gemini (AI inference for niche tagging, audience estimation, and content classification), and data-provider services used to collect public creator information from third-party platforms (including ScrapeCreators and the official YouTube Data API).
• Shopify: When you install Acurrate from the Shopify App Store, your subscription billing is managed through Shopify's billing system. We share necessary billing information with Shopify to process payments and manage subscriptions.
• Team Members: If you add team members to your store, they will have access to your store's calculation data and settings based on their assigned role (Editor or Viewer). Team members do not have access to billing information or account management settings.
• Legal Requirements: We may disclose information if required by law or to protect our rights and safety
• Business Transfers: Information may be transferred in connection with a merger, sale, or acquisition

Customer Data (Shopify Protected Customer Data): We do not share, sell, resell, license, or disclose customer PCD (names, emails, customer IDs, order numbers) with any third party for any purpose. PCD is stored exclusively within Acurrate's Supabase infrastructure (currently hosted in the United States, AWS us-east-1) and is not transmitted to AI providers, analytics services, advertising platforms, or any external tool. The only exceptions, as required by law, are (a) lawful order from a competent authority, or (b) a data-portability request initiated by the customer themselves under UK/EU GDPR Article 20.

3b. Free Tools

Our free tools at acurrate.com/tools look up a public creator by their handle, with no account. To stop automated abuse they run Cloudflare Turnstile, so Cloudflare sees your IP address and browser signals for that check.

• Fair-use limits: to apply per-visitor limits we keep one record per visitor, tool and day, labelled with a keyed hash of your IP address that cannot be turned back into an address without a secret we hold. It is still personal data, because it identifies a visitor over time. We delete these records after 30 days.
• Detailed ROI forecasts: if you give your email address to see a detailed forecast, we keep a keyed hash of it (not the address itself) to allow two detailed forecasts per address, for as long as that limit applies. We also add the address to our email list in Loops (Section 5), so we can send you occasional emails about Acurrate; every email has an unsubscribe link. You can ask us to delete either at privacy@acurrate.com; deleting the hash lifts the limit for that address.
• Creator email addresses: the email finder shows visitors without an account only a masked placeholder for a creator's public business email: no letters of the name, and the domain shown only when it is a shared provider such as gmail.com (otherwise just the ending, such as .com). The full address is available only inside the product. Creators can ask us to remove their record under Section 8.

Our basis for the fair-use and forecast-limit records is our legitimate interest in preventing abuse of free tools (Article 6(1)(f) UK/EU GDPR).

4. Data Security

We implement appropriate technical and organizational measures to protect your personal information against unauthorized access, alteration, disclosure, or destruction. However, no method of transmission over the internet is 100% secure.

5. Email Marketing

If you opt-in to receive marketing emails, we use Loops to manage our email communications. You can unsubscribe at any time by clicking the unsubscribe link in any email or contacting us directly.

6. Shopify Data Access and Customer Privacy

Shopify App Store Integration: When you install Acurrate from the Shopify App Store, we request the following access scopes with your explicit permission:

• read_analytics: Access to store analytics data
• read_orders: Access to order data including orders older than 60 days (approved access for 12-month historical metrics)
• read_products: Access to product information for industry detection
• read_customers: Access to customer records including customer IDs, order numbers, names, and email addresses (approved under Shopify Protected Customer Data Levels 1 + 2 on 2026-04-22, reference 103226)
• read_customer_events: so Acurrate's link-tracking pixel (below) can see a page view and a completed checkout in your store

What Acurrate can and cannot change: Acurrate has no write permission for products, orders, customers, analytics or store settings, and never modifies, creates or deletes any of them. It requests exactly four write scopes, listed on the permission screen Shopify shows you at install:

• write_discounts and write_price_rules: to create a discount code for a specific creator, when you generate one
• write_draft_orders: to raise a $0 draft order so a product sample can be sent to a creator, when you send one
• write_pixels: to add Acurrate's link-tracking pixel to your store, once, at install. When a shopper arrives through a creator's Acurrate link, it remembers that visit for 30 days and reports the order it leads to, so the creator is credited for a later purchase. It sends the visit, the order number and Shopify's browser identifier, never the shopper's name, email or address, and Shopify runs it only where the shopper's privacy choices allow marketing.

Nothing else in your store can be written to. Discount codes and draft orders are created only when you take an action in Acurrate; the pixel is added once, at install.

