Privacy Policy

socommerce.io is operated by Socommerce LTD, a company registered in the United Kingdom under company number 17378950, with its registered office at 27 Old Gloucester Street, London, WC1N 3AX, United Kingdom (“socommerce”, “we”, “us”, or “our”).

No Data Protection Officer has been appointed, as one is not legally required under GDPR Article 37 given the current scale and nature of our processing. For all data protection inquiries, contact us at info@socommerce.io.

As Data Controller:we act as the data controller for personal data we collect directly from you — as a creator, or as a person at a brand or agency — for account management, billing, communications, and operating the Service.

As Data Processor:when a brand connects its shop — on Shopify or on WooCommerce — we process its shoppers’ order data on the brand’s behalf (Sections 3 and 4), only according to its instructions and the terms of our Data Processing Agreement (DPA).

Brand and agency accounts

When a person at a brand or agency signs up, we collect their email address and password, the business’s name, and for a brand its name and niche. When a brand sets up billing, we collect its billing country, address and VAT number, which we check against the UK or EU VAT register. Its card or Direct Debit details go to Stripe directly; we never see them (Section 9). We also record when the business agreed to our Brand Terms and, before it connects a shop, to our Data Processing Agreement.

Creator accounts

A creator holds an account of their own, and what we hold about them is what they typed into it. At signup: an email address and password. In onboarding and their profile: a display name, a username, a profile photo, their gender, their date of birth, the country and city they live in, the kinds of content they make, how many videos they make a month, what they have earned from creator work so far and what they aim to earn this year, in which currency, and up to five portfolio videos they upload. We do not collect, scrape, enrich or cache data about creators from TikTok, Instagram or any third-party data provider, and we do not hold engagement metrics or commerce estimates about anybody.

Before a creator is first paid, we collect their legal name, date of birth, tax identification number (or their confirmation that their country issued them none, with their place of birth) and whether they are VAT-registered, with their VAT number if so. These are collected for tax reporting (Section 5) and for the self-billed statements we write for them. Stripe collects their identity documents and bank details directly; we never see them.

When a creator requests a free sample of a product, we collect the name, postal address and phone number the sample should be sent to.

Every brand on socommerce.io can read a creator’s profileonce they finish onboarding — their display name, username, photo, gender, the year they were born (not the date), where they live, what they make and earn, and their portfolio videos — so brands can find creators to invite. The creator agrees to this in our Terms of Service before onboarding. Brands do not see a creator’s email address, exact date of birth, tax details or sample addresses, except as Section 8 describes.

A creator’s videos are used for advertising.The videos a creator sends a brand are run by that brand as paid ads, on Meta and anywhere else it advertises, and we hand them to the people who run the brand’s ads. A creator agrees to this before sending one, and we record when they agreed. Our Terms of Service say how the videos are used and for how long.

Brand data

What a brand sets up on socommerce.io — its programs and their commission rates, the products it picks from its shop, the brief it uploads for each product, the creators it invites and the videos it accepts — and the orders, commission, invoices and payments that follow. This is processed solely to provide the Service.

Messages to us

When you write to us, or a creator sends a support or feedback message from the app, we receive what you wrote, your email address and any file you attach, and we reply by email. These messages are not stored in our database.

Usage data and analytics

Our hosting providers keep short-lived request logs that include IP addresses, browser type and the pages requested, for security and to diagnose faults. We measure how the site is used with Vercel Web Analytics, which counts page views and events without cookies and without storing IP addresses or any identifier of your device; what we see is aggregated.

Cookies

We set no advertising or tracking cookies, and no analytics cookies, so there is no cookie banner to accept. The cookies we set are:

• Session cookies — keep you signed in and protect the account you sign in to. Strictly necessary; deleted when you sign out, or expire on their own.
• Two preference cookies — remember whether you collapsed the navigation, and which of your brands you last opened. Kept for up to one year. They hold no personal data and are not used to track you.

You can delete any of them through your browser. Without the session cookies you cannot stay signed in. The captcha on our signup and login forms (Section 9) may set a cookie of its own to tell people from bots. The cookie our WooCommerce plugin can set is set on the brand’s own shop, not on socommerce.io, and is described in Section 4.

