Twinfold privacy policy

Effective October 7, 2026 · NewClick, Pasadena, CA, USA

Twinfold is a Shopify app by NewClick that finds duplicate customer profiles in a Shopify store and merges them when the merchant confirms. This policy explains what the app accesses, what it keeps, and how it is deleted.

What the app accesses

With the merchant's permission, the app reads through Shopify's Admin API:

• Customer profiles: name, email address, phone number, addresses, number of orders, account state and whether Shopify allows the profile to be merged. These are used only to find duplicates and to show the merchant what a merge will do.
• Basic store information: the store's domain, its Shopify ID and its subscription plan for this app.

What the app stores

• No customer names, email addresses, phone numbers or addresses. They are read from Shopify when a page needs them and are not saved. During a scan they are normalized and hashed in memory to compare profiles, then discarded.
• Shopify customer IDs of profiles found as possible duplicates, why they matched, their order counts and creation dates, and profiles the merchant marked as "not duplicates".
• Merge history: which customer IDs were merged, the result, any reason Shopify gave for refusing, and the ID of the store staff member who confirmed.
• Store-level records: the store domain, plan, spending limit, usage counts and Shopify access tokens.

How long it is kept

• Possible-duplicate lists are replaced by each new scan; old scans are deleted after 90 days.
• Merge history is deleted after 12 months.
• Pay-as-you-go usage records are deleted 90 days after they are reported to Shopify.
• When a store uninstalls the app, its access tokens are deleted immediately. When Shopify sends the shop data erasure request (48 hours after uninstall), all of its data is deleted; only anonymous usage counts with no store name are kept.
• When Shopify sends a customer data erasure request, that customer's ID is removed from duplicate lists and the merge history.

Sharing

NewClick does not sell or share customer data. The app runs on Amazon Web Services (United States) and talks only to Shopify. Usage-based charges are reported to Shopify with a count and the store's ID, never customer details.

Security

Data is encrypted in transit (TLS) and at rest, including database backups. Access to the app's systems is limited to NewClick staff who operate it. Each time customer details are read, the app logs which store, which staff member or background job, why, and the customer IDs (not the details); these logs are kept 30 days.

Your choices and contact

Merchants can uninstall the app at any time from the Shopify admin. Store customers can make privacy requests to the store, which Shopify forwards to the app. How we process data for merchants is also set out in our terms of service. Questions: gmx2267@gmail.com or NewClick support.