Privacy Policy

Effective date: August 20, 2026 · TrueTrack is a product of Gaia Interactive Projects Ltd ("we", "us")

TrueTrack is a conversion-tracking application for Shopify stores. It helps merchants deliver their store's sales and browsing events to advertising and analytics platforms the merchant already uses (Meta, Google Analytics 4, TikTok). This policy explains what data we handle, why, and what your rights are.

Two kinds of people, two roles

Merchants (the store owners who install TrueTrack): for your account data, we are the data controller.
Shoppers (customers of those stores): we process a limited set of your data on the merchant's behalf and instructions, as a data processor. The merchant's own privacy policy governs that processing.

What we process for merchants

Store identifiers (your myshopify.com domain), app settings, and subscription status.
Contact email, if you provide one for alerts.
Credentials you connect (e.g. a Meta access token) — stored encrypted (AES-256-GCM) and used only to send your events to that platform.

What we process about shoppers — and how we minimize it

Browsing events (page views, product views, carts, checkouts) collected by a Shopify Web Pixel that runs only after the shopper grants consent, as enforced by Shopify's Customer Privacy API.
Order events received from Shopify's webhooks (order total, currency, product IDs).
Hashed identifiers: shopper email addresses and phone numbers are SHA-256 hashed immediately on receipt. Raw email addresses and phone numbers are never stored in our database.
Technical data: IP address, browser user-agent, and ad-click identifiers (e.g. fbclid) — used solely to improve conversion matching on the merchant's ad platforms.

Why (legal bases)

To provide the service the merchant contracted for: delivering conversion events to the merchant's own ad and analytics platforms (performance of contract; the merchant's instructions).
To alert merchants when their tracking breaks, and to bill through Shopify (legitimate interest / contract).

Where data goes

Only to platforms the merchant explicitly connects: Meta (Conversions API), Google (GA4 Measurement Protocol), TikTok (Events API) — plus Shopify itself, our cloud infrastructure providers, and our email delivery provider (for merchant alerts). We never sell data, never share it with data brokers, and never use shopper data for our own marketing.

Retention & deletion

Browsing events: deleted automatically after 90 days.
Uninstalling TrueTrack stops all processing immediately; all store data is purged within 48 hours (via Shopify's shop-redact process).
Shopper deletion requests submitted through Shopify (customer redact) are honored automatically: hashed identifiers are erased and related events deleted.
You can also email us for deletion at any time — see below.

Security

Data in transit is encrypted with TLS. Connected-platform credentials are encrypted at rest. Personal identifiers are stored hashed (SHA-256), not in raw form. Access is restricted to what operating the service requires.

Your rights

Depending on where you live (e.g. GDPR in the EU/EEA/UK, CCPA in California), you may have the rights of access, correction, deletion, portability and objection. Shoppers should direct requests to the merchant they purchased from (the controller); we support merchants in fulfilling them. Merchants can contact us directly.

Changes & contact

We'll post updates to this page with a new effective date. Questions or requests: support@gettruetrack.com.

Gaia Interactive Projects Ltd, Israel.