Age

socommerce.io is for adults. You must be 18 or over to hold an account, and a creator confirms their date of birth in onboarding. We do not knowingly collect personal data from anyone under 18; if we learn that we hold any, we delete it. Write to info@socommerce.io if you believe a child has given us their data.

A brand connects its Shopify shop to socommerce through our Shopify app. This section sets out what that app reads from and writes to the shop, why, and where it is kept. For the personal data of the brand’s shoppers, the brand is the controller and we are its processor (see Section 1).

The permissions the app asks for

When a brand connects its shop, Shopify asks it to approve these permissions, and these only:

• read_orders — to read the shop's orders and refunds.
• read_products — to read the shop's product catalogue.
• write_draft_orders — to create free sample orders in the shop.
• write_pixels — to add our checkout pixel to the shop.
• read_customer_events — to receive what that pixel reports.

We do notask Shopify for a shopper’s name, email address, phone number or postal address, and we do not keep them: where Shopify includes them in an order anyway, our service removes them, with the shopper’s IP address, before the order is stored. We do not ask for access to orders older than the sixty days Shopify allows by default.

Orders and refunds

Shopify notifies us when an order is created, paid or updated, and when it is refunded. We store each order and refund much as Shopify sent it: the products bought and their prices, discounts, taxes and shipping lines, the order’s currency and status, the page the shopper landed on and the site that referred them, the attributes of their cart, the checkout’s identifier, and technical details Shopify includes with an order, such as the browser and language it was placed from — less the shopper’s name, contact details, addresses and IP address, which are removed first.

Products

We read the brand’s product catalogue — names, prices, variants, images and links — so the brand can choose which products creators promote. Product data is not personal data.

Sample orders

When a brand accepts a creator’s request for a free sample, we create a zero-value order in the brand’s shop. It carries the name, shipping address and phone number the creator typed into socommerce, so the brand can send the sample. Shopify then notifies us of that order like any other, which is how the creator sees it ship.

The tracking code and the checkout pixel

The link in an ad for a creator’s video carries a tracking code that names the creator and product, not the shopper. Opening it puts the code in the shopper’s cart, so it arrives with the order. Our app also adds a pixel to the shop’s checkout. When a checkout starts and the page the shopper came from carries a tracking code, the pixel sends us three things: the shop’s Shopify address, the checkout’s identifier and the tracking code. It sends no customer details and no browser or device identifier, and it listens to no other event. We store the checkout identifier, the code and the time it arrived.

The cart code and the pixel work whether or not the shopper accepts the shop’s cookie banner.The pixel is set to “not required” under Shopify’s customer privacy settings, the setting Shopify describes as strictly necessary. We treat it that way because its only purpose is to attribute a sale to the creator whose ad led to it, so the creator is paid correctly — not to track, profile or advertise to the shopper.

What it is used for

• Matching each order to the creator whose link referred it, and recording how it was matched or that it was not.
• Showing the brand its creators' sales, and each creator the number, product, value and date of the sales they earned — never anything about the shopper.
• Calculating commission, reversing it when an order is refunded, and charging the brand and paying the creator for it.

We do not sell this data, share it outside the purposes above, or use it to market to anyone, shoppers included.

Where it is kept, and how

Orders, refunds, pixel reports and the shop connection are stored in our database on Supabase in Frankfurt, Germany (AWS eu-central-1). Shopify’s notifications and the pixel’s reports are received by our shop service, which runs on Modal, a United States provider whose servers may be outside the EEA. It writes them to the database and does not store their contents; its logs record only which shop a delivery came from and whether it was accepted. The access token Shopify issues for a shop is encrypted (AES-256-GCM) before it is stored, with a key held only by that service and never in the database.

How long it is kept

We delete Shopify data automatically, once a day, when its period below has passed:

• Shopify's notifications themselves (which shop, which event, when) — 30 days after they arrive.
• The checkout pixel's reports — 60 days after they arrive.
• Orders and their refunds are kept as described above for 180 days after the order was placed. Then an order that earned no commission is deleted, with its refunds. An order that did earn commission is cut down to what that commission and our invoices need: the products, prices, discounts, taxes, totals and dates. The landing page, the referring site, the tracking codes read from them, the cart's attributes, the checkout's identifier, the browser details, any notes, the shipping lines and the payment details of a refund are deleted. What remains is kept with our billing records (Section 14).
• The address on a sample request — 90 days after the request was declined, withdrawn, shipped or cancelled.

