Privacy policy
Last updated: 30 September 2026
In short
CommerceTrace does not read anything about your customers. It reads order numbers and amounts, never the people behind them — no names, email addresses, phone numbers or shipping addresses, because those fields are not part of the query it sends to Shopify.
The personal data it does hold is about you: the email address you sign in with. Order numbers are treated as personal data too, because Shopify can link one back to a person even though we cannot.
If you use Share with developer, the link you create shows the order numbers, totals, dates and transaction IDs of the orders missing from Google Analytics, to anyone who has the link. It has no customer names or emails, it cannot be guessed, and it stops working on the date shown when you create it.
Audit data is not kept beyond 90 days. Your store's security log (who connected, shared or deleted what) is kept for 180 days. We delete everything sooner if you ask.
This policy explains what CommerceTrace accesses when you connect a Shopify store and a Google Analytics property, why each item is accessed, how it is stored, how long it is kept, and how to have it deleted.
1. Who we are
CommerceTrace (“we”, “the service”) is operated from Romania by the independent developer of the service, who is the data controller for the personal data described in this policy.
For privacy questions, deletion requests, or to identify the controller for a formal request, contact contact@commercetrace.com. We respond to identification requests from data subjects and supervisory authorities.
2. What the service does
CommerceTrace compares the orders in your Shopify store against the purchase events your Google Analytics 4 property received, in order to identify orders that are missing, duplicated, or recorded with the wrong value or currency. To do this it needs read access to your Shopify orders and read access to your GA4 reporting data. It does not write to either system.
3. Shopify data we access
We request the read_orders scope only. The Shopify client issues read queries
exclusively; there is no write operation anywhere in the code.
| Data | Why we need it | Stored? |
|---|---|---|
| Order number and order ID | The key used to match a Shopify order to a GA4 transaction, and to show you which order a finding concerns | Yes |
| Confirmation number | GA4 sometimes stores this instead of the order number, so it is an additional match candidate | Yes |
| Order creation time | Determining whether GA4 has had time to process the order, and grouping related failures | Yes |
| Subtotal, total, tax, shipping, discounts, duties, tips | The value comparison itself, and distinguishing a genuine mismatch from a total-versus-subtotal error | Yes |
| Presentment and shop currency | Comparing against the currency the customer was actually charged, not your store's home currency | Yes |
| Test, cancelled, and financial status flags | Excluding test orders on live stores, and cancelled orders, so they are not reported as tracking faults. On a development store, test orders are checked like real ones | Yes |
| Line items: product name, SKU, quantity, price | Item-level reconciliation and detecting purchases that arrive with an empty item list | Yes |
| Sales channel, the name of the app that created the order, and payment gateway names | Setting aside orders that are expected to be missing from GA4, such as point-of-sale sales, subscription renewals and orders marked paid by hand, instead of reporting them as tracking faults | Yes |
| Customer name, email, phone, address | Not requested. The query does not ask for these fields | No |
3.1 What Shopify's install screen and App Store listing say
Shopify describes the access an app requests with its own categories. For CommerceTrace they read “Orders”, “Store owner” and “Device and activity data”. In plain terms:
- Orders is the table above: order totals, dates, line items and the flags listed.
- Store owner is the staff or collaborator account you open the app with. Shopify tells us its user ID, its email address, whether Shopify has verified that address, and whether it is the store owner or a collaborator. We use it to sign you in and to link your verified email address to the store. See section 6. It is about you as a user of the store's admin, not about your customers.
- Device and activity data: we do not request or store any information about your shoppers' devices or activity, such as an IP address, browser or user agent, location, or browsing history. The order query asks for none of these fields. The only device-like value in the service is the “sales channel” of an order, for example “Point of Sale” or “Online Store”, which describes where the order was placed, not who placed it.
Because no customer contact or address fields are requested, the service operates at Shopify's protected customer data Level 1. Shopify still classes orders themselves as protected customer data, and those obligations apply.
4. Google user data we access
4.1 What we request
When you connect Google Analytics, we request a single OAuth scope:
https://www.googleapis.com/auth/analytics.readonly. This is read-only. We do
not request permission to modify your Analytics configuration, manage users, or access any
other Google service.
4.2 What we read with it
We run aggregate reports through the Google Analytics Data API. The dimensions requested
are transactionId, dateHour, and currencyCode, with
purchase revenue, tax, shipping, and event-count metrics. The report is filtered to the
purchase event only. We also use the Google Analytics Admin API's
accountSummaries.list method to read account and property display names so you
can choose the correct property without entering an identifier from memory.
No user-level dimensions are requested. We do not read user IDs, client IDs, device information, or geographic data through this API.
4.3 How we use it
Solely to compare against your Shopify orders and produce the findings shown in your dashboard. Google user data is not used for advertising, sold, transferred to third parties for their own purposes, used to train machine-learning models, or used to build any profile of you or your customers.
4.4 Limited Use disclosure
CommerceTrace's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
4.5 How your Google authorisation is stored
Connecting Google Analytics produces a refresh token, which lets the service read your reports for scheduled comparisons without asking you to sign in each time. That token is encrypted at rest with AES-256-GCM, bound cryptographically to your store so it cannot be used in another account's context, and is never written to logs.
You can disconnect at any time. The service immediately deletes its stored connection and sends Google a request to revoke the token. You can also revoke access directly at myaccount.google.com/permissions. Removing the stored connection immediately stops CommerceTrace from making further requests.
