Tag Magic ("we", "our", or "the app") is a Shopify application operated by Whatever DTC. This privacy policy explains what data Tag Magic accesses, how it is used, and how it is protected.
1. What data does Tag Magic access?
Storefront visitor data
When a visitor arrives at your store through a URL containing parameters (such as UTM tags), the Tag Magic theme extension captures those URL parameters. Specifically:
- URL parameters — such as
utm_source,utm_medium,utm_campaign,utm_content,utm_term, and any custom parameters you configure. - Referrer URL — the page the visitor came from (if available).
- Landing page URL — the first page the visitor landed on.
These values are stored temporarily in the visitor's browser using localStorage. They are not transmitted to any external server. When the visitor adds an item to their cart, the values are written to Shopify cart attributes so they become part of the order.
Order data
When an order is placed, Tag Magic reads the order's note attributes (specifically those prefixed with tag_magic_) and the order's existing tags. Tag Magic then writes tags to the order and, if enabled, to the associated customer record. Tag Magic accesses:
- Order ID, name, creation date, tags, and note attributes
- Customer ID and tags (for customer tagging)
Store configuration
Tag Magic stores your app settings (such as which parameters to capture, whether customer tagging is enabled, and your billing plan status) in a secure database. This configuration data does not include any customer personal information.
2. How is data used?
Tag Magic uses the accessed data solely to:
- Apply tags to orders and customers based on URL parameters captured during the shopping session.
- Display tagging activity and status in the app's admin dashboard.
- Reconcile any orders that may have been missed due to temporary service interruptions.
- Provide analytics about your tagging activity (orders tagged, top tags, etc.).
3. Data storage and security
- URL parameters are stored in the visitor's browser (
localStorage) and then in Shopify's cart/order system. Tag Magic does not maintain a separate copy of this data. - Store configuration (settings, plan status) is stored in MongoDB Atlas, a SOC 2-compliant cloud database, with encryption at rest and in transit.
- Order and customer tags are written directly to Shopify via the Shopify Admin API. Tag Magic does not store copies of order or customer data outside of Shopify.
- Sessions are stored securely in MongoDB using Shopify's official session storage mechanism.
4. Third-party data sharing
Tag Magic does not share, sell, or transmit your data to any third parties. All tagging data remains within your Shopify store. The only external service used is MongoDB Atlas for storing app configuration and session data (no personal customer information is stored there).
5. Cookies and tracking
Tag Magic does not set any cookies. The app uses browser localStorage to temporarily store URL parameters during a visitor's shopping session. This data is only used to tag the resulting order and is not used for cross-site tracking or advertising.
6. GDPR and data protection compliance
Tag Magic complies with GDPR and Shopify's data protection requirements:
- Customer data request — When a customer requests their data, Tag Magic responds with any stored data associated with that customer (store configuration only; Tag Magic does not store separate customer PII).
- Customer data erasure — When a customer requests data deletion, Tag Magic confirms deletion. Since Tag Magic does not store customer PII outside of Shopify, the order/customer tags within Shopify are managed through Shopify's own data controls.
- Shop data erasure — When a merchant uninstalls Tag Magic, all store configuration data is permanently deleted from our database within 48 hours.
7. Data retention
- Browser localStorage — URL parameters are stored until the browser storage is cleared or the data expires.
- Order/customer tags — Tags applied to Shopify orders and customers persist as part of your Shopify store data. These are managed through Shopify's admin and are not controlled by Tag Magic after application.
- Store configuration — Retained while the app is installed. Deleted within 48 hours of uninstallation.
8. Your rights
As a merchant, you can:
- View all tags applied by Tag Magic in the app's Logs page.
- Remove any tags from orders or customers through Shopify's admin interface.
- Disable order tagging, customer tagging, or both in the app's Settings page.
- Uninstall the app at any time, which stops all tagging activity and triggers deletion of stored configuration data.
9. Changes to this policy
We may update this privacy policy from time to time. Changes will be posted on this page with an updated "Last updated" date. Continued use of the app after changes constitutes acceptance of the updated policy.
10. Contact us
If you have questions about this privacy policy or how Tag Magic handles data, please contact us at support@tagmagic.app.