Privacy Policy

Last updated: August 2026

1. Who we are and what this covers

Tomify GTM Pixel Pro ("the App") is a Shopify application, operated by Tomify eCommerce Strategy, that connects a Shopify store to Google Tag Manager and — when the merchant enables it — forwards conversion events from our servers to the advertising and analytics destinations the merchant has configured.

This policy explains what data the App processes, why, for how long, and who else sees it.

2. Our role

For data about the merchant's own account and configuration, we act as a controller.

For data about the merchant's customers, the merchant is the controller and we act as a processor: we process that data only on the merchant's documented instructions — the settings they choose in the App — and never for our own purposes. We do not use it to build profiles, we do not enrich it with other sources, and we do not reuse it across merchants.

3. Data we process

3.1 Merchant and store data

• Store identity: the myshopify.com domain and store ID, to authenticate the store and apply the right configuration.
• Configuration: GTM container IDs, enabled events, market settings and related preferences.
• Session credentials: the access tokens Shopify issues so the App can act on the store's behalf.

3.2 Events on the storefront

On the merchant's storefront and checkout, the App writes ecommerce events into the browser's GTM dataLayer. These events are not sent to our servers. They are handled by the merchant's own Google Tag Manager container, under the merchant's configuration and their agreement with Google. What those events contain — including whether they carry a logged-in customer's email or phone number — is determined by the merchant's settings in the App.

3.3 Advertising identifiers attached to orders

So that conversions can be attributed correctly, the App copies advertising and analytics identifiers that already exist in the shopper's browser (such as the Google Analytics client ID and Meta's _fbp cookie, plus ad click identifiers present in the URL) into an attribute on the merchant's cart, which Shopify carries through to the order. The recorded consent state travels in the same attribute.

These identifiers are stored inside the merchant's own Shopify data, not on our servers, and the merchant can inspect them on any order. Only identifiers that already exist are copied: where consent has been refused, the corresponding cookies are absent and nothing is copied.

3.4 Server-side conversion forwarding (only if enabled)

If the merchant enables server-side forwarding, order data reaches our servers through Shopify webhooks and is forwarded to the destinations the merchant has configured. This data can include:

• order details: value, currency, order and transaction identifiers, purchased items;
• customer personal data used by the destination platforms to match the conversion: name, email address, phone number, and the city, region, postal code and country of the order;
• the advertising identifiers described in section 3.3;
• the IP address and browser user agent recorded by Shopify for the order, which the destination platforms use for the same matching purpose;
• the recorded consent state.

This processing does not happen unless the merchant turns it on and configures a destination.

4. What we never do

• We never sell or rent data, and we never share it with anyone other than the recipients listed in section 6.
• We never store payment card details. The App has no access to them.
• We never capture passwords. Password fields are excluded from every form the App observes, by field type and by field name.
• We never use customer data for our own analytics, product development or marketing.

5. Consent

Where the merchant uses Shopify's native cookie banner, the App reads the shopper's choice through Shopify's Customer Privacy API and records it alongside the event. Where the merchant uses an external consent platform, consent is governed by that platform at tag level and we record that we could not determine the state ourselves — we do not assume consent was given.

Server-side forwarding respects the recorded consent state. Where consent cannot be determined, forwarding takes place only if the merchant has explicitly enabled it, taking responsibility for the lawful basis of that processing.

6. Who else processes the data

• Microsoft Azure — hosting of our application and database, in the Italy North region (European Union). Data is encrypted in transit and at rest.
• Destinations chosen by the merchant — the merchant's own server-side Google Tag Manager container, or the advertising and analytics platforms they configure (such as Google Analytics, Google Ads, Meta or TikTok). These recipients are selected by the merchant, and their handling of the data is governed by the merchant's own agreements with them.

We do not transfer data outside the European Union ourselves. Where a merchant configures a destination outside the EU, that transfer is made on the merchant's instruction and under the merchant's own agreement with that provider.

7. How long we keep it

• Configuration and session data: for as long as the App is installed. On uninstall, the associated data is deleted, and any remainder is removed when Shopify sends the shop redact request 48 hours later.
• Events awaiting forwarding: deleted as soon as delivery succeeds. Events that cannot be delivered after the retry window are discarded and only the failure is recorded.
• Delivery log (which event went where, and whether it succeeded): 45 days.
• Aggregated counters that contain no personal data: 13 months.
• Database backups: 7 days.

8. Data subject requests

Shoppers should address their requests to the merchant, who is the controller of their data. We respond to Shopify's customers/data_request, customers/redact andshop/redact webhooks, and we assist the merchant in fulfilling access, correction, deletion, restriction and portability requests.

9. Security

• All traffic is served over HTTPS.
• Requests from Shopify — webhooks and app proxy calls — are verified with HMAC signatures before any data is processed.
• The database is encrypted at rest and reachable only from allow-listed network addresses.
• Access to production systems is limited to the operator of the service.
• Our incident response procedure is documented, and we notify affected merchants without undue delay.

10. Changes

When what the App does with data changes, this policy is updated at the same time. The date at the top reflects the most recent change.

11. Contact

For questions about this Privacy Policy, or to exercise a right, contact us at support@tomify.it.