Security built for
merchant trust.

1. Data Ownership

Merchants retain full ownership of their data. StoreTracker acts only as a data processor and never sells, shares, or monetizes merchant data.

2. What We Store and What We Don’t

• Order metadata including IDs, timestamps, and values
• Product and attribution data
• First-party behavioral events

We do not store payment information, credit cards, CVVs, passwords, or billing credentials.

3. First-Party, Shopify-Native Tracking

StoreTracker integrates via Shopify OAuth with read-only permissions. All tracking is first-party and merchant-owned.

4. Encryption & Secure Storage

• HTTPS / TLS encryption in transit
• Encrypted databases and backups
• Secrets stored securely outside application code

5. Access Control

Access is restricted using role-based permissions. Only authorized users can access store data.

6. Auditability & Transparency

Attribution logic, data sources, and metrics are clearly labeled in-app. Agencies can audit and explain results with confidence.

7. Data Retention & Deletion

• Merchant-initiated data deletion supported
• Automatic deletion within 30 days of uninstall
• Data deletion requests handled through verified support workflows

8. AI & Automated Insights

StoreTracker does not train shared or public AI models using merchant data. Data is processed ephemerally to generate insights.

9. Regulatory & Privacy Considerations

StoreTracker is designed around core data protection principles such as data minimization, purpose limitation, transparency, and merchant-initiated data deletion.

StoreTracker does not sell or share consumer personal data and relies on Shopify as the primary system of record for customer information. Our practices continue to evolve as regulatory requirements apply.

10. Certifications

We follow industry-standard security practices. Formal certifications are pursued based on enterprise requirements.