Privacy Policy

1. Introduction

Real Cloud Tracking ("we," "us," or "our") provides server-side tracking and marketing analytics services for Shopify merchants ("Merchants"). This Privacy Policy explains how we collect, use, share, and protect personal information in connection with our Shopify application ("App").

By installing or using the App, you agree to the practices described in this Privacy Policy.

2. Information We Collect

2.1 Information from Merchants

When you install and use the App, we collect:

• Account information: Your name, email address, and Shopify store domain.
• Configuration data: Third-party API keys and tokens you provide (e.g., Facebook Pixel IDs, Google Analytics credentials, Google Ads customer IDs, Klaviyo API keys, Google Tag Manager container IDs).
• Billing information: Subscription plan and payment history, processed through Shopify's billing system.

2.2 Information from Your Store's Customers

To provide tracking services on your behalf, our App processes the following personal data belonging to your store's end customers:

• Identity data: Full name, email address, phone number.
• Location data: Shipping and billing address (street, city, region, postal code, country), and approximate location derived from IP address.
• Device and technical data: IP address, browser type, operating system, and device information (user agent).
• Behavioral and event data: Pages viewed, products viewed, items added to cart, checkout initiations, purchases, searches, and other storefront interactions.
• Transaction data: Order values, products purchased, order history, return and refund events.
• Marketing attribution data: Facebook pixel cookies (_fbp, _fbc), UTM parameters, and other campaign identifiers.
• Customer identifiers: Shopify customer IDs and anonymized client identifiers used for event deduplication.

3. How We Use the Information

We use the information described above to:

• Provide the App's core services: Forward customer behavioral and transactional events to the third-party marketing and analytics platforms you configure (see Section 4).
• Reconcile and deduplicate events: Match server-side and client-side events to ensure accurate tracking across platforms.
• Monitor delivery health: Track whether events are successfully delivered to integrations and alert you to failures.
• Display analytics: Show you customer journey data, campaign performance, and event logs within the App.
• Manage your account: Handle authentication, billing, and support requests.
• Improve the App: Analyze aggregate, non-identifying usage patterns to improve App performance and reliability.

We do not sell personal data. We do not use customer data for our own advertising or marketing purposes.

4. How We Share Information

We share personal data only as necessary to deliver our services:

4.1 Third-Party Marketing and Analytics Platforms

When you configure an integration, we transmit relevant customer event data to the platform on your behalf. These integrations may include:

Each of these platforms has its own privacy policy and acts as an independent data controller or processor once data is transmitted to them. We encourage you to review their respective policies.

Note: Before transmitting personally identifiable information (PII) such as email addresses, phone numbers, and names to analytics platforms, we apply SHA-256 hashing in accordance with each platform's data requirements.

4.2 Infrastructure and Service Providers

We use trusted third-party infrastructure providers to operate the App:

• Fly.io – Application hosting and deployment.
• Amazon Web Services (AWS) – Email delivery for system alerts (via Amazon SES).

These providers only process data as necessary to provide their services and are bound by appropriate data protection agreements.

4.3 Legal Requirements

We may disclose information if required by law, regulation, legal process, or governmental request, or to protect the rights, property, or safety of Real Cloud Tracking, our users, or others.

5. Data Retention

• Merchant account data is retained for the duration of your subscription and deleted within 30 days of App uninstallation, unless a longer retention period is required by law.
• Customer event data (tracking events, customer profiles, marketing attribution data) is retained for up to 12 months from the date of collection, after which it is automatically deleted or anonymized.
• Session data is retained only as long as necessary to maintain your authenticated session.

You may request earlier deletion of your data by contacting us (see Section 9).

6. Data Security

We implement appropriate technical and organizational measures to protect personal data, including:

• Encryption in transit: All data is transmitted over HTTPS/TLS.
• PII hashing: Personally identifiable information (email, phone, name) is hashed using SHA-256 before being sent to third-party analytics platforms.
• Access controls: Access to production systems and data is restricted to authorized personnel.
• Backups: Data is backed up using Litestream to protect against accidental loss.

No method of electronic transmission or storage is 100% secure. While we strive to use commercially acceptable means to protect your data, we cannot guarantee absolute security.

7. Cookies and Tracking Technologies

The App's storefront tracking pixel may read first-party cookies set by third-party platforms (such as _fbp and _fbc) from your store's visitors. These cookies are set by and belong to the respective platforms (Meta, etc.) and are governed by their privacy policies. Real Cloud Tracking does not set its own cookies on end-customer browsers.

8. Merchant Responsibilities (GDPR, CCPA, and Other Regulations)

Real Cloud Tracking acts as a data processor on behalf of the Merchant, who is the data controller for their customers' personal data. As a Merchant, you are responsible for:

• Obtaining any necessary consents from your customers before enabling tracking.
• Maintaining an accurate and compliant privacy policy on your own storefront that discloses the use of server-side tracking and the third-party platforms you have configured.
• Complying with applicable data protection laws in your jurisdiction (including GDPR, CCPA/CPRA, and others).
• Responding to your customers' data subject requests (access, deletion, portability) related to data processed through the App.

Upon receiving a verified data subject deletion request that you forward to us, we will delete or anonymize the relevant customer data from our systems within 30 days.

9. Your Rights

Depending on your location, you or your customers may have rights under applicable privacy laws, including the right to:

• Access personal data we hold.
• Correct inaccurate personal data.
• Delete personal data (subject to legal retention requirements).
• Restrict or object to certain processing activities.
• Data portability – receive a copy of your data in a structured, machine-readable format.

To exercise these rights, please contact us using the information in Section 10. We will respond within 30 days.

10. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us at:

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify Merchants via the App or by email prior to the changes taking effect. Continued use of the App after the effective date constitutes acceptance of the updated policy.