Shopify Protected Customer Data (PCD): The following customer fields are Protected Customer Data under Shopify's classification and are governed by additional safeguards described in this section:

• Customer ID (Level 1)
• Order number (Level 1)
• Customer name (Level 2)
• Customer email address (Level 2)

Purposes for which we use PCD:

• Calculating Returning Customer Rate and other per-customer retention metrics
• Calculating Customer Lifetime Value (first-order, 90-day, lifetime) to power the forecast modes in our product
• Matching your existing customers to creators in our public creator-discovery database (the "Your Customers" feature). Matching is done by email address (exact match) and, as a lower-confidence fallback, by name. Matching is performed only within your store's scope and results are only ever visible to you
• Attributing specific orders to specific creator campaigns when promo codes or UTM links are used

Storage location: PCD is stored encrypted at rest in our Supabase database, currently hosted in the United States (AWS us-east-1). Database backups are held in that same region. We will update this section if the hosting location changes.

Retention and deletion: Raw PCD is automatically deleted 30 days after its last sync from your Shopify store. Aggregated metrics derived from PCD (such as LTV numbers, segment counts, or match counts) are non-identifying and may be retained indefinitely. If you uninstall Acurrate, all PCD tied to your store is deleted within 48 hours — Shopify sends us a deletion signal 48 hours after an uninstall and we erase on receipt, and we also expire your customer data immediately at uninstall, so in practice it goes sooner. You may request earlier deletion at any time by contacting us (see Section 12, Contact Us). Backups: deletion removes the data from our live systems straight away. Because we keep encrypted database backups for disaster recovery, a copy can remain inside those backups until they rotate — currently up to seven days — after which it is destroyed with them. We never restore deleted customer data from a backup, and this applies only to the raw customer data described above, not to the aggregated, non-identifying metrics covered earlier in this section.

What is NOT deleted when you uninstall, and why: your own work in Acurrate — the creator lists you built, your forecasts, campaigns, agreements, outreach history and team members — is kept, along with aggregated non-identifying figures derived from your store economics. None of it is Shopify customer data. We keep it so that reinstalling returns you to your work rather than to an empty account, because uninstalling and coming back is a normal thing to do. The access token we held for your store is destroyed at uninstall either way. If you would rather we deleted your own work too, ask and we will (see Section 12, Contact Us).

Audit logging: Every access of PCD is logged to a mutation-restricted audit trail (field names accessed, timestamp, purpose, number of records touched). When a store is erased, store-linked detail is deleted and a de-identified delivery/erasure receipt remains. Shopify may request the applicable audit evidence under its Partner Program requirements.

Access control: PCD is accessible only to active members of your store with viewer, editor, or owner role. Acurrate staff access PCD only for the purposes of providing technical support at your request or complying with a legal obligation; such access is additionally logged.

What we do NOT do with PCD:

• We do not send marketing emails to your customers
• We do not resell, trade, or share customer PCD with any third party for their marketing or commercial purposes
• We do not transmit PCD to AI providers, analytics services, or external tools (customer data does not leave Acurrate's infrastructure)
• We do not access customer phone numbers, physical addresses, geolocation data, IP addresses, or browser/device information
• We do not combine PCD from your store with PCD from another store

Your customers' rights: Your customers retain all rights granted under UK GDPR, EU GDPR, CCPA, and other applicable privacy laws, including the rights of access, rectification, erasure, and objection. If a customer of yours exercises one of these rights (directly with us or via you), we will process the request within 30 days and notify you. See Section 8 for details.

7. Cookies, Analytics and Advertising

No analytics or advertising cookie loads until you choose. Analytics and advertising cookies are off by default. We ask once, with Reject and Accept given equal prominence, and we treat no answer as a refusal. You can change your mind at any time by clearing this site's data in your browser, which returns you to the unasked state.

If you accept, we set cookies for two purposes only:

• Understanding how the site is used — via Google Analytics, Google Tag Manager and PostHog, so we can see which pages and buttons help and which do not. PostHog can also replay a visit, with everything you type hidden, and record errors a page hits, so we can fix what breaks.
• Measuring our own advertising — via Google Ads conversion tracking and the Meta Pixel, so we can tell which of our adverts on Google, Facebook and Instagram led to someone visiting or signing up.