A brand can ask us at any time to erase its shop’s data. We then delete all of it at once. The exception is the cut-down orders that earned commission, which are billing records. We delete the shop’s access token too. Shopify asks us to do the same 48 hours after the app is removed from a shop, and we do it then.

When a brand asks through Shopify for a shopper’s data to be deleted, we treat that shopper’s orders as if their 180 days had passed: we delete them, or cut them down if they earned commission. We never hold the shopper’s name or contact details to delete. When a shopper asks through Shopify to see their data, there is nothing to send: we hold nothing that identifies them.

We keep a permanent record of every such request: which shop it came from, what it asked, when, and how many orders were deleted or cut down. The record holds nothing that identifies the shopper or their orders. If we cannot act on a request automatically, we are told by email and act on it by hand within Shopify’s thirty days.

Requests from shoppers and brands

A shopper who wants to see or delete their data should contact the brand they bought from, which is the controller; we help the brand answer. A brand, or a shopper who cannot reach the brand, can write to info@socommerce.io, and we respond within one month. Removing the app from a shop stops any new data reaching us.

A brand whose shop runs on WooCommerce connects it to socommerce without an app: WooCommerce is a plugin for WordPress, and the shop is a website the brand hosts itself. This section sets out what we read from such a shop, what our plugin does there, and where it is kept. As on Shopify, the brand is the controller of its shoppers’ personal data and we are its processor (Section 1).

The key the brand grants

On its Integration tab the brand types its shop’s address and is sent to its own site, where it signs in to WordPress and approves a REST API key for socommerce with read and write access. The key reaches our shop service directly and is encrypted (AES-256-GCM) before it is stored, with a key held only by that service and never in the database. With it we create three webhooks in the shop — for an order created, updated or deleted — pointing at our service and signed with a secret of our own. A shop that is not served over HTTPS, runs WooCommerce older than 9.0 or sells in a currency other than pounds or euros is refused.

Notifications, and what we read instead

A WooCommerce notification carries the whole order, including the shopper’s name, email address, phone number, postal address, IP address and browser, and no setting of the shop’s leaves them out. We treat it as a ping: our service checks its signature, takes the order’s id and discards the rest unread. It then reads the order from the shop asking for these fields and no others: the order’s number, status, currency and dates, its totals, discounts, shipping total and tax, its lines (each kept less the meta data a line may carry), coupon codes, refund summaries, how it was created, and its meta data. Of the meta data we keep five entries only: the tracking code our plugin wrote (_socommerce_ref), the landing page, referring site and source type that WooCommerce’s own Order Attribution feature recorded, and our reference on a sample order. We never ask for the billing or shipping details, customer account, IP address, browser or customer note, and we remove them before storing if a shop sends them anyway. A refund is read by its number with when it was made, how much, and the lines refunded — not the reason typed by the shop’s staff, which is free text.

With our plugin installed, the shop sends us the order’s id only, so nothing about the shopper leaves the shop in a notification at all.

WooCommerce never re-sends a notification, so every six hours our service also reads the orders changed since it last looked, in the same way, and checks that our webhooks and the plugin are still there.

Products

We read the brand’s product catalogue — names, prices, variations, images and links, and on a multilingual shop the ids of each product’s translations — so the brand can choose which products creators promote. Product data is not personal data.

Sample orders

When a brand accepts a creator’s request for a free sample, we create a zero-value order in the brand’s shop carrying the name, shipping address and phone number the creatortyped into socommerce, so the brand can send the sample. The shop notifies us of that order like any other; marking it completed tells the creator it has shipped. For such an order only, we also read the latest note the brand’s staff added to it, to show the creator as its tracking.

