Last updated: 21 October 2026
This policy explains what personal information Taguu ("we", "us") handles when a Shopify merchant uses the Taguu app, when an affiliate (creator) uses a store's affiliate portal, and when a shopper visits a store that uses Taguu. Taguu is a product of Megnus, which operates it. Contact: contact@megnus.app.
Who this applies to
- Merchants: Shopify stores that install Taguu.
- Affiliates: people who join a store's affiliate program through Taguu.
- Shoppers: customers of a store that uses Taguu.
Information we handle
Merchants
- Store details from Shopify: store name, domain, email address, currency and plan.
- An access token from Shopify so the app can work. It is stored encrypted (Supabase Vault) and used only by our servers.
- If you use web login or email broadcasts: your login email, and the sending domain you set up.
Affiliates
- What you enter when you apply or edit your profile: name, email, phone, the platform you share on, profile link, follower range, and your affiliate code.
- Your password is handled by our authentication provider (Supabase Auth). We never see it in plain text.
- Payout details (bank account, wallet number or PayPal email) are encrypted and shown only to the store you work with, on its payout screen. Stores only see a masked label elsewhere.
- Your program data (orders credited to you, commissions, payouts, rewards) is stored in the store's own Shopify account, not in a separate Taguu database.
Shoppers
- To credit a sale to the right affiliate, the store's tracking embed stores the affiliate code from a referral link in a first-party cookie on the store's website (for the number of days the store chooses, e.g. 30) and adds it to the cart. It does not track browsing and does not send visits to our servers.
- To work out commissions, our servers read the store's orders through Shopify's API: order number, amounts, products, discount code, payment and delivery status, and the order's email, phone and customer ID.
- The order's email and phone are used only to stop affiliates earning commission on their own orders, and the customer ID only to flag a customer who keeps ordering through the same affiliate. They are checked when the order is processed and are not stored in our own database. We do not read customers' names or addresses.
- Store reports use Shopify's analytics (ShopifyQL), which return totals such as visits and sales, not individual customers.
- Affiliates never see customer names, emails, phone numbers or addresses.
How we use information
- To run the store's affiliate program: tracking, commissions, approvals, payouts, rewards and reports.
- To send service emails (account verification, application updates, payout notices) and, when a store sends a broadcast, the store's emails to its own affiliates.
- To secure the service, prevent fraud, and provide support.
We do not sell personal information and do not use it for advertising.
Emails
- Account and notification emails are sent through Resend.
- Store broadcasts to affiliates are sent through Amazon SES from the store's own verified domain. They include an unsubscribe link; opens and clicks are counted per campaign and per-recipient records are deleted 30 days after a campaign is sent.
Service providers
We use these providers to run Taguu, under their own security and privacy terms:
- Shopify: store, order and program data.
- Supabase (database, authentication, encrypted storage; Singapore region).
- Vercel (hosting of taguu.com and the app).
- Amazon Web Services – SES (sending store broadcasts; Sydney region).
- Resend (account and notification emails).
Retention and deletion
- Program data lives in the merchant's Shopify store and stays under the merchant's control.
- When a store uninstalls Taguu, its access token is removed. We delete the store's remaining data in our systems after Shopify's shop data erasure request (
shop/redact), and we honor customer data requests and erasures (customers/data_request,customers/redact) sent by Shopify. - Short-lived caches of Shopify responses are kept for minutes and can be wiped at any time.
- Affiliates can ask us to delete their account at contact@megnus.app. Records a store needs for its own accounting (for example past payouts) stay in that store's Shopify account.
Your rights
Depending on where you live (for example under the GDPR or CCPA), you can ask to access, correct, export or delete your personal information, or object to its use. Shoppers should contact the store first; the store can reach us. Affiliates and merchants can contact us directly at contact@megnus.app. We reply within 30 days.
Security
Data is encrypted in transit (HTTPS). Access tokens and payout details are encrypted at rest. Access to production systems is limited to the people who run Taguu.
Children
Taguu is not meant for children under 16, and we do not knowingly collect their information.
Changes
We will post updates on this page and change the date above. Significant changes are announced in the app.
Contact
Megnus · contact@megnus.app