Last updated: July 6, 2026
Kuto is operated by Iridian LLC, a Texas limited liability company ("Kuto," "we," "us," or "our"). Kuto is an affiliate marketplace that connects Shopify merchants with affiliates who promote their stores. This Privacy Policy explains what information we collect, how we use it, and your rights with respect to it.
By creating an account or using the Kuto platform (including kuto.link and the Kuto mobile app), you agree to this policy.
This policy applies to three types of people who interact with Kuto:
When you create a Kuto account, we collect your name and email address. If you sign in with Google, we receive your name, email, and Google account ID from Google. If you sign in with Apple, we receive your name (if you choose to share it) and email address from Apple. If you set a password, it is stored as a one-way hash. We never store your password in readable form.
If you connect a Shopify store, we collect your store's myshopify.com domain and an access token that allows us to create and manage discount codes on your store. This token is encrypted at rest using AES-256-GCM. We also store the commission rate, consumer discount rate, payout delay, and other listing settings you configure.
If you use Kuto as an affiliate, we store your chosen handle (a public username used as your discount code on merchant stores), the affiliate links you generate, and your pending and available commission balances. Your handle is publicly visible to merchants and, when used as a discount code at checkout, to the merchants' Shopify stores.
Merchants may upload a store logo, and affiliates may upload a custom image for each affiliate link. These images are stored on Cloudflare R2, our cloud object storage provider. Images are processed server-side (resized and converted to WebP) before storage. We do not collect photos from your device camera roll except when you explicitly choose to upload an image using the in-app image picker. Uploaded images may be publicly visible as part of your listing or link in the Kuto catalog.
When a sale is attributed to an affiliate link, we receive order data from Shopify via webhook. This includes the Shopify order ID, order total (in cents), and timestamp. We use this solely to calculate and record affiliate commissions. We do not receive or store consumer names, email addresses, shipping addresses, or payment card details. Those remain entirely within Shopify and the merchant's payment processor.
Commission payouts are processed through Stripe Connect. When you connect a bank account to receive payouts, Stripe collects your name, date of birth, the last four digits of your Social Security Number, and your bank account details directly. Kuto does not see or store this information. It goes directly to Stripe and is governed by Stripe's Privacy Policy. We store your Stripe account identifier so we can route payouts to you.
We store your notification preferences (such as whether you want immediate or digest emails for new sales). When you contact us at [email protected], we retain that correspondence.
Our hosting provider (Railway) collects standard server logs including IP addresses, request paths, and timestamps. We use this for security monitoring and diagnosing errors. We do not run advertising trackers or third-party analytics pixels.
If the Kuto app or website encounters an error or crash, we collect a diagnostic report so we can find and fix the problem. Crash reports include the technical details of the error (such as a stack trace), your device model, operating system version, and app version. Error reports from our servers may include your account identifier or email address when the error occurred while processing your account's data. We use Sentry (Functional Software, Inc.) to collect and store these reports (see Section 6). Diagnostic data is used only for debugging and reliability. It is never used for advertising or profiling.
If you are located in the European Economic Area or the United Kingdom, we process your personal data under the following lawful bases:
We do not use your information for advertising. We do not sell or share your data with third parties for their own marketing or advertising purposes.
We share your information with the following service providers to operate the platform:
We may also disclose information where required by law, in response to a valid legal process, or to protect the rights, property, or safety of Kuto, our users, or the public.
We do not share your personal information with merchants, affiliates, or other users of the platform beyond what is necessary to operate it — for example, a merchant can see that a specific affiliate handle generated a sale, but cannot see that affiliate's email address or personal details.
Kuto is operated from the United States. If you are accessing the platform from the European Economic Area, the United Kingdom, or another jurisdiction with data transfer restrictions, your data will be transferred to and processed in the United States.
These transfers are made under appropriate safeguards. Our hosting provider (Railway/Google Cloud Platform) and payment processor (Stripe) offer Standard Contractual Clauses as the transfer mechanism for EU/UK data. By using the platform, you acknowledge that your data will be processed in the United States under these safeguards.
| Data Category | Retention Period |
|---|---|
| Account information (name, email) | Duration of account; deleted within 30 days of account closure (subject to legal holds) |
| Shopify access token | Deleted when merchant disconnects their store or closes their account |
| Transaction and commission records | 7 years minimum (IRS recordkeeping requirement) |
| Payout records | 7 years minimum (IRS recordkeeping requirement) |
| Server logs | Up to 90 days (Railway infrastructure default) |
| Crash reports and diagnostic data | Up to 90 days (Sentry retention) |
| Support correspondence | 3 years after last contact |
Kuto uses a single session cookie to keep you logged in on the web. This cookie is strictly necessary for the platform to function and cannot be disabled without also disabling your login session. The mobile app stores your authentication token in your device's secure storage (iOS Keychain / Android Keystore), not in a cookie.
We do not use advertising cookies, tracking pixels, or third-party analytics scripts. We do not respond to Do Not Track browser signals because we do not track users across third-party websites. We honor Global Privacy Control (GPC) signals as an opt-out of any future data sharing for cross-context behavioral advertising purposes (we currently do not engage in such sharing).
The Kuto mobile app does not track you across other companies' apps or websites. We do not use the Advertising Identifier (IDFA on iOS) or any equivalent device advertising identifier. Data collected by the app is used solely to operate your Kuto account and is not shared with data brokers or used for targeted advertising.
You have the right to:
You can delete your account and its data at any time from your profile page, on the web or in the mobile app, without contacting us. To exercise any other right, contact us at [email protected]. We will respond within 30 days (one month for GDPR; 45 days for CCPA, with one 45-day extension if needed). We may require identity verification before fulfilling a request.
California residents have the following rights in addition to the above:
Categories of personal information collected (per CCPA-defined categories): Identifiers (name, email, account ID); Commercial information (commission earnings, transaction history); Financial information (Stripe account ID; actual banking data is held by Stripe, not Kuto); Internet or network activity (server logs, request paths, crash and diagnostic reports). We do not collect biometric data, geolocation, or inferences drawn from personal information.
Sources: Directly from you (account registration, onboarding forms); from Shopify (order data via webhook); from Stripe (payment event notifications).
In addition to the rights above, EU/UK residents have the right to lodge a complaint with their local supervisory authority. See Section 4 for the lawful bases under which we process your data. For data processed on the basis of consent, you may withdraw consent at any time without affecting the lawfulness of prior processing.
We take reasonable technical and organizational measures to protect your data, including: AES-256-GCM encryption of Shopify access tokens at rest; HTTPS for all traffic; bcrypt hashing of passwords; HMAC verification on all Shopify webhooks; and signature verification on all Stripe webhooks. No system is perfectly secure. If you believe your account has been compromised, contact us immediately at [email protected].
Kuto is not directed at children under 18. We do not knowingly collect personal information from anyone under 18. If we learn that we have collected information from a minor, we will delete it promptly.
We may update this Privacy Policy from time to time. When we make material changes, we will notify you by email and update the "Last updated" date at the top of this page. Your continued use of the platform after the effective date constitutes acceptance of the revised policy. If the change requires your consent under applicable law, we will obtain it before the change takes effect.
Questions or requests regarding this Privacy Policy should be sent to [email protected].
Iridian LLC · Kuto · kuto.link