The plugin and its cookie

Socommerce for WooCommerceis a small plugin the brand installs on its shop, from its Integration tab. It carries the tracking code from the ad’s link to the order. Commission runs without it, from Order Attribution alone, but Order Attribution does not run for a shopper who declines the shop’s cookie banner. The plugin:

• Reads the tracking code from the address a shopper lands on and keeps it in WooCommerce's own cart session, which lasts about two days and uses the shop's session cookie, not one of ours. The code names a creator and a product, never the shopper.
• Sets a cookie of its own, socommerce_ref, holding the same code for 30 days — only when the WP Consent API on the shop reports consent to marketing cookies: on an opt-in banner once the shopper accepts them, on an opt-out banner until the shopper declines them, and never on a shop without the API. Without that consent no cookie is set, and the sale still counts through the session.
• On a page served from the shop's cache, a few lines of script hand the code to the plugin's own endpoint on the shop, which keeps it the same way. The script sends nothing anywhere but the shop itself.
• Writes the code on the order at checkout, as the order meta _socommerce_ref.
• Trims the notifications the shop sends us to the order's id.
• Answers a public, read-only status check with its version, the shop's WooCommerce version, whether Order Attribution is on and which translation plugin is active. It holds nothing secret and nothing about any person.

The plugin makes no request to socommerce and stores nothing about the shopper beyond the code. Its cookie is set on the brand’s shop, not on socommerce.io; the cookies our own site sets are listed in Section 2.

What it is used for

The same three things as on Shopify (Section 3): matching each order to the creator whose link referred it, showing the brand and its creators the sales, and calculating, reversing, charging and paying commission. We do not sell this data, share it outside those purposes, or use it to market to anyone, shoppers included.

Where it is kept, how, and for how long

Orders, refunds and the shop connection are stored in our database on Supabase in Frankfurt, Germany, beside Shopify’s. Notifications are received, and orders read, by our shop service on Modal, a United States provider; it writes them to the database and does not store their contents. A notification itself is not kept at all: we record only when the shop last reached us. Orders and their refunds are kept for 180 days after the order was placed, then deleted or cut down exactly as Section 3 describes; what the cut removes from a WooCommerce order is its meta data — the tracking code and what Order Attribution recorded — the reason typed on a refund, and whatever a line carries beyond its product, quantity and price. The address on a sample request goes 90 days after the request ends.

Requests from shoppers and brands

WooCommerce sends us no notice of a shopper’s request, or of a brand leaving. A shopper’s request to see or delete their data is answered by the brand, in WordPress, which is the controller. We ask brands to turn on WooCommerce’s setting Remove personal data from orders on request, so that an erased shopper’s orders are anonymised in the shop; each then reaches us as an order update, from which we never read the shopper in any case. A brand that wants those orders deleted here too names them to us at info@socommerce.io. A brand that leaves revokes our key and deletes our webhooks in its shop and tells us; we then erase its shop’s data, keeping only the cut-down orders that are billing records, and the key with it. Our six-hourly check notices a revoked key on its own and stops reading.

We process personal data on the following bases under GDPR Article 6:

• Performance of Contract (Art. 6(1)(b)) — to provide, operate, and maintain the Service, show creators' profiles to brands, attribute sales, calculate commission, charge brands, pay creators, and manage your account.
• Legitimate Interest (Art. 6(1)(f)) — to keep the Service secure, tell people from bots, prevent and detect fraud, diagnose faults, and understand in aggregate how the site is used. We have assessed that these interests are not overridden by your data protection rights.
• Consent (Art. 6(1)(a)) — where we ask for it, which today is nowhere: we send no marketing email and set no cookies that need consent.
• Legal Obligation (Art. 6(1)(c)) — to issue invoices and keep accounting records under UK tax law; to collect creators' tax details and report what we pay them to HM Revenue & Customs under the UK's platform reporting rules and, through them or directly, to EU tax authorities under DAC7; to check VAT numbers; and to comply with other applicable UK and EU laws and legal processes.

