Privacy Policy

Last updated: 23 October 2026

In short

We do not collect, receive or store your store's customer or visitor data.
For each store that installs our app, we keep only the store's Shopify domain, an access token and the plan status, so we can switch tracking on or off.
Tracking data goes to your own Google Tag Manager and server container, never to us.
We never sell or rent data. Uninstalling the app deletes what we hold.

1. Who we are

NexFeb ("NexFeb", "we", "us") makes the NexFeb GTM & DataLayer app for Shopify (the "App") and runs the website nexfeb.com. This policy explains what personal data we handle through the App, the website and our support, and why.

For the data in your store, including your customers and visitors, you, the merchant, are the controller. The App runs inside your store and sends data only to the destinations you configure.

2. Data about merchants

When you install the App, we receive and store the following from Shopify:

Data	Why we need it
Store domain (for example `yourstore.myshopify.com`)	To identify your installation
Access token issued by Shopify	To read your app subscription status and turn tracking on or off in your store
Subscription status (plan, trial, active or cancelled)	To provide the plan you chose. Billing is handled entirely by Shopify, and we never see payment details.
Messages you send to support@nexfeb.com	To answer your questions and fix problems

The App asks for no Shopify access scopes beyond what's needed to manage its own subscription and settings. It does not read your orders, products or customer records through the Shopify API.

App settings you enter in the theme editor, such as your GTM container ID and server URL, are stored by Shopify in your theme, not by us.

3. Data about your store's visitors and customers

The App's script runs in the shopper's browser on your store domain. It:

creates dataLayer events (page and product views, cart and checkout steps, purchases, sign-ups and newsletter forms) for your Google Tag Manager container;
stores first-party cookies and browser storage on your domain: a visitor ID, session information, campaign parameters (UTMs and ad click IDs) and backup copies of your existing tracking cookies, so they can be kept for the lifetime you choose;
can create one-way SHA-256 hashes of email and phone, only when the shopper has provided them (for example at checkout), to improve advertising match quality;
can, if you turn it on, save tracking IDs as hidden order attributes in your store.

None of this data is sent to NexFeb. Where it goes next is decided by your own tag configuration: Google Analytics, Google Ads, Meta, TikTok, Pinterest, Snapchat, Reddit, Microsoft, your own server-side GTM container, or other tools you choose. The optional Shopify Flow order webhooks also send to your server container, not to us.

Consent. The App supports the Shopify Customer Privacy API and Google Consent Mode v2. When consent is turned on in the App:

Google tags wait for the visitor's choice in your cookie banner;
cookies are only extended for the categories the visitor accepted;
strict mode holds all events until analytics consent is given.

You are responsible for your store's cookie banner, privacy notice and any consent your visitors must give.

4. Our website

nexfeb.com is hosted on Cloudflare. To deliver and protect the website, Cloudflare processes technical data such as IP address, browser type and the pages requested. Cloudflare may set cookies that are strictly necessary for security.

If we add analytics or marketing tools to the website, we'll update this policy and ask for your consent where the law requires it.

5. How we use data and our legal bases

To provide the App and your plan. Store domain, access token and subscription status are needed to perform our contract with you.
To provide support. We use your messages to answer you, which is part of our contract with you and in our legitimate interest.
To keep services secure and working. We use technical logs in our legitimate interest.
To meet legal obligations, for example tax or legal requests.

We do not use data for profiling, automated decisions or advertising, and we never sell or rent it.

We share data only with service providers that help us run the App and website, under their own data-protection terms:

Shopify: app platform and billing.
Cloudflare: hosting for the App's backend and the website, and storage of store tokens.
Our email provider: support emails.

We may also disclose data if the law requires it, or to protect our rights or users' safety.

7. Retention and deletion

When you uninstall the App, we delete your store's access token. When Shopify sends a shop data erasure request (shop/redact), we delete anything else we hold about the store.
Customer data requests and erasure requests from Shopify (customers/data_request, customers/redact) need no action from us, because we hold no customer data.
Support emails are kept as long as needed to help you, and then deleted, at most 24 months after the conversation ends.
Data in the shopper's browser (cookies and local storage on your domain) stays under your and the shopper's control. It expires as configured, or when the shopper clears their browser.

8. Security

We protect data in several ways:

all traffic is encrypted (HTTPS);
every request from Shopify is verified with signed tokens and webhook signatures;
store tokens are kept in access-restricted storage;
we hold as little data as possible.

No system is completely secure. If a breach affects your data, we'll inform you as the law requires.

9. Your rights

Depending on where you live (for example under the GDPR, the UK GDPR or US state laws such as the CCPA/CPRA), you may have the right to:

access the personal data we hold about you;
correct or delete it;
restrict or object to how we use it;
receive a copy of it;
complain to your data protection authority.

To use any of these rights, email support@nexfeb.com. We'll reply within 30 days.

If you are a shopper of a store that uses the App, contact that store directly: they control your data. We'll help them answer your request where we can.

10. International transfers

Our providers, such as Shopify and Cloudflare, may process data in countries other than yours, including the United States. Where required, these transfers are protected by safeguards such as the EU Standard Contractual Clauses that these providers offer.

11. Children

The App and website are for businesses and are not directed at children. We do not knowingly collect children's personal data.

12. Changes to this policy

We may update this policy when our services or the law change. The date at the top shows the latest version. If we make important changes, we'll tell merchants in the App or by email.

13. Contact

Questions about this policy or your data:
NexFeb
Email: support@nexfeb.com
Website: nexfeb.com