Drip privacy policy

Last updated October 18, 2026

Drip is a Shopify app operated by Pepper Labs. Merchants install it to give their customers personal referral links and to reward successful referrals with Shopify store credit. This policy explains what personal information Drip processes, why, who receives it, and how long it is kept. Questions and requests go to raymondxma@gmail.com.

Each merchant decides to use Drip for their store and is responsible for their own customers' information. Pepper Labs processes that information on the merchant's behalf to run the referral program. If you shopped at a store that uses Drip, the store's own privacy policy also applies.

Information Drip processes

Merchants

The store's Shopify domain, name and currency; the access token Shopify issues when the app is installed; and the referral program settings, such as reward amounts, the friend discount, the return hold and setup progress.

Customers who share a referral link

• The email address used to sign in to Drip. You type it in, or Drip takes it from your Shopify customer account when you get your link from a store's order confirmation page.
• Your Shopify customer ID at each store where you join a program.
• Your personal links, and the clicks, referred orders and rewards associated with them, including reward amounts, status and history.
• A personal discount code for each store, made from your first name if you gave one, or otherwise the first part of your email address, plus the discount amount (for example, JANE-10). Drip creates it in the store's Shopify discounts.
• If you use Drip's cash affiliate program: your name, PayPal email address, tax form acknowledgement, and the commissions and payouts merchants record for you.

Shoppers who place an order at a store that uses Drip

For each paid order, Drip stores the order ID and number, subtotal, currency, products and quantities, discount codes, the landing page address, and Shopify's customer journey summary for the order (first and last visit, traffic source and campaign parameters). It also stores the email address on the order and the Shopify customer ID. Drip uses these to tell whether an order is the shopper's first order at the store and whether it came through a referral link.

Drip reads the name and the shipping and billing addresses on the order, turns them into one-way SHA-256 hashes, and stores only the hashes, not the name or address. When a referral reward is checked, Drip also reads the referrer's email address, default address and recent shipping addresses from Shopify and compares them with the order. These comparisons stop customers from referring themselves. They happen in memory and the values read are not stored.

People who open a referral link

Drip records a random click ID, the link, the store, your country (determined by Cloudflare from your connection) and your browser's user agent. If you allow analytics and marketing tracking at checkout, Drip's Shopify checkout pixel also sends the order ID, checkout token and the referral link and click you arrived from.

What Drip does not store

Drip does not store IP addresses alongside the information above. It uses IP addresses briefly to limit repeated sign-in and sharing attempts, in temporary records that expire within one hour. Drip does not collect phone numbers or payment card details.

Cookies and browser storage

• _drip cookie and local storage entry, set on the store's website when you arrive through a referral link. It holds the referral link, click ID and timestamps so a later purchase can be credited to the person who referred you. It lasts 30 days.
• Session storage and local storage entries that remember whether you arrived through a referral during the current visit and whether you dismissed the referral discount banner.
• Cart attributes and hidden line item properties named _drip_ref and _drip_click, which carry the referral link and click ID through checkout into the order.
• drip_session cookie on Drip's own website, which keeps you signed in for up to 30 days. Sign-in links expire after 15 minutes and work once.

Drip does not use advertising or third-party analytics cookies.

How the information is used

• To attribute orders to referral links and decide whether a reward is earned: the order must be the buyer's first at the store, made within 30 days of a recorded click on the link, placed with the store's Drip discount code or the referrer's personal code, not placed by the referrer, and kept past the merchant's return hold.
• To issue store credit through Shopify, and to reduce or reverse it after refunds and cancellations.
• To show merchants their program results and the history of each reward.
• To send sign-in links by email.
• To prevent abuse, troubleshoot problems and respond to privacy requests.

Reward eligibility is decided automatically using the rules above. If Drip cannot confirm within 7 days of payment that an order qualifies, no reward is issued for it. Problems found after credit has been issued, such as a refund Drip cannot match to specific items, are held for the merchant to review. If you think a reward was decided incorrectly, contact the store that runs the program.

Drip does not sell personal information, use it for advertising, build marketing profiles, or use it to train AI models.

Who can see it

• The merchant sees, in the Drip app in Shopify admin, each referrer's email address and personal discount code, referred order numbers, whether each buyer was a new or repeat customer, how the order was attributed, and reward amounts and status.
• Referrers see their own links and rewards. They do not see who used their link.
• Friends who open a referral link see the discount being offered and the referrer's personal discount code, which contains the referrer's first name or the start of their email address. They do not see the referrer's full email address.

Service providers

• Shopify provides app installation, store and order data, the checkout pixel, discounts and store credit. If the merchant turns on store credit notifications, Shopify emails the customer when credit is issued.
• Cloudflare hosts Drip and stores its databases, sessions, queues and operational logs.
• Resend delivers sign-in emails and receives the recipient's email address and sign-in link.
• AI assistants you connect. If you connect an AI assistant to your Drip account, it receives the account information you authorize, such as your links, referral statistics and payout email. The assistant's provider handles that information under its own privacy policy.

These providers may process information in countries other than your own.

How long information is kept

• Order, attribution and reward records are kept while the store has Drip installed, so rewards can complete their hold, be adjusted after refunds and be audited.
• When a merchant uninstalls Drip, Shopify sends a store data deletion request 48 hours later, and Drip then deletes that store's data.
• When a merchant submits a Shopify customer data erasure request, Drip removes that customer's email address, customer ID and hashes from their orders, removes their program membership and product links, and holds any related rewards for manual review. Reward amounts and audit history remain without the customer ID.
• Your Drip sign-in account, which is your email address and links, is shared across stores. It is kept until you ask us to delete it.
• Operational logs and backups are kept according to Cloudflare's retention practices.

Your choices and rights

To access, correct or delete information a store holds about your orders, contact that store. Merchants can submit Shopify customer privacy requests, which Shopify forwards to Drip. To access or delete your Drip sign-in account, email raymondxma@gmail.com. We verify requests before disclosing or deleting information and respond within the deadlines required by applicable law.

You can block or clear the _drip cookie in your browser. Referral purchases may then not be credited.

Security

Information is sent over HTTPS and stored with Cloudflare, which encrypts it at rest. Merchants can see only their own store's data, through Shopify's authenticated admin. No method of storage or transmission is completely secure.

Changes

We will update this page when Drip's data practices change and revise the date at the top.