This policy explains what Inner Circle does with personal information. Inner Circle is a Shopify app that lets a merchant gate purchasing on their store behind an access code or an approved access request.
There are two different groups of people this affects, and we treat them differently:
- Merchants. The businesses that install Inner Circle on their Shopify store, and their staff.
- Shoppers. The visitors to those stores, who may enter an access code or submit an access request.
- People who write to us. Anyone who uses the contact form on this website. Section 5 covers them, and nothing else in this policy applies.
1. Who we are
Inner Circle is operated by Monochrome, based in Lebanon.
For anything to do with privacy, including requests about your own data, write to hello@monochrome.digital. We answer within 30 days.
2. The two roles we play
This distinction decides who is responsible for what, so it is worth being clear about.
For merchant information, we are the controller. We decide what to collect about the businesses that install the app, and why. This policy governs it.
For shopper information, we are a processor. The merchant decides what to collect from their visitors, what form questions to ask, and what to do with the answers. We only hold and handle that information on the merchant's instructions. If you are a shopper and you want your data corrected or deleted, the store you dealt with is the right first contact, though you can write to us too, and we will help them act on it.
Our obligations as a processor are set out in the Data Processing Addendum, which forms part of every merchant's agreement with us.
3. What we collect from merchants
When a store installs Inner Circle, Shopify gives us:
- The store's domain and the access token that lets the app work
- The name, email address, language and role of the staff member who installed it, and whether they own the account
- Which plan the store is on
We also store whatever the merchant enters in the app's settings, which may include a sender name and email address, an address for request notifications, and, if they choose to send email through their own provider, the credentials for that provider.
We use all of this to run the app, to work out which features the store is entitled to, to send service messages, and to provide support. The legal basis is performance of our contract with the merchant.
The support chat. There is a chat button on the app's own pages inside the Shopify admin. If a merchant's staff use it, we receive what they type, along with any name or email address they give us. The app also tells the chat which store it is, so a conversation reaches us identified by its shop domain instead of as an anonymous visitor. It runs on tawk.to, listed in our sub-processors, so the conversation lives in their system as well as in ours. We use it to answer, and for nothing else: no marketing, no mailing list. We keep conversations for 24 months and then delete them, the same as email enquiries, and sooner if you ask.
The chat is never loaded on a merchant's storefront and is never shown to shoppers. Section 6 covers what it stores in the browser.
4. What we hold about shoppers
We only ever receive this because a shopper interacted with a store that has Inner Circle installed.
When someone submits an access request:
- Email address, and, if the merchant asks for them, name, phone number, company and country
- The answers to every other question on the merchant's custom form. The merchant builds this form themselves, so we cannot list the fields in advance. Merchants are contractually forbidden from using it to collect sensitive categories of data such as health, ethnicity, religion or political views.
- The products the shopper added to their interest list
- Their Shopify customer ID, if they were signed in
- Which page they submitted from, and which campaign it was attributed to
- Any internal note the merchant later adds, and the outcome of the request
When someone redeems an access code:
- Their Shopify customer ID and email address, if they were signed in
- A one-way scrambled version of their IP address. We never store the address itself. It is salted per store, hashed, and shortened, which makes it useful for spotting abuse and useless for identifying anyone.
- The identifying string their browser sends about itself
- Which page they entered the code from, and when
When someone joins a waitlist:
- Their email address, and their Shopify customer ID if they were signed in
- When they joined, which is what decides their place in the queue
- How many other people joined through their referral link, and for each of those people, which link brought them. That link is what moves somebody up the queue, so the connection between two entries is the feature, not a by-product.
When someone asks to be told about a drop:
- Their email address, which lock they asked about, which page they asked from, and whether the announcement has been sent yet
While someone has access:
- A record that access was granted, when it expires, and when it was last used, linked to their customer ID or email address
- The access tier it was granted at, if the merchant uses tiers. Where the shopper is a signed-in customer, the tier's name is also written to their Shopify customer record as a tag, so the merchant's other tools can act on it
Activity records: we log that events happened (a gate was shown, a code was tried, a request was submitted) so merchants can see how their campaigns performed.
We do not sell any of this, we do not use it for advertising, and we do not use it to train machine-learning models.
5. When you write to us through this website
This website has a contact form. If you use it, we receive your name, your email address, the store address you optionally give us, and the message you write. Cloudflare, which serves the site, also tells us which country the message came from. It does not give us your IP address.
We are the controller for this, and we use it for one thing: to answer you. The legal basis is our legitimate interest in replying to people who write to us.
It reaches us as an ordinary email through Resend, our email provider, and then lives in our mailbox. We do not add you to a mailing list, we do not use it for marketing unless you ask us to, and we do not pass it to anyone else.
We keep enquiries for 24 months, so we can pick a conversation up where it left off, and then delete them. Ask us to delete yours sooner and we will.
The form itself is plain HTML and depends on no script. Nothing about your visit is attached to the message you send us.
This website does use Google Analytics to count visits, and that sets cookies, but only if you agree. Until you answer the question the site asks on your first visit, and for as long as you decline, no cookies are set and nothing that could identify you is sent. Nothing on this site needs it to work, and declining costs you nothing. Section 6 has the detail, including the one anonymous signal that is still sent when you decline, and how to change your mind later.
