Privacy Policy

Last updated: September 2026

1. Who we are and what this covers

Tomify GTM Pixel Pro ("the App") is a Shopify application, operated by Tomify eCommerce Strategy, that connects a Shopify store to Google Tag Manager and — when the merchant enables it — forwards conversion events from our servers to the advertising and analytics destinations the merchant has configured.

This policy explains what data the App processes, why, for how long, and who else sees it.

2. Our role

For data about the merchant's own account and configuration, we act as a controller.

For data about the merchant's customers, the merchant is the controller and we act as a processor: we process that data only on the merchant's documented instructions — the settings they choose in the App — and never for our own purposes. We do not use it to build profiles, we do not enrich it with other sources, and we do not reuse it across merchants.

3. Data we process

3.1 Merchant and store data

• Store identity: the myshopify.com domain and store ID, to authenticate the store and apply the right configuration.
• Configuration: GTM container IDs, enabled events, market settings and related preferences.
• Session credentials: the access tokens Shopify issues so the App can act on the store's behalf.
• Advertising platform credentials: where the merchant chooses to send conversions directly to Meta, TikTok, Google Analytics or Google Ads, the App stores the access token or API secret the merchant provides for that platform. These belong to the merchant, not to their customers. They are encrypted before storage with a key held outside the database, are never displayed again once saved, and are deleted when the App is uninstalled. The merchant can remove or replace any of them at any time.
• Google account data: Google Ads is the only destination connected through Google's own sign-in rather than a pasted key. When a merchant connects it, the App receives from Google a refresh token and the identifier of the Google Ads account the merchant selected. Details are in the section below.

3.2 Events on the storefront

On the merchant's storefront and checkout, the App writes ecommerce events into the browser's GTM dataLayer. These events are not sent to our servers. They are handled by the merchant's own Google Tag Manager container, under the merchant's configuration and their agreement with Google. What those events contain — including whether they carry a logged-in customer's email or phone number — is determined by the merchant's settings in the App.

3.3 Advertising identifiers attached to orders

So that conversions can be attributed correctly, the App copies advertising and analytics identifiers that already exist in the shopper's browser (such as the Google Analytics client ID and Meta's _fbp cookie, plus ad click identifiers present in the URL) into an attribute on the merchant's cart, which Shopify carries through to the order. The recorded consent state travels in the same attribute.

These identifiers are stored inside the merchant's own Shopify data, and the merchant can inspect them on any order. Only identifiers that already exist are copied: where consent has been refused, the corresponding cookies are absent and nothing is copied.

When server-side forwarding is enabled (section 3.4), the checkout events the merchant has chosen to forward also carry these identifiers and the consent state, together with the Shopify checkout token. We keep that pairing on our servers for a short time so that, if the cart attribute did not reach the order in time, the same identifiers can be re-attached to that order before it is forwarded. This record contains no name, email address, phone number or postal address, and is deleted after 72 hours (see section 8).

3.4 Server-side conversion forwarding (only if enabled)

If the merchant enables server-side forwarding, order data reaches our servers through Shopify webhooks and is forwarded to the destinations the merchant has configured. This data can include:

• order details: value, currency, order and transaction identifiers, purchased items;
• customer personal data used by the destination platforms to match the conversion: name, email address, phone number, and the city, region, postal code and country of the order;
• the advertising identifiers described in section 3.3;
• the IP address and browser user agent recorded by Shopify for the order, which the destination platforms use for the same matching purpose;
• the recorded consent state.

This processing does not happen unless the merchant turns it on and configures a destination.

4. What we never do

• We never sell or rent data, and we never share it with anyone other than the recipients listed in section 6.
• We never store payment card details. The App has no access to them.
• We never capture passwords. Password fields are excluded from every form the App observes, by field type and by field name.
• We never use customer data for our own analytics, product development or marketing.

5. Consent

Where the merchant uses Shopify's native cookie banner, the App reads the shopper's choice through Shopify's Customer Privacy API and records it alongside the event. Where the merchant uses an external consent platform, consent is governed by that platform at tag level and we record that we could not determine the state ourselves — we do not assume consent was given.