How you found us. On your first visit we keep a small note in your browser, on this site only, of how you arrived: the website that linked to us, the campaign tags and ad click identifiers in the link (such as utm_source, gclid or fbclid), the page you landed on and the date. It stays in your browser and is not sent anywhere unless you create an account. If you do, we copy it to your account together with the country your sign-up came from (as our hosting provider reports it from your connection; we do not keep your IP address for this), so we know which channel brought each customer. We do not share it with Google, Meta or anyone else. Our basis is our legitimate interest in knowing which of our marketing works (Article 6(1)(f) UK/EU GDPR). You can remove the note by clearing this site's data in your browser, and ask us to delete it from your account at privacy@acurrate.com.

Visitors in the United States. If our hosting provider places your visit in the United States, Google's tag loads when the page opens with every consent signal set to denied. It sets no cookies and sends Google only cookieless signals, such as that a page was viewed, without an identifier for you; Google uses them to estimate how many visits and sign-ups our adverts led to. Accept turns on the cookies described above, including Google Tag Manager, which carries our Google Ads tag. Reject keeps everything cookieless, and nothing else loads. Everywhere else, nothing loads until you choose.

Sign-ups we report to Meta. If you accept, when you create an account or start a trial our server also tells Meta that it happened (Meta Conversions API), so the count still works when a browser blocks the Pixel. It sends the event's name, time and reference, the page address without its query, the Meta browser identifiers the Pixel uses (or one made from the Meta advert you clicked), and your IP address and browser details, which the Pixel sends anyway. It never sends your email address, name or account ID, hashed or not. If you reject, nothing is sent.

Meta. If you accept, the Meta Pixel sends Meta Platforms Ireland Limited a record of your visit to this site. Meta may link that visit to your Facebook or Instagram account if you have one, and uses it under its own privacy policy, including for its advertising. We are joint controllers with Meta for collecting and transmitting that visit; Meta is responsible for what it does with it afterwards. You can see and control this in your Facebook or Instagram ad settings.

What we deliberately do not do. We do not use these cookies to build an advertising profile of you or to show you personalised adverts ourselves. We do not send your email address, name or account details, hashed or otherwise, to Google, Meta or any other advertising platform. For Google this is enforced, not merely promised: we set Google's consent signals for advertising user data and advertising personalisation to denied permanently, and the advertising audience export from our analytics to Google Ads is switched off.

We also exclude private surfaces from all analytics entirely — pages whose web address is itself the credential, such as a questionnaire or an agreement link. No tracker loads on those pages whatever your cookie choice, because the address alone would be the thing disclosed.

Third parties: Google Ireland Limited (Google Analytics, Google Tag Manager, Google Ads), Meta Platforms Ireland Limited (Meta Pixel), PostHog, Inc. (product analytics, United States) and Vercel (site performance measurement) receive data under this section. PostHog acts as our processor. Google acts as our processor for analytics and as an independent controller for advertising measurement; Meta is a joint controller for the collection and transmission described above and an independent controller afterwards. This is in addition to the service providers listed in Section 3.

8. Your Rights

Under UK GDPR and applicable data-protection laws, you have the right to:

• Access the personal information we hold about you
• Request correction of inaccurate information (including inaccurate inferred attributes such as estimated demographics or niche)
• Request deletion of your personal information
• Object to processing based on legitimate interests, including inclusion in the creator discovery database (Article 21 UK GDPR)
• Restrict processing of your information
• Opt-out of marketing communications
• Data portability (receive your data in a structured format)
• Lodge a complaint with the UK Information Commissioner's Office (ICO) or your local supervisory authority

Creator removal requests: If you are a content creator and do not wish to appear in our discovery database, email privacy@acurrate.com from an address clearly associated with the account(s) in question, or include a link to the profile(s). We will remove your record(s) within 30 days and suppress them from re-ingestion. We may retain a minimal hash of the handle solely to enforce the suppression.

9. Children's Privacy

Our service is not intended for children under 13. We do not knowingly collect personal information from children under 13.

10. International Data Transfers

Your information may be transferred to and processed in countries other than your own. Our primary database is currently hosted in the United States (Supabase, AWS us-east-1). Some service providers (including Google Cloud for AI inference, Shopify for billing, and Stripe for payments) also process data in the United States or other jurisdictions. Where personal data is transferred outside the UK/EEA, we rely on appropriate safeguards such as the UK International Data Transfer Agreement, the EU Standard Contractual Clauses, or equivalent mechanisms.

11. Changes to This Policy

We may update this privacy policy from time to time. We will notify you of any changes by posting the new policy on this page and updating the "Last updated" date.

12. Contact Us

If you have any questions about this privacy policy or our practices, please contact us at: