Last updated: October 17, 2026
1. Introduction
Attribeam: Server Tracking ("the App") is a Shopify application that sends a store's conversion events (page views, product views, add to cart, checkout, purchases) server-side to the advertising, analytics and e-mail platforms the merchant connects (for example Meta, Google, TikTok, Pinterest, Microsoft, Snapchat, Reddit, OpenAI, Klaviyo and Omnisend), and shows the merchant tracking, attribution and audience reports. The merchant is the data controller; the App processes data on the merchant's behalf.
2. Data We Collect
2.1 Merchant data
- Store information (shop domain, name, currency, time zone) and app settings.
- Platform credentials the merchant enters or authorises (pixel / dataset IDs, API keys, access and refresh tokens) — encrypted at rest with AES-256-GCM.
2.2 Store visitor and customer data
- Identifiers: a first-party visitor ID, Shopify client ID, device and session IDs, cart and checkout tokens, advertising click and browser IDs (e.g. fbclid/_fbc/_fbp, gclid, ttclid/_ttp, epik, msclkid, ScCid, rdt_cid, oppref) and UTM parameters.
- Contact data when the visitor provides it to the store (checkout, account, newsletter or other forms): e-mail, phone, name, city, region, postal code, country, Shopify customer ID.
- Technical data: IP address, browser user agent, device type, pages viewed and referrer.
- Shopping events: products viewed, cart and checkout contents, order ID, value and currency, refunds.
- Consent state from Shopify's Customer Privacy API.
3. How We Use the Data
- To send conversion events to the platforms the merchant connected, so ads and e-mail flows are measured and optimised. Contact data is normalised and SHA-256 hashed before it is sent to advertising platforms; e-mail platforms (Klaviyo, Omnisend) receive the e-mail / phone the visitor gave to the store.
- To recognise returning visitors across sessions and devices (deterministically, by e-mail, phone or customer ID — no fingerprinting).
- To filter bots and the merchant's own traffic.
- To estimate the visitor's country and city from the IP address when the visitor has not given an address (merchants can turn this off). The lookup runs on our own server against a local copy of the IP Geolocation by DB-IP database (CC BY 4.0); the IP address is not sent to any other service for this.
- To e-mail the merchant when tracking stops working (for example no events, failing platform deliveries or missing orders).
- To show the merchant dashboards, attribution, journeys and segments built from their own store data.
We do not sell data, do not combine data across merchants and do not use it for our own advertising.
4. Google user data
When a merchant chooses "Connect Google", the App asks for access to the merchant's Google account with these permissions:
- Google Data Manager API (
datamanager): sends the store's conversion events (order value, click IDs such as gclid, and hashed customer contact data) to the Google Ads conversion action the merchant selects.
- Google Analytics Admin API (
analytics.edit): lists the merchant's GA4 properties and data streams so the merchant can pick one. It also creates a Measurement Protocol API secret for that stream so the App can send server-side events.
The App stores only the OAuth refresh token, encrypted with AES-256-GCM, together with the IDs the merchant selected. It does not read the merchant's ads, campaigns, reports, e-mail or any other Google data. Google data is used only to provide this feature to that merchant. It is never sold, used for advertising, shared with other merchants or third parties, or used to train AI models. People cannot read it, except with the merchant's consent for support, for security purposes, or where the law requires. The merchant can disconnect Google at any time in the App or at myaccount.google.com/permissions. The token is then deleted.
Attribeam's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
5. Consent
The App follows the store's cookie banner through Shopify's Customer Privacy API. By default, events are not sent to advertising platforms when a visitor declined marketing, and not to analytics platforms when the visitor declined analytics. Merchants can choose a stricter mode that only sends with explicit consent.
6. Data Sharing (sub-processors)
- The platforms the merchant connects (Meta, Google, TikTok, Pinterest, Microsoft, Snapchat, Reddit, OpenAI, Taboola, Outbrain, Klaviyo, Omnisend) — only for that merchant's events.
- Hetzner Online GmbH (application hosting and database, Germany, EU).
7. Data Storage and Security
Data is stored in the EU (Hetzner, Germany; encrypted backups in Finland). It is encrypted in transit (TLS) and at rest (encrypted database volume; credentials additionally AES-256-GCM). Backups are encrypted, and access to personal data is logged. Details: Security & Incident Response. The data processing terms are in our Data Processing Agreement.
8. Data Retention
- Browsing events (page and product views, cart and checkout steps): 6 months. Purchases, refunds and sign-ups: 13 months. Delivery logs: 90 days, with full request/response bodies kept for 7 days only.
- Visitor profiles and their identifiers: deleted 13 months after the visitor was last seen, once none of their events remain.
- On uninstall, access tokens are deleted immediately; all store data is deleted 48 hours later when Shopify sends the shop/redact request.
- Customer redaction requests (customers/redact) delete that customer's visitor profile, identifiers and events.
9. Your Rights (GDPR)
Store visitors and customers can exercise access, rectification and erasure rights through the merchant; the App handles Shopify's customers/data_request, customers/redact and shop/redact webhooks.
10. Contact
For privacy-related questions or data requests:
Email: info@crotechcreators.com