Server-side forwarding respects the recorded consent state. Where consent cannot be determined, forwarding takes place only if the merchant has explicitly enabled it, taking responsibility for the lawful basis of that processing.

6. Who else processes the data

• Microsoft Azure — hosting of our application and database, in the Italy North region (European Union). Data is encrypted in transit and at rest.
• Destinations chosen by the merchant — the merchant's own server-side Google Tag Manager container, or the advertising and analytics platforms they configure (such as Google Analytics, Google Ads, Meta or TikTok). These recipients are selected by the merchant, and their handling of the data is governed by the merchant's own agreements with them.

7. Google user data

This section describes, specifically, how the App handles data obtained through Google sign-in. It applies only to merchants who choose to connect Google Ads; nothing here happens otherwise.

• What we ask for. A single scope, https://www.googleapis.com/auth/adwords. It is requested only when the merchant clicks to connect Google Ads, and it is used for one purpose: uploading the conversions of that merchant's own store to the Google Ads account they selected.
• What we store, and where. The refresh token Google issues, the short-lived access token derived from it, and the Google Ads customer ID chosen by the merchant. They are encrypted before being written to the database, with a key held outside it, and are never shown again in the interface once saved. Our servers and database are in the European Union.
• What we never do with it. The token is not used to read campaigns, budgets, keywords or reports, is not used for any purpose beyond delivering that merchant's conversions, and is never sold, shared with third parties, or used to train models. No human at Tomify reads it: it is decrypted only in memory, at the moment a conversion is sent.
• How to take it back. The merchant can disconnect Google Ads from inside the App at any time, which deletes the stored credentials, and can revoke access independently from their own Google account permissions. Uninstalling the App deletes them as well.

Tomify's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

We do not transfer data outside the European Union ourselves. Where a merchant configures a destination outside the EU, that transfer is made on the merchant's instruction and under the merchant's own agreement with that provider.

8. How long we keep it

• Configuration and session data: for as long as the App is installed. On uninstall, the associated data is deleted, and any remainder is removed when Shopify sends the shop redact request 48 hours later.
• Events awaiting forwarding: deleted as soon as delivery succeeds, and in any case within 24 hours of being queued. An event that still cannot be delivered after every retry is held for diagnosis and then deleted, at the latest 48 hours after the last attempt. After that only the record of the failure remains, which contains no personal data.
• Checkout identity records (advertising identifiers and consent state, keyed by checkout token — section 3.3): 72 hours from the last checkout event, removed by a daily clean-up and therefore gone at the latest 96 hours after it. Deleted immediately when the App is uninstalled.
• Delivery log (which event went where, and whether it succeeded): 45 days.
• Error diagnostics (which request to the App failed, for which store, and why — no shopper data): 30 days, and removed on shop redact.
• Aggregated counters that contain no personal data: 13 months.
• Database backups: 7 days.

9. Data subject requests

Shoppers should address their requests to the merchant, who is the controller of their data. We respond to Shopify's customers/data_request, customers/redact andshop/redact webhooks, and we assist the merchant in fulfilling access, correction, deletion, restriction and portability requests.

10. Security

• All traffic is served over HTTPS.
• Requests from Shopify — webhooks and app proxy calls — are verified with HMAC signatures before any data is processed.
• The database is encrypted at rest and reachable only from allow-listed network addresses.
• Advertising platform credentials are additionally encrypted by the application itself (AES-256-GCM) with a key that is stored separately from the database, so that a copy of the database alone does not expose them. Decryption happens only at the moment an event is delivered, on our servers; the credentials are never sent to the browser.
• Access to production systems is limited to the operator of the service.
• Our incident response procedure is documented, and we notify affected merchants without undue delay.

11. Changes

When what the App does with data changes, this policy is updated at the same time. The date at the top reflects the most recent change.

12. Contact

For questions about this Privacy Policy, or to exercise a right, contact us at support@tomify.it.