iTagsPrivacy Policy

This Privacy Policy describes how iTags (“the App”), operated by Xeon Apps (“we”, “us”, or “our”), collects, uses, and shares information when merchants install the App on their Shopify store.

iTags adds and removes tags on a store’s orders, products, and customers according to rules the merchant sets up — for example, tagging orders over an amount, products that are low on stock, or customers who have ordered several times. By installing or using the App, you agree to the collection and use of information as described in this policy.

When the App is installed, we access certain Shopify store data through the permissions (scopes) granted during installation, and we store the rules and settings merchants create in the App:

• Store information: your shop domain and the authentication tokens required for the App to communicate with Shopify on your behalf.
• Rules: the rules you create — name, conditions, the tags to add or remove, when tags expire, the line a rule adds to an order’s note, and the email addresses you enter for a rule’s alerts.
• Order, product, and customer information: read from Shopify each time a record is checked against your rules. Depending on the conditions you use, this includes an order’s totals, items, discounts, payment, delivery, and risk details; a product’s details, variants, prices, inventory, and sales; and a customer’s order count, amount spent, tags, marketing consent, name, email address, phone number, and addresses. The App uses these to decide whether a rule matches, and does not write them to our database.
• A record of tag changes: for each order, product, or customer the App tags, its Shopify ID, the tags the App added or removed, the rule that did it, and when. This is what the Activity page shows and what lets you undo a change.
• Runs on existing records: when you run rules on past orders, customers, or your catalog, the run’s settings, its counts, and a preview sample of the records it would change (their Shopify IDs and tags).
• Product sales totals: for rules based on sales, each product’s units sold, net sales, and returns over the periods your rules use. These totals say nothing about who bought the product.
• AI rule drafts: if you use “Draft with AI”, the sentence you write to describe the rule.
• Support: messages you send our support team.

We don’t keep your customers’ personal details. Names, email addresses, phone numbers, street addresses, and postcodes are read from Shopify only while a record is being checked, and are never stored. A tag can take its value from a record — such as the shipping country or a discount code — but the App does not allow a tag to be made from a name, email address, phone number, address line, or postcode.

We do not collect or store payment or credit card information.

We use the information we collect to:

• provide the App’s core functionality — checking orders, products, and customers against your rules when they are created or changed, on a schedule, or when you run rules on existing records, and adding or removing the tags your rules name;
• tag an order’s customer or add a line to an order’s note, when a rule is set to;
• show you what each rule changed, and undo those changes when you ask;
• email the addresses you enter when a rule changes a record’s tags;
• start workflows in Shopify Flow when the App tags an order or a product, if you use the App’s Flow triggers;
• draft a rule from your description, when you ask for one;
• respond to support requests and troubleshoot issues; and
• improve the reliability and performance of the App.

You decide which records a rule matches and which tags it adds. We process order, product, and customer data on your behalf, only to carry out those instructions.

We do not sell, rent, or trade your data, we do not use it for advertising or marketing to your customers, and we do not use it to train AI models.

Rules, the record of tag changes, runs, sales totals, and session data are stored in a secured database operated by us and hosted in the United States; personal details of your customers are not stored (see section 2). All data is transmitted over encrypted connections (HTTPS/TLS), and access to production systems is restricted to authorized personnel who need it to operate and support the App.

While we take commercially reasonable measures to protect your information, no method of transmission or storage is 100% secure, and we cannot guarantee absolute security.

We only share information in the following limited circumstances:

• AI rule drafts: when you use “Draft with AI”, your description is sent to OpenRouter, which passes it to the AI model that writes the draft, together with the list of conditions the App offers and the names of your store’s tags, vendors, product types, and metafields, so the draft can use them. No orders, products, or customers are sent. Nothing is sent unless you ask for a draft.
• The alert recipients you choose: a rule’s alert emails go to the addresses you enter for that rule. An alert names the rule, the order’s number or the product’s title, and the tags that changed; it never names a customer. Our email delivery provider receives each email in order to deliver it;
• Service providers: with infrastructure providers (cloud hosting, database, and logging services) strictly as needed to run the App;
• Shopify: data flows between the App and Shopify as required for the App to function, including the tags and note lines the App writes and the Shopify Flow triggers it sends to your own workflows; and
• Legal requirements: when required to comply with applicable law, regulation, legal process, or enforceable governmental request.

We retain your rules and the record of which tags each rule added for as long as the App is installed on your store. When you uninstall the App, we delete its access to your store immediately. Your rules and the record of tag changes are kept for 48 hours, in case you reinstall, and are then deleted with everything else of your store’s when Shopify issues the shop redact request. Shopify’s mandatory privacy webhooks cover customers too:

• Customer data requests — the only records the App keeps about a customer are the Shopify IDs of the customer and their orders, with the tags the App added or removed and the rules that did it. We hold no personal details to hand over, and provide these records to the merchant on request;
• Customer data erasure — we delete those records for the customer and their orders; and
• Shop data erasure — we delete everything we hold for the store.

Some records also expire on their own. The record of tag changes shown on the Activity page is deleted after 90 days. A run on existing records is deleted 90 days after it ends, and a preview nobody applied after one day. The descriptions you write for AI drafts are deleted after 30 days. Tags and note lines the App added stay on those records in Shopify.

Merchants can also request deletion of their data at any time by contacting us directly.

Depending on where you are located, you may have rights under data protection laws such as the GDPR (European Economic Area / United Kingdom) or the CCPA (California), including the right to:

• access the personal information we hold about you;
• request correction of inaccurate information;
• request deletion of your personal information; and
• receive a copy of your data in a portable format.

To exercise any of these rights, contact us using the details below. If you are a customer of a store using iTags, you can also direct your request to the merchant, and we will assist them in fulfilling it.

The App uses session tokens and strictly necessary cookies to authenticate merchants inside Shopify admin and keep the App working securely, and remembers the language you choose in your browser. We do not use advertising or cross-site tracking cookies, and iTags adds nothing to your online store, so your shoppers never load any of its code or cookies.

We may update this Privacy Policy from time to time to reflect changes in the App or in applicable law. When we do, we will revise the “last updated” date at the top of this page. Significant changes will be communicated to merchants through the App or by email.

If you have questions about this Privacy Policy or how your data is handled, contact us at support@xeonapp.com.