• Provide, operate, and maintain the Service
• Show creators' profiles and portfolios to brands, so brands can invite them to programs, and show programs to creators
• Store the briefs brands upload and the videos creators send, and hand accepted videos to the brand
• Arrange free samples: pass a creator's shipping details to the brand through its shop
• Attribute each sale to a creator, calculate and reverse commission, charge brands weekly, invoice them, and pay creators
• Collect creators' tax details and report what we pay them to tax authorities
• Communicate with you about your account, and answer your support and feedback messages
• Keep the Service secure, prevent fraud, and diagnose faults
• Comply with our legal obligations

• No AI Processing: the Service does not send your data to any artificial-intelligence or large-language-model provider. Briefs are written by brands and videos are made by creators. Nothing you submit is used to train any model, by us or by anyone else.
• No automated decisions (Art. 22 GDPR):there is no algorithm that ranks, scores or recommends creators. A brand filters creators by the answers the creators gave about themselves, and the decision to invite, accept or decline is always a person’s, at the brand or at the creator. Sales are attributed to creators automatically, by the tracking code in the order; that concerns the brand’s shopper only in that we never identify them.
• Profiling: we do not profile users or creators.

We do not sell your personal data. We share information only in the following circumstances:

• Creators' profiles with brands — every brand and agency on socommerce.io can read an onboarded creator's profile and watch their portfolio videos, as Section 2 describes. Brands can watch, not download, portfolio videos.
• Accepted videos with the brand — a video a brand accepts is handed to that brand, and to the agencies and media buyers who run its ads, for advertising under the licence in our Terms of Service.
• Sample addresses with the brand — the name, address and phone number a creator gives for a sample are written into the brand's shop, Shopify or WooCommerce, as the shipping details of a free order, so the brand can send it. The brand is then the controller of that order in its shop.
• Brands' names with creators — a creator sees the name of each brand whose program they join, its products and briefs, and the brand's name on their earnings and self-billed statements.
• Tax authorities — what we pay each creator, with their name, date of birth, address, tax number and (if any) VAT number, is reported to HM Revenue & Customs under the UK's platform reporting rules, which exchange it with the tax authority of the creator's EU country under DAC7; where we must register directly with an EU authority, we report to it.
• Sub-processors — with the service providers who process data on our behalf (Section 9).
• Legal Requirements — when required by UK or EU law, regulation, legal process, or a governmental request.
• Business Transfers — in connection with a merger, acquisition, or sale of assets; affected users will be notified beforehand.
• With Your Consent — in any other case where you provide explicit consent.

We use the following sub-processors to deliver the Service. All are reviewed for security and GDPR compliance and are contractually obligated to protect your data:

• Supabase(Frankfurt, Germany — AWS eu-central-1): database (PostgreSQL), backend infrastructure, and Edge Functions. Data stored within the EEA, encrypted at rest (AES-256) and in transit (TLS).
• Vercel (United States, running our application in Frankfurt, Germany): hosts the website and application and runs its scheduled jobs. Its request logs are short-lived. Vercel Web Analytics counts page views and events for us without cookies and without storing IP addresses or device identifiers. Data encrypted at rest and in transit.
• Cloudflare Turnstile(United States, with servers worldwide): the captcha on our signup, login and password-reset forms. It sees the visitor’s IP address and browser characteristics to tell people from bots, and may set a cookie of its own. We receive only whether the check passed.
• Modal(United States): runs our shop service, which receives order notifications and checkout-pixel reports from brands’ Shopify shops, reads orders from their WooCommerce shops, and writes them to our database (Sections 3 and 4). It does not store their contents.
• Stripe(United Kingdom): takes brands’ payments and pays creators. It collects and holds brands’ card and Direct Debit details and creators’ identity documents and bank details directly; we never see them. We give it a brand’s business name and VAT number, and a creator’s name, country and email address, to open their accounts. Stripe may process this data outside the UK and EEA, under its own safeguards.
• Cloudflare R2(EU jurisdiction): stores the videos creators upload — portfolio videos and the videos they send brands — and the briefs brands upload, in a private bucket whose data is kept within the EU.
• Resend(United States, sending from the EU): sends our email. That is an email to us when a privacy request from a Shopify shop needs a person (it names the shop, never the shopper), and the support and feedback messages creators send from the app, which reach us with the creator’s email address as the reply address and any file they attached.

A complete, up-to-date list of sub-processors is available on request at info@socommerce.io. We will notify users of material changes to this list at least thirty (30) days in advance.

