gnlink for WooCommerce & Shopify

1. What the plugin does

The gnlink Affiliate for WooCommerce plugin and the gnlink Shopify integration connect your online store to gnlink so you can measure which affiliate, link, or campaign drove a sale.

gnlink is track-only. We measure and attribute conversions; we never process payments, never charge buyers, and never move money. Where the Service computes affiliate commission amounts, those figures are provided for measurement and reporting only — you are solely responsible for verifying, approving, and paying any amounts owed to your affiliates through your own payment arrangements.

2. What data the plugin sends

When a tracked order is paid, your store sends gnlink an order record containing only commercial / transactional fields — money amounts, product line items, coupon, status, and an anonymous click token:

• orderId — your store's own order id (also used as the exactly-once idempotency key).
• currency — the ISO currency code.
• subtotal, discount, tax, shipping, total — the order money amounts.
• products[] — per line item: product id, quantity, unit price and line discount, and where available the SKU, product name, and product category.
• couponCode — the first applied coupon code, when present.
• orderStatus — one of pending, processing, completed, cancelled, or refunded.
• paymentStatus — always paid in v1.
• occurredAt — the order creation timestamp.
• clickToken — the gnlink click token (see below), when a tracked click preceded the order. WooCommerce only: in Phase 1 the Shopify integration sends no click token — it attributes by the coupon / order match instead.

When you issue a refund on a tracked order, the store also reports the refund so the affiliate commission can be reversed (again, track-only — gnlink computes the reversal but never moves money). The refund record contains orderId, refundId, refundAmount, the refunded subtotal/discount where derivable, currency, and a free-text reason (capped at 500 characters — see the refund-reason note below).

What the plugin does NOT send

We do not collect buyer names, email addresses, postal/shipping addresses, phone numbers, or IP addresses through the store plugins. The plugins send order-level commercial data only. On Shopify, the customer id is deliberately omitted, so no buyer identifier is forwarded.

3. The click token and the optional storefront pixel

The WooCommerce plugin joins an order to the click that drove it using an anonymous click token, not any personal identifier. The token is a random 32-character hex value that gnlink's redirect appends to your destination URL and the tracking tag stores in a first-party cookie named gnl_cid. At checkout, the WooCommerce plugin reads gnl_cid and stores the token on the order so it can be sent with the conversion. It is a pseudonymous random value — not the buyer's name, email, or account. The Shopify integration sends no click token in Phase 1 — Shopify attribution relies on the coupon / order match rather than a click token.

Optional storefront pixel (opt-in, default OFF). The WooCommerce plugin can, if you explicitly turn it on and provide a valid tracking id, auto-inject the gnlink tracking tag into your storefront so clicks are captured without hand-editing your theme. It is off by default and emits nothing unless you enable it with a valid tracking id. When enabled, the tag honours browser Do Not Track and consent-required mode, exactly like the standard gnlink website tracking tag.

4. Setup

• API key & scope. Create a gnlink API key with the conversions:write scope and paste it into the plugin settings. The plugin authenticates with this key as a Bearer token and only ever calls gnlink's fixed API endpoints.
• Key type. Platform / multi-account API keys are rejected — use a normal org-scoped key with conversions:write.
• Storefront pixel. The pixel is opt-in and off by default. Enable it in the plugin settings by turning it on and entering a valid tracking id; disable it by turning it back off.
• Test it. After configuring the key, click one of your tracked gnlink links and place a test order, then confirm the conversion appears in your gnlink dashboard.

(Scope enforcement and platform/multi-account key rejection: integrations/woocommerce/gnlink-affiliate/includes/class-gnlink-aff-api-client.php:140-162.)

5. Refund reasons and personal data

The refund reason is free text typed by your own staff, so in principle someone could type personal data into it. To minimize that risk the WooCommerce plugin automatically removes obvious personal data — email addresses and phone numbers — from the refund reason before it is sent to gnlink. Only the scrubbed, length-capped text is transmitted.

The scrub targets common, machine-detectable patterns (emails and phone numbers); it cannot guarantee removal of every possible free-text disclosure (for example a plain name), so please advise your staff not to enter personal data in refund reasons. The scrub is a safety net, not a licence to include personal data.

6. Data-subject (shopper) requests

Because you (the merchant) are the data controller of your store's order data, a shopper who wishes to access or delete data relating to their order should contact you (the store operator); gnlink will assist you as your processor. When you relay a shopper's order-scoped request, gnlink locates the relevant records by your order id (orderId, the idempotency key) and acts on your instruction. Raw order records also age out automatically at 24 months (see retention below).

7. Data retention

• Raw order / conversion & refund records are retained for 24 months from the order date, then deleted, subject to your configured policy and any earlier erasure request.
• Derived commission statements and aggregate reports (computed totals and aggregates only — no raw buyer-linked order payloads) are retained for the lifetime of your account, because they are needed for your own commission accounting and audit history.

8. Related pages

For the full detail on what is and isn't collected, and how it is handled, see the Privacy Policy (including the E-commerce / Order Data section) and the Terms of Service.

• Privacy Policy
• Terms of Service