Privacy policy
Last updated October 6, 2026
Mint Store Locator is a Shopify app made by Mint Labs ("we", "us"). It shows a merchant's stores and stockists on their online store: a searchable list, a map, opening hours, directions and a page for each location. This policy explains what the app handles, why, and when it's deleted. For anything about the merchant's visitors we act as a service provider (processor) to the merchant, who is the controller.
The short version
- The app stores no customer data: no customer or order records, no shopper names, email addresses, phone numbers, IP addresses or positions.
- What it stores is the merchant's own business information: the locations they add (business addresses, opening hours, phone, website, notes, tags) and their settings.
- “Use my location” on the storefront stays in the shopper's browser. The position is never sent to us.
- A typed place search (for example a town or postcode) is looked up by our server; we keep only a one-way hash of the search and a point rounded to about 1 km, for 30 days, linked to no one.
- We never sell or share data, use it for advertising, or combine it across stores. The app sets no cookies.
Information about merchants
| Information | Why |
|---|---|
| Store domain and a Shopify access token | To read the store's Shopify locations when the merchant imports them, and to save the theme block's settings. |
| Store name, time zone, primary domain, app installation ID | “Open now” uses the store's time zone unless a location has its own; links on the store pages use the primary domain. |
| Locations: name, type (own store or stockist), business address, phone, email, website, note, tags, opening hours, time zone, map position, visibility | Shown on the storefront as the merchant entered them. Business contact details are the merchant's own or their stockists' public ones. |
| Settings | To show the locator the way the merchant set it up. |
| Plan (Free, Pro or Plus) and its dates | Read from Shopify to decide which features apply. Payments are handled entirely by Shopify. |
| When the theme block and the store list page were last used | The setup checklist on the app home. |
Information about shoppers
| What happens | Details | Kept |
|---|---|---|
| “Use my location” | The browser asks the shopper for permission; the position is used in the browser to sort stores by distance and is never sent to us. | Not stored |
| Place search (only when the typed words match no store name or address) | Our server sends the search text — never the shopper's IP address — to OpenStreetMap Nominatim to find the place. We keep a one-way hash of the search and the point rounded to about 1 km, so repeated searches don't go out again. | 30 days |
| Rate limits on place searches | Counters keyed by a salted, daily-changing one-way hash of the visitor's IP address (never the address itself). | Up to 1 day |
| Map display | When a map is shown, the shopper's browser loads the map library from our server and map tiles from OpenFreeMap (tiles.openfreemap.org). Like any website, those servers see the visitor's IP address to deliver the files; OpenFreeMap states it uses no cookies and keeps no user database. The map loads only when it scrolls into view. | Not stored by us |
Search text is never written to our logs.
Customer privacy requests
- Access requests (
customers/data_request) and erasure requests (customers/redact): the app holds no information about individual customers, so there is nothing to return or delete. The requests are acknowledged. - Store deletion (
shop/redact, sent 48 hours after a merchant uninstalls): we permanently delete everything we hold for the store, including all locations and settings.
Where data is processed and how it's protected
The app runs on Cloudflare (hosting and database) and connects to Shopify's APIs. Addresses are looked up with OpenStreetMap Nominatim (operated by the OpenStreetMap Foundation): merchants' location addresses and shoppers' place searches are sent from our server, without any personal data. Map tiles come from OpenFreeMap. Data is encrypted in transit (TLS) and at rest. Access is limited to Mint Labs staff who need it to provide support. We use no analytics or trackers. See our security policy.
Retention
Locations and settings are kept while the app is installed. Access tokens are deleted as soon as the app is uninstalled, and everything else when Shopify sends the store deletion request 48 hours later. Cached address lookups are kept for 180 days and place searches for 30 days; rate-limit counters for up to a day.
Map data
Map data © OpenStreetMap contributors, available under the Open Database License. Map tiles by OpenFreeMap, © OpenMapTiles. The map library is MapLibre GL JS (BSD-3-Clause).
Your rights
Depending on where you are, you may have the right to access, correct or delete information about you. Merchants can contact us directly; shoppers should contact the store, or email us and we'll help. We respond within 30 days.
Changes
If we change this policy we'll update the date above and, for significant changes, notify merchants in the app.
Contact
Mint Labs — support@stickermint.com