Socommerce LTD is established in the United Kingdom. All primary data is stored and processed within the European Economic Area (EEA): our database and backend run on Supabase in Frankfurt, Germany (AWS eu-central-1), and our frontend and API run on Vercel in its Frankfurt region.

Our shop service runs on Modal, a United States provider, so the order data it receives from Shopify and WooCommerce shops, and the pixel reports, may be processed outside the EEA on their way to our database. Stripe may process payment and payout data outside the UK and EEA. Resend, a United States provider, sends our email, and Cloudflare, a United States provider, runs the captcha on our forms. Where this occurs, we rely on appropriate safeguards, such as Standard Contractual Clauses (SCCs) approved by the European Commission or the UK’s International Data Transfer Agreement, or an adequacy decision.

• Encryption — sensitive data is encrypted in transit using TLS 1.2+ and at rest using AES-256.
• Access Controls — access to personal data is limited to authorized personnel under the principle of least privilege.
• Data Minimization — we collect and retain only the minimum personal data necessary.
• EU Data Residency — all primary data is stored within the EEA (Supabase, Frankfurt) and our application runs within the EEA (Vercel, Frankfurt).
• Infrastructure Security — network segregation, intrusion detection, and host monitoring are enforced by our managed providers, which maintain SOC 2 Type II and ISO 27001 certifications.
• Incident Response — we maintain a documented incident response policy that is reviewed regularly.

In the event of a confirmed personal data breach, we will notify affected users and the UK Information Commissioner’s Office (ICO), and any EU supervisory authority concerned, without undue delay and within seventy-two (72) hours of becoming aware of the breach, in accordance with GDPR Articles 33 and 34.

If you are in the United Kingdom or the European Economic Area, you have the following rights under GDPR. We respond without undue delay and at the latest within one month of receiving your request:

• Right to Access (Art. 15) — request copies of the personal data we hold about you.
• Right to Rectification (Art. 16) — request correction of inaccurate or incomplete data.
• Right to Erasure (Art. 17) — request deletion of your data, subject to legal exceptions.
• Right to Restrict Processing (Art. 18) — request that we limit processing.
• Right to Object (Art. 21) — object to processing based on legitimate interests.
• Right to Data Portability (Art. 20) — request transfer of your data in a structured, machine-readable format.
• Right to Withdraw Consent (Art. 7(3)) — withdraw consent at any time without affecting prior lawful processing.
• Right to Lodge a Complaint — with the UK Information Commissioner's Office (ico.org.uk) or your local EU data protection authority.

To exercise any of these rights, contact us at info@socommerce.io.

• Account and profile data — kept while your account is open and deleted within thirty (30) days of it closing. For a creator that includes their profile, photo, date of birth and portfolio videos. To close an account, write to us (Section 17).
• Videos creators send brands — the file of a video a brand sent back or the creator withdrew is deleted thirty (30) days later, and an upload left unfinished for seven (7) days is abandoned. A video the brand accepted is kept while the creator's account is open; the brand holds its own copy under the licence in our Terms of Service, and keeps it only for as long as that licence runs.
• Sample addresses — ninety (90) days after the request ends (Sections 3 and 4).
• Brand data — programs, products, briefs and the videos accepted are kept while the brand's account is open and deleted within thirty (30) days of it closing, except billing records.
• Billing and tax records — invoices, self-billed statements, the commission they cover, creators' tax details and our record of having asked for them are kept for up to seven (7) years, as UK tax law and platform reporting rules require, including after an account closes.
• Request logs and analytics — our hosts keep request logs for a short period under their own policies; analytics are aggregated and never identify you.
• Shop order data — see Sections 3 and 4.

Where we process personal data on a brand’s behalf — above all its shoppers’ order data, through our Shopify app or from its WooCommerce shop — our Data Processing Agreement applies. It covers the scope and purpose of processing, sub-processors, security, assistance with data subject requests, breach notification, and deletion. A brand accepts it before connecting a shop. Questions about it go to info@socommerce.io.

We may update this Privacy Policy from time to time. For material changes, we will post a prominent notice on our website or email the address associated with your account at least thirty (30) days before the changes take effect.

For any questions about this Privacy Policy or to exercise your data protection rights: