1. Who We Are
Minted ("we", "us", "our") is the trading name of a sole trader business based in England. We operate the Minted analytics service at useminted.com and app.useminted.com, the Minted WooCommerce plugin and the Minted iPhone app. We are the data controller for the information you give us when you create and use a Minted account. For the data collected from your store's visitors and customers, you are the controller and we process it on your behalf. Our registered business details are available on request. Contact: [email protected].
2. What Data We Collect
2a. Data from Minted customers (you)
When you create and use a Minted account, we collect:
- Email address and, if you give it, your name
- Your password, which is stored only as a hash by our authentication provider
- Your WooCommerce store URL, the API credentials and webhook secret used to sync your store, and the store's settings in Minted
- Billing information, which Paddle collects at checkout; we store your Paddle customer and subscription references and never your card details
- If you connect Google Ads or Meta, the access tokens you authorise and the campaign, spend and performance data we import from those accounts
- If you use the iPhone app and allow notifications, the device token Apple gives us to deliver them
- The emails you send us for support
- How you reached the sign-up form: the site that sent you to useminted.com, the page you landed on and any campaign tags on the address. useminted.com keeps this in your browser's local storage for up to 30 days and passes it to the form; we use it only to tell which of our own marketing works
2b. Data from your store's visitors and customers (collected on your behalf)
When the Minted plugin or tracking code runs on your store, we collect from your visitors:
- Page views and events such as product views, items added to the basket, checkout steps and purchases
- Referrer, campaign tags and advertising click ids on the address they arrived at
- Approximate location (country and city), derived from the IP address
- Device type, browser, operating system, screen size and language
- A randomly generated visitor id, stored in a first-party cookie
- A salted hash of the IP address and browser, which cannot be reversed to the address. It is used to tell automated traffic from people, and to match an advertising click to a purchase made on the same network within seven days. The IP address itself is not stored.
- An email address a visitor enters at checkout or in a form, so that their visits can be linked to their order
From your WooCommerce store we import orders: order number, items, totals, currency, payment method, refunds, and the customer's name, email address and billing and shipping country and city.
We do not collect passwords, payment card details, health data, or any special category personal data from your visitors, and we do not build device fingerprints that follow people across other websites.
3. How We Use Data
- To provide and operate the Minted service: live visitors, sales and order reports, customer profiles and journeys, and attribution
- To tell automated traffic from real visitors
- To send you transactional emails (account verification, sale notifications, trial and billing notices) and, if you allow them, push notifications in the iPhone app
- If you turn on audience sync, to send SHA-256 hashes of your customers' email addresses to your own Google Ads or Meta account, so your campaigns can exclude existing customers. Only hashes leave Minted, and only to accounts you have connected
- To keep the Service secure and prevent abuse
- To improve the Service, using aggregated usage patterns
We do not sell, rent, or share your data or your visitors' data with third parties for their own advertising or marketing.
4. Legal Basis for Processing (UK GDPR and GDPR)
- Contract: Processing your account data is necessary to provide the Service you subscribed to.
- Legitimate interest: Analytics on your store serves your legitimate interest in understanding its performance; keeping the Service secure serves ours. You are responsible for establishing the legal basis for collecting data from your own visitors, including consent where your law requires it.
- Consent: Where required by law (for example marketing emails or push notifications), we obtain explicit consent.
5. Who We Share Data With
We share data only with the providers that run the Service:
- Supabase (database and authentication)
- Cloudflare (edge computing, storage and email routing)
- Paddle (payments and payment recovery; Paddle is the merchant of record for all purchases)
- Postmark (transactional email)
- Sentry (technical error reports, which may include account and store identifiers but not your visitors' browsing data)
- Apple (delivery of push notifications to the iPhone app)
- Google and Meta, only for the advertising accounts you connect: we read campaign data from them, and if you turn on audience sync we send hashed customer email addresses to your account there
Each provider processes data under a data processing agreement. Some of them process data outside the UK and the EEA; where they do, the transfer relies on their standard data protection terms, including standard contractual clauses and the UK addendum.
6. Data Retention
Retention is the same on every plan: we keep one year of data.
- Visits: Kept for one year, then deleted. The raw event records behind them are kept for seven days and then held only as daily and hourly totals; hourly totals are kept for 90 days.
- Visitors who left no email address and placed no order: Deleted after one year.
- Visitor profiles, orders and advertising click records: Kept for as long as you have an account.
- Account data: Kept for as long as you have an account.
We delete data on request at any time. Cancelling a subscription does not by itself delete your data: it is removed by the one-year retention period above, or when you ask us to delete it or delete your account.
7. Cookies
The Minted tracking code sets two first-party cookies on your store visitors' browsers. _mnt_vid holds a randomly generated id and is used solely to recognise returning visitors for analytics purposes. _mnt_vs records when your own server last wrote that id, so the tracking code knows to leave it alone.
Where the Minted WooCommerce plugin is installed, your store's own server sets _mnt_vid for 397 days. Without the plugin the tracking code sets it from the browser instead, and Safari and all iPhone browsers shorten that to 7 days from the most recent visit. We do not use third-party tracking cookies.
app.useminted.com uses cookies and browser storage to keep you signed in and to remember your settings. useminted.com runs no analytics. It loads Paddle's script so that Paddle can verify the site and reach customers whose payment has failed; Paddle may set its own cookies when that script runs. Nobody is identified on useminted.com; the application identifies you only after you sign in.
8. Your Rights (UK GDPR and GDPR)
If you are in the UK or the EEA, you have the right to:
- Access your personal data
- Rectify inaccurate data
- Request erasure ("right to be forgotten")
- Restrict or object to processing
- Data portability (export your data)
- Withdraw consent at any time
To exercise these rights, contact [email protected] or use the Data Privacy controls in your Minted account (Settings, then Data Privacy), where you can also delete your account.
9. Your Visitors' Rights
As a Minted customer, you are the data controller for the visitor and customer data collected on your store. You are responsible for giving your visitors appropriate privacy notices, obtaining consent where your law requires it, and honouring their data rights. Minted provides tools in the application to export and delete an individual visitor's data to help you answer data subject requests.
10. Security
We use encryption in transit (TLS) and at rest, role-based access controls, salted hashing for the network and browser values described above, and regular security reviews. All data is hosted on infrastructure provided by Supabase and Cloudflare.
11. The iPhone App
The Minted iPhone app signs you in to the same account and shows the same data as the web application. If you allow notifications, it can tell you about sales and alerts for your stores; Apple delivers these, and we keep the device token only while you stay signed in on that device. The app contains no advertising.
12. Children's Privacy
The Service is not directed to children under 16. We do not knowingly collect personal data from children. If we learn we have collected data from a child, we will delete it promptly.
13. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of material changes via email. The "Last updated" date at the top indicates the most recent revision.
14. Contact
For privacy-related inquiries, contact us at [email protected].