Sutyx by Tanturo

Privacy Policy

Effective October 11, 2026

Sutyx by Tanturo is operated by Ecomm Optimiser Private Limited. This policy explains how the app processes data when a merchant connects a Shopify store or another supported marketing and analytics service.

Data we process

The app may process the shop domain, order identifiers, order dates, totals, financial and fulfilment status, refunds, cancellations, product-level order data, and available attribution data such as UTM parameters, referring sites, and customer-journey events. We do not request protected customer name, email, phone, or address fields from Shopify.

The Sutyx Web Pixel and optional cart journey bridge require Shopify's permission for both analytics and marketing attribution. If either purpose is denied or unavailable, they do not create journey identifiers or send attribution events. The pixel records standard storefront and checkout steps, a random journey identifier in a first-party _sutyx_journey cookie for up to 90 days, Shopify's pseudonymous client and checkout identifiers, and validated campaign tokens (UTM values and gclid, gbraid, wbraid, and fbclid click identifiers). Before transmission, landing URLs are reduced to the HTTP(S) origin and validated campaign parameters; referrers retain only their origin. Paths, fragments, credentials, arbitrary query fields, duplicate parameters, recognizable email/phone values and free-text or oversized campaign values are discarded. Campaign labels must be non-personal machine tokens, not customer data; token validation is not a general detector of personal information. Discarded information cannot establish attribution. Sutyx does not send these events to advertising platforms.

Consent withdrawal clears queued events and the Sutyx journey cookie, prevents stale asynchronous work from restoring an identifier, and requests removal of the bridge's own cart attribute. Outstanding event requests are aborted where supported, but an event or cart write already accepted by a server cannot be undone by aborting it. A late cart write is followed by a compensating removal of the Sutyx attribute; network failures can delay that removal. Previously accepted events and derived order joins remain subject to the retention and deletion policies below. Granting permission again starts a new journey rather than replaying the denied events.

When a merchant connects advertising, analytics, checkout, or operational services, the app also processes the reporting data needed to build the merchant's funnel and calculate attribution, revenue, and return on ad spend.

How we use data

We use merchant data only to provide attribution analytics, reconcile orders and revenue, operate and secure the service, troubleshoot failures, and meet legal obligations. We do not sell customer or merchant data and do not use it to advertise to individual customers.

Storage and retention

For self-service beta workspaces, raw order reports are processed in memory. Event metadata is retained for 7 days, sync records and usage for 30 days, and reporting aggregates and privacy suppression hashes for up to 396 days. Disconnecting deletes stored access credentials immediately; workspace deletion removes its active reporting data and memberships. Encrypted recovery snapshots expire after 30 days. Deletion receipts are kept separately for 32 days and reapplied before a restored database serves customers. Your app identity may remain for your other workspaces; contact support for account deletion.

Shopify webhook signatures are verified using the request bytes in memory. Only a topic-specific subset of order/refund identifiers, dates, amounts, currency, lifecycle status and validated pseudonymous journey/checkout joins is persisted, for no more than 90 days. Customer details, free-form notes and attributes, authenticated order-status links and raw request bodies are not retained in new webhook records. Historical webhook exports are filtered through the same contract; that filtering does not itself erase historical storage or backups. Individual storefront journey events are retained for no more than 90 days; the order-to-journey attribution derived from them is retained while the merchant uses the service. Aggregated reporting data is retained while the merchant uses the service. Encrypted connection tokens are retained only while the integration remains connected. Shopify customer and shop redaction requests delete the corresponding stored webhook, connection, and derived shop data as applicable.

Security and service providers

Data is encrypted in transit using HTTPS. Access tokens and application secrets are encrypted before database storage, and access is limited to authorized services and users. The service uses Railway for application hosting and managed database infrastructure, and uses the services a merchant chooses to connect for authentication and data retrieval.

Merchant choices

Merchants control which services they connect. They can revoke a connection or uninstall the app. Requests to access, correct, export, or delete merchant data can be sent to the contact below. We also respond to Shopify's mandatory privacy webhooks.

For the Shopify dashboard, a signed customer-data request creates a durable request receipt and an export of retained records reliably linked to the requested order identifiers, including related app-held journey records. Customer contact details and raw request bodies are not saved. The authorized merchant can download the export under Customer data requests, supply it to the store owner for the requesting customer through an authorized channel, and confirm delivery. Receipt, export readiness and downloading are not proof that the customer received the data. Pending requests show their 30-day due date; merchants and our support team must follow up before that deadline. Exports expire on the webhook retention schedule (no more than 90 days); customer/shop redaction also removes these exports. Earlier requests acknowledged before this workflow was released were not recorded and require support follow-up rather than a claim of retroactive fulfillment.

International processing and changes

Data may be processed in countries where our service providers operate, subject to appropriate safeguards. We may update this policy as the service or applicable requirements change; the effective date above will be updated when we do.