Privacy Policy

Linqol is a pixel-based analytics application for Shopify merchants. It measures how visitors move through a merchant's storefront so the merchant can understand campaign returns and conversion funnels. This policy describes what Linqol collects, how it is protected, and the rights merchants and their customers have.

What we collect

• Storefront interaction events from the merchant's own store — page views, product views, cart actions, checkout steps, searches, clicks, and form submissions — collected through a Shopify Web Pixel running in Shopify's sandboxed pixel environment.
• Event context: page URL, referrer, timestamps, an anonymous browser identifier assigned by Shopify, and order identifiers for completed purchases (used to measure conversions and returns).
• Campaign parameters present in the URL (such as utm_source and advertising click identifiers), used for attribution.

What we do NOT collect or store

• No raw IP addresses. Where a network identifier is used at all, it is one-way hashed before storage; the raw value is never written to disk.
• No raw email addresses or customer identifiers. Where present in checkout events, these are one-way hashed with versioned keys before storage.
• No payment card data, and no browsing data from outside the merchant's own storefront.

Consent

The Linqol pixel runs inside Shopify's Customer Privacy framework. It is registered as an analytics pixel, honors the store's consent settings, and does not sell data (sale_of_data is disabled). Where a store requires consent, events flow only for visitors who have given it.

Connected advertising accounts

Merchants can optionally connect their own advertising accounts (such as Google Ads or Meta) to Linqol to measure return on ad spend. When a merchant does so:

• Linqol requests read-only access to campaign, spend, and performance data for the ad accounts the merchant chooses to connect. We do not create, change, or manage ads.
• OAuth tokens for connected accounts are stored encrypted at rest, scoped to the connecting store, and used only to retrieve that merchant's own advertising data.
• Advertising data is joined only to that same merchant's storefront conversion data to compute attribution and return-on-ad-spend reporting for that merchant. It is never shared across merchants, sold, or used for any other purpose.
• Disconnecting an ad account revokes Linqol's access and deletes the stored token; uninstalling the app removes connected-account tokens and advertising data along with the rest of the store's data (see Retention).
• Use of data received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

How data is used

Event data is used solely to provide analytics to the merchant whose store produced it: traffic and funnel reporting, campaign attribution, and return-on-ad-spend measurement. Data is strictly separated by store; one merchant can never see another merchant's data. We do not sell or rent data to anyone.

GDPR & privacy requests

Linqol implements all three of Shopify's mandatory privacy webhooks, verified end-to-end:

• customers/data_request — we compile the customer's stored event rows for the merchant to pass on.
• customers/redact — for the orders Shopify names, and for every event recorded from the same browser, we clear the identifiers that link an event to a person (the browser identifier, the hashed IP address, the checkout token and the order id) and empty the event's details. The event's type and time, the page address it was recorded on and the referring page are kept, with their query string removed: only the scheme, host and path remain. For stores that also use paraGEO, events in paraGEO's event archive are not changed by Linqol's request.
• shop/redact — after an app uninstall, we delete the store's data that Linqol holds: events, aggregates, sessions, API tokens, connected-account tokens and advertising data. We keep only the record that the erasure request was carried out. For stores that also use paraGEO, Linqol additionally reads historical events from paraGEO's event archive. That archive is paraGEO's data and is not erased by Linqol's request. After every uninstall Linqol checks it for rows remaining for the store and alerts our operators if any are found.

Requests are processed automatically on receipt from Shopify; no manual action by the merchant is required.

Erasure changes past figures. Visitor counts and funnel conversion rates count distinct visitors, and attributed conversions and return on ad spend follow orders. Once a customer is erased they can no longer be counted as a visitor or linked to their orders, including in periods you have already viewed or exported, so those figures can change after an erasure. We do not keep the link to a person in order to keep a figure stable.

Retention

Event data is retained while the app is installed, to power historical reporting. Uninstalling the app triggers Shopify's shop/redact flow, which removes the store's data as described above.

Storage & security

Data is stored on infrastructure operated by Linqol with access limited to the operators of the service. Sensitive identifiers are hashed before storage with versioned keys, secrets are held in environment configuration rather than code, and all data access is authenticated and scoped per store.

Contact

Privacy questions or requests: privacy@linqol.com.

Linqol · linqol.com