TagRelay — Security & data protection

Last updated: 2026-09-26

Data minimization

The web pixel sends storefront events without email addresses or phone numbers.
The order webhook goes directly to the store's own tag server container. Email, phone, name and address from the order are hashed with SHA-256 in the container, in memory, before being sent to Meta, Google and TikTok.
Raw web server logs may contain the body of the order webhook, including email, phone and address. They are readable only by the administrator (files owned by root/adm, permissions 0640).
The operator panel database keeps only event and order metadata: time, path, IP address, user agent, event name, value, click identifiers (gclid, fbc/fbp, ttclid) and order ID. Personal fields (email, phone, first name, last name, address) are removed before data is written to the database.

Raw web server logs: at most 14 days, then deleted automatically.
Operator panel database (metadata): up to 30 days.
On Shopify's shop/redact request the store's panel data and app configuration are deleted and its container stays stopped.

A single administrator has access to the servers and data.
Server access requires a personal administrator account; administrative actions require elevated privileges (sudo).
Stored data and server logs are readable only by the administrator (file permissions restricted to root and the log group).

Development and testing use Shopify development stores with their own, separate tag server containers. Each production store has its own container.

Detection of the incident.
Containment and limiting its impact.
Notification of affected merchants and Shopify without undue delay, and no later than 72 hours after becoming aware of it.
Analysis of the cause and corrective actions.

There is no export of store customer data.
Customer personal fields from orders are removed before storage in the panel database; they may remain only in raw server logs with administrator-only access for at most 14 days.
Each store sees only its own data: requests from the app to the operator panel API are authorised with a per-store HMAC token.

The app and the tag server containers run on servers operated by us in the European Union (Poland).

Security questions and reports: lukasz9011@gmail.com.