5. Free public audit data
You can run the free funnel check without an account. For that check we process the storefront domain, the requesting IP address, the selected public product path, and the three funnel verdicts. The IP address and domain are used to enforce abuse limits. The browser may temporarily observe public page and analytics-request data while producing the verdict, but the raw browser artifacts are deleted when the job finishes.
If you ask us to email you the result, we use the address you type to send that one email, through Resend, and do not store it or add it to any list. To stop misuse, we keep a short-lived count of sends per address (one day) and per visitor (one hour) in memory.
Audit progress and results (the storefront domain, the funnel verdicts, and any error) are kept for 24 hours, so a check survives our own restarts, and are then deleted. The requesting IP address is not stored with them. Rate-limit records are kept for one hour. If a store asks to opt out, its domain and active opt-out state are kept until the store asks us to remove that block.
6. Account data
We store the email address you sign in with, in order to send sign-in links and to identify your account. Sign-in links are single-use, expire after 15 minutes, and are stored as a hash rather than in a form that could be reused.
When you open a sign-in link we record your account: the address, when you first and last signed in, and whether you had connected a store. We use it to tell you when you can connect your store and to keep your account between visits. We do not use it for advertising. Email contact@commercetrace.com to have your account record deleted.
Answering a feedback question is always optional. When you answer, we store your choices and anything you type, together with the audit it is about: whether it finished, the error if it failed, how long it took, and whether Shopify and Google Analytics were connected. After the free storefront check, we store what that check saw instead. We store your email address with an answer only when you signed in by email or ticked that we may contact you. Answers are read by the CommerceTrace team to fix problems and decide what to build. When a store's data is deleted, its answers are kept without the store, the email address or the audit details.
Fourteen days after your first completed audit, and at most every 75 days after that, we may email you one question about CommerceTrace. Every such email has a link that stops them.
When you open CommerceTrace from a store's Shopify Admin, Shopify tells us which staff or collaborator account you are using: its Shopify user ID, its email address and whether Shopify has verified that address, and whether it is the store owner or a collaborator. We store that link between your verified email address and the store, so that a sign-in link can open every store you work on and you can switch between them. We store it only when Shopify has verified the address. It stops granting access 30 days after you last opened CommerceTrace from that store, and it is deleted with the store's data when the app is uninstalled or you delete that store's data. This is data about you as a user of the store's admin, never about the store's customers.
7. What we do not collect
- Customer names, email addresses, phone numbers, or shipping addresses
- Shoppers' IP addresses, browsers, devices, locations or browsing history
- Payment card details — we never see them, and Shopify does not expose them to us
- User-level analytics identifiers from GA4
- Website analytics on this marketing site
8. Cookies
The application sets one cookie, holding your signed session so you stay logged in. It is
HttpOnly, SameSite=Lax, and marked Secure over HTTPS.
It is strictly necessary for the service to function and is not used for tracking or
advertising.
9. Where data is stored and who can access it
Data is currently stored on servers operated by Railway in the United States (US West). Access is limited to the operator of the service, and only for operating and supporting it.
Third parties that process data on our behalf:
- Railway — hosting and database, United States region
- Resend — delivery of sign-in emails, alerts and free-check results you ask for
- Google — the Analytics Data API, which is the source of the analytics data being compared
10. How long we keep it
Order and analytics data collected for a comparison is retained for 90 days and then deleted, along with the findings derived from it. Ninety days is long enough to compare against a previous period and to detect a regression, and short enough that we are not holding data the service does not need.
The deletion itself is implemented in software — scan runs past the window are removed along with everything attached to them: findings, evidence and trace records. We run it on a regular basis while the automatic schedule is being finished; either way no audit data is kept beyond 90 days.
Your store's security log is the one exception. It records sensitive account actions: signing in by email, connecting or disconnecting Shopify or Google Analytics, starting an audit, marking a tracking change, sharing or revoking a report link, billing changes, deleting data and refused attempts. Each entry holds the action, the time, who did it (a sign-in email or a Shopify staff ID) and the requesting IP address. It is kept for 180 days so that an owner can see who did what, then deleted. The IP address is never shown in the app.
When you close your account, or ask us to delete your data, everything associated with your store is removed regardless of age, within 30 days of the request.
11. Your rights
Depending on where you are, you may have the right to access the data we hold about you, correct it, delete it, export it, or object to its processing. To exercise any of these, contact contact@commercetrace.com. We will respond within 30 days.
You can delete most data yourself: disconnecting Google Analytics clears the stored connection and asks Google to revoke the token, and closing your account removes the stored orders and findings.
12. Data deletion requests
To request deletion of everything associated with your account, email contact@commercetrace.com from the address you signed up with, with the subject “Delete my data”. We will confirm once it is done. You can also do it yourself, step by step, on the data deletion page.
13. Security
- All traffic is served over HTTPS
- Google refresh tokens are encrypted at rest with AES-256-GCM and bound to their store
- Credentials are never written to logs; error output is redacted before being recorded
- Every request is scoped to your own store, and access to another store's data is refused rather than filtered
- The service holds read-only access and cannot modify your store or your Analytics property
No system is perfectly secure, and we do not claim otherwise.
14. Children
The service is a business tool and is not directed at children under 16.
15. Changes to this policy
If we change this policy we will update the date above, and for material changes we will notify account holders by email before the change takes effect.
16. Contact
contact@commercetrace.com
CommerceTrace — operated from Romania