6. Cookies and browser storage
Three different things, in three different places: what the app stores in a shopper's browser on a merchant's storefront, what the support chat stores in a merchant's own browser inside the Shopify admin, and what this website stores in yours. They are unrelated, and only the last one involves cookies you are asked about.
In a merchant's storefront: the app
Inner Circle stores one value in the visitor's browser, named ic_grant, under the store's own domain.
It holds a random token and nothing else: no name, no email, nothing readable. Its only job is to remember that a guest has already unlocked the store, so they are not asked again on the next page.
It is normally kept in the browser's local storage rather than in a cookie. Shopify's app proxy, the channel a storefront uses to reach an app, removes cookie headers in both directions, so a cookie cannot survive the round trip and Shopify's own guidance is to carry the value another way. Where local storage is unavailable, as it is in some private-browsing modes, a plain cookie of the same name is used as a fallback.
One consequence is worth stating plainly: unlike an HttpOnly cookie, this value can be read by other scripts running on the store's pages. It is designed on that basis. It is a random token that carries no personal information and grants nothing beyond the ability to see prices and buy on that store, it expires, and the merchant can revoke it at any time from their admin.
It lasts for as long as the merchant configures, 30 days by default.
Because it exists only to deliver something the visitor explicitly asked for, namely the access they just unlocked, it is generally treated as strictly necessary. In Europe, storing a value in a browser is treated the same way whether it is a cookie or not, so merchants should still list it in their own cookie notice. We provide wording for that in the merchant disclosure snippet.
Beyond ic_grant, the app sets no analytics, advertising or tracking cookies of any kind on a merchant's storefront, and stores nothing else in a shopper's browser.
In the Shopify admin: the support chat
The support chat described in section 3 is tawk.to's widget, and it stores what any chat widget needs in order to keep one conversation continuous: tawk.to's own identifier for the browser it is talking to, and the state of the chat window. These belong to tawk.to and are set under their domain, not ours.
Two things worth being straight about. First, this is in the browser of a merchant's own staff, on the app's pages inside the Shopify admin. It is never set on a storefront and never in a shopper's browser. Second, the widget loads with the app rather than waiting for the button to be pressed, so that identifier is set on the first admin page view whether or not anyone actually starts a conversation.
It measures nothing about how a merchant uses the app, and none of it is used for advertising. Support is part of what we owe merchants under our agreement with them, which is the basis for it being there.
On this website
Separately from the app, this website, innercircle.monochrome.digital, uses Google Analytics 4, loaded through Google Tag Manager, to count visits and see which pages people actually read.
It is off until you allow it. The site asks on your first visit. Until you answer, and for as long as you decline, Google Consent Mode holds the tag in a state where it writes no cookies and sends no identifier. If you decline, the only thing this site keeps is your answer, stored under ic-consent in your browser's own local storage so you are not asked on every page.
One thing is still sent while you are declining, and we would rather state it than have you find it: for each page you open, the tag sends Google a single anonymous signal: the page address, with no cookie and no identifier of any kind, so one visit cannot be joined to another or to you. Google sees the IP address the request came from, as any server does for any request it receives. Google uses these signals to estimate totals it is not allowed to measure directly. Neither we nor Google can use them to recognise you, and nothing about them is stored in your browser.
If you allow it, Google Analytics sets its usual cookies: _ga and one named _ga_ followed by the property's identifier. They hold a randomly generated number used to recognise a returning browser, and nothing you have told us. They last up to 13 months. We have retention for the underlying event data set to 14 months, after which Google deletes it.
We have deliberately not enabled Google Signals, advertising features or ads-personalisation, so none of this is combined with a Google account or used to build an advertising profile. We run no advertising pixels of any kind, from Google or anyone else.
For visitors in Europe and the United Kingdom this is collected through Google Ireland Limited. Google is listed in our sub-processors, and it also acts as a controller in its own right for some of what it does with the data, which is described in Google's own terms rather than ours.
To change your mind, use the Cookie settings link at the foot of any page. Withdrawing takes effect immediately, and is exactly as easy as giving consent was.
On our Shopify App Store listing
Our listing on the Shopify App Store, at apps.shopify.com, is Shopify's page and not ours. Shopify gives app developers a field for a Google Analytics identifier, and we have filled it in, so we are told how many people open the listing and how many go on to install the app. The install count reaches us from Shopify's servers rather than from your browser, and puts nothing in it.
The consent question on this website does not reach that page. We do not control the tag there and cannot hold it back until you answer, and any cookies it sets belong to apps.shopify.com rather than to us. What happens on the listing is governed by Shopify's own privacy policy and whatever choice Shopify offers you there; the Cookie settings link at the foot of our pages has no power over it.
This lands in a separate stream from the website figures above, so the two are never mixed together, and because those cookies belong to Shopify's domain rather than ours, a visit to the listing cannot be joined to a visit here or to you. The choices described above still hold: no Google Signals, no advertising features, and the same 14-month retention.
