Athlete Affiliates Privacy Policy

Last updated: 28 October 2026

Athlete Affiliates (the "App") is a Shopify app that helps merchants run athlete sponsorship and affiliate programs: it tracks sales referred by athletes, calculates commissions and content payments, and gives athletes a portal to see their earnings and submit content. The App is operated by NEWGEN ("we", "us").

This policy explains what information the App processes, why, and the choices available to merchants, athletes and shoppers.

1. Who is responsible for your information

• Merchants (Shopify store owners who install the App): we are responsible for the account information we hold about your store.
• Athletes and applicants: the merchant whose program you joined or applied to decides what happens to your information. We process it on that merchant's behalf, under their instructions. Questions about how a merchant uses your information should go to that merchant first; we will help them respond.
• Shoppers (customers of a merchant's store): the merchant is responsible for your information. We process the limited order information described below on the merchant's behalf.

2. Information we process

Merchants

• Store details from Shopify: store domain, store name, currency, time zone, and the store's contact email address. The email is used only to send you the monthly results email, which you can turn off in Settings or with the unsubscribe link in any of those emails.
• The access credentials Shopify issues so the App can work with your store (stored securely and used only for the App's functions).
• Your program settings: commission rates, attribution window, discount settings, campaigns, recruitment page content and branding (including any logo you upload).
• Records you create in the App, such as payment references you enter when you mark a commission as paid.

Athletes

• Information the merchant enters or that you provide when applying: first and last name, email address, Instagram and TikTok handles, and any notes the merchant adds.
• Your referral code and the commission, content payment and payout records linked to it.
• Content you submit through the athlete portal: links to your content, notes, and the merchant's review comments.
• Sign-in records for the athlete portal (see section 5).

We do not collect or store athletes' bank account, card or tax details. Payments to athletes are made by the merchant outside the App; the App only records that a payment was made.

Recruitment applicants

• Your application: name, email address, social handles, your message, your answers to the merchant's questions, and your consent to the merchant contacting you.

Shoppers

• Order information: when an order is paid, cancelled or refunded in a store that uses the App, Shopify sends the order to the App. We store only the order ID and number, the order date, amounts, currency and the athlete code or referral link that the order was credited to.
• Email address (not stored): the App reads the order's email address only to check that an athlete is not earning commission on their own purchase. The comparison happens in memory; the email address is never saved, logged or shared. If an order has to wait for a referral report from the store's web pixel (see section 5), the App keeps a one-way keyed hash of the email for up to 7 days so the same check can be made later; the email itself cannot be recovered from it.
• Referral link visits and completed checkouts: see section 5.

We do not store shoppers' names, addresses or phone numbers.

3. How we use information

We use information only to provide the App's features to the merchant who installed it:

• crediting referred orders to the right athlete and calculating commissions, including reversing them when an order is refunded or cancelled;
• creating optional Shopify discount codes for athletes when the merchant chooses to;
• managing campaigns, content submissions and approvals;
• running the merchant's recruitment page and application review;
• showing athletes their earnings and content in the athlete portal;
• preventing self-referral, spam applications and abuse (for example rate limits);
• keeping the App secure, fixing problems and meeting legal obligations.

We do not sell personal information, use it for advertising, or share it with data brokers.

4. Who we share information with

• Shopify, which provides the platform the App runs on and sends us store and order information.
• Render (render.com), which hosts the App and its database. Data is stored in Render's Singapore region. Render's network provider (Cloudflare) carries traffic to the App.
• Sentry (sentry.io), which receives reports when the App hits an unexpected error so we can fix it. Reports contain the error, the part of the App where it happened, the store's domain and technical details about the server. They do not contain shopper, athlete or applicant details: request contents, cookies and users are not sent, and email addresses and sign-in links are removed. Reports are stored in Sentry's United States region.
• The merchant whose program the information belongs to. Merchants can see the athletes, applications, content and earnings in their own program, and athletes can see their own records in the portal. Merchants cannot see each other's data.
• Authorities, if required by law.

We will update this list before adding any new service provider that receives personal information.

5. Cookies and browser storage

• Referral links (store websites): when a shopper arrives through an athlete's referral link, the App's storefront script remembers the athlete code and the time of the click in the browser's local storage, and adds them to the shopping cart so the order can be credited. It does this only if the shopper's privacy choices on that store allow marketing tracking (through Shopify's Customer Privacy API). No personal information is stored. The stored code is ignored after 365 days, and the merchant's attribution window (30 days by default) decides whether an order earns commission.
• Web pixel (store websites and checkout): the App also uses a Shopify web pixel, which Shopify runs in a restricted sandbox, again only if the shopper's privacy choices allow marketing tracking. It remembers the referral code and click time in the same way, and when the checkout is completed it sends the App the code, the click time and Shopify's checkout identifier, so the order can be credited even if the cart did not carry the referral. It sends no names, email addresses, addresses or payment details. The App keeps these reports for 30 days.
• Athlete portal: after an athlete signs in with a one-time link, a secure cookie (aa_portal) keeps them signed in for up to 30 days or until they sign out. Sign-in links expire after 7 days and can be used once.
• Merchant admin: the App runs inside Shopify admin and uses Shopify's session tokens; it does not set its own tracking cookies.

The App does not use analytics, advertising or third-party tracking cookies.

6. How long we keep information

7. Your rights and choices

• Merchants can view and change their program data in the App at any time, and can have all of it deleted by uninstalling the App (deletion follows 48 hours later) or by contacting us.
• Athletes and applicants can ask the merchant whose program they joined to access, correct or delete their information. Merchants can correct it in the App, delete an application, and erase an athlete's personal data (name, contact details, notes, codes, portal access, submitted content links and applications, plus any Shopify discount created for them). Earnings, order and payment records are kept without the athlete's details, for the merchant's accounts. You can also contact us at [email protected].
• Shoppers can ask the store they bought from about their data. Shopify forwards data requests and deletion requests to us; as we hold no shopper names, emails or addresses, there is nothing to return or erase beyond order references that the merchant needs for its commission records.
• Referral tracking: shoppers can decline marketing tracking in the store's privacy banner, or clear their browser storage, and no referral will be remembered.

Depending on where you live, you may have further rights under local privacy law (for example in Australia, the UK, the EU or California). Contact us and we will respond within the time those laws require.

8. Security

We protect information with measures including: encrypted (HTTPS) connections; verification that every notification really comes from Shopify; strict separation between merchants' data, covered by automated tests; a database that cannot be reached from the internet; one-time sign-in links that we store only in hashed form; rate limits on public forms and sign-in; and access to systems limited to the people who run the App. No system is perfectly secure; if a security incident affects your information, we will tell the affected merchants and, where the law requires, the relevant regulator and the people affected.

9. Children

The App is a business tool for merchants and the athletes they work with. Merchants are responsible for making sure they have any consent needed (for example from a parent or guardian) before adding an athlete under 18.

10. International transfers

Information is stored in Singapore and may be accessed from Australia, where the App is run. Shopify may process information in other countries under its own privacy policy.

11. Changes to this policy

We will post any changes here and update the date at the top. If a change materially affects how we use personal information, we will tell merchants in the App before it takes effect.

12. Contact

NEWGEN — [email protected]