Shopify also offers listing fields for a Google remarketing tag and a Meta pixel. We have left both empty, which is what "no advertising pixels of any kind" means in practice.
7. Who else sees the data
We share personal information only with the providers that make the service work. The current list, what each one handles, and where the data physically sits is published at sub-processors.md. Merchants get at least 30 days' notice before we add a new one.
Email to shoppers goes through our email provider. Shopify gives apps no general way to send email to a customer, so Inner Circle sends it: access codes, unlock links, request confirmations and drop announcements. That means the recipient's email address and the contents of the message pass through the provider named in the sub-processor list. The message is sent under the merchant's shop name with the merchant's address for replies; only the technical sending address is ours. A merchant who configures their own SMTP server or Resend account in the app's settings takes this over entirely, and our provider is then not involved.
Beyond that, we disclose information only where the law requires it, or where it is necessary to establish or defend a legal claim. If we are ever compelled to hand over data, we will tell the affected merchant unless we are legally barred from doing so.
8. Where the data goes
The app and its database are both in the European Union, in Frankfurt. The app used to run wherever was nearest to whoever was asking, which in practice meant the United States; since 13 August 2026 it runs beside the database instead.
Support chat conversations are processed in the United States, by tawk.to. That is the only part of the service where merchant information leaves Europe by design, and it only involves what a merchant chose to type to us.
We are based in Lebanon, which the European Commission has not declared to offer an adequate level of data protection. Where European or UK data reaches us, the transfer is covered by the Standard Contractual Clauses (and the UK Addendum where relevant), which are incorporated into our Data Processing Addendum. Merchants do not need to sign anything separately. Accepting our terms puts them in place.
9. How long we keep things
While a store has the app installed, we keep its data so the app can work.
Support conversations, whether they reached us through the chat in the app, the contact form on this website, or ordinary email, are kept for 24 months so we can pick a thread up where it left off, and then deleted. Ask us to delete yours sooner and we will. Uninstalling does not delete them, because they are correspondence with us rather than store data; ask and we will remove them.
When a merchant uninstalls, Shopify tells us, and 48 hours later we delete everything belonging to that store: settings, locks, access codes, access requests, waitlist entries, drop reminders, access tiers, auto-approve rules, granted access, member invites and activity records. This is permanent, and it is not recoverable. Merchants who want to keep their access request history should export it before uninstalling.
When a shopper asks a merchant to erase them, Shopify passes that request to us and we act on it within the window Shopify sets. Records of access requests are stripped of everything identifying (email, name, phone, company, country, customer ID and every form answer) while the bare fact that a request happened remains, so the merchant's own totals stay accurate. Granted access is deleted outright, which also ends that person's access. Redemption records have their email address, customer ID, scrambled IP and browser string removed. A waitlist entry is part of an access request, so it is anonymised with it: the place in the queue survives, the person behind it does not. Requests to be told about a drop are deleted outright, because an entry with the address taken out is not a reminder any more, and leaving one would mean sending that person a final email when the drop opened. An invite someone sent keeps the count and the credit, with the member's name and address removed, so the merchant's totals do not change; invites they make afterwards start from a fresh allowance, because there is no longer any way to tell it is the same person.
10. Keeping it safe
- Every request from a storefront is cryptographically verified as genuinely coming from Shopify before we act on it. A forged request gets nothing.
- Access decisions are made on our servers. Editing the page in a browser can reveal a button, but it cannot make a purchase go through.
- IP addresses are only ever stored scrambled.
- The access token held in the browser is random, carries no personal information, expires, and can be revoked by the merchant at any time. It cannot be read by another store, and it is worthless on one.
- Data is encrypted in transit, and encrypted at rest by our database provider.
- Access to production systems is limited to those who need it.
No system is perfectly secure, and we do not claim otherwise. If a breach affects a merchant's data we will notify them without undue delay, with what we know and what we are doing about it.
11. Your rights
Depending on where you live, you may have the right to ask for a copy of your data, to have it corrected or deleted, to restrict or object to how it is used, and to have it sent to another provider. You can also complain to your national data protection authority.
- Merchants. Write to hello@monochrome.digital.
- Shoppers. Contact the store you dealt with, as they decide what happens to your information. You are welcome to write to us as well and we will make sure your request reaches them.
We do not charge for this, and we will not treat you differently for asking.
12. Requests that come through Shopify
Shopify requires every app to handle three official requests, and we do:
- A shopper asks what is held on them. We assemble everything we hold linked to that email address or Shopify customer account, and make it available to the merchant, who is the one obliged to answer.
- A shopper asks to be erased. We anonymise and delete as described in section 9.
- A store's data must be erased. 48 hours after uninstall, we delete everything belonging to it.
13. Children
Inner Circle is a business tool and is not directed at children. We do not knowingly collect information from anyone under 16. Merchants must not use the access request form to collect information from children. If you believe a child's information has reached us through a store, tell us and we will remove it.
14. Changes to this policy
If we change this policy in a way that materially affects merchants, we will tell them by email at least 30 days beforehand. The date at the top always reflects the current version.
15. Contact
Monochrome, Lebanon