Privacy Policy of GOM Tools for Shopify

Privacy Policy

GOM Tools for Shopify (the “App”) is a Shopify app by GOM Network that adds WhatsApp buttons and forms to a store, saves the contacts they receive and measures visits, campaigns and sales. This policy explains what data the App processes, why, who it is shared with and how to exercise your rights. The App runs at https://gom-tools-sfy.gomnetwork.com and is used from the Shopify admin.

Who is responsible

For the merchant’s own data (store and settings), GOM Network is the controller. For the data of the store’s visitors and customers, the merchant is the controller and GOM Network processes it on the merchant’s behalf, only to provide the App. Contact: info@gomnetwork.com.

Data we process

• Store data: the store’s Shopify domain, the access token Shopify issues to the App (stored encrypted), the plan, and the settings of widgets, forms, events and reports.
• Form submissions: what a visitor sends through a store form, such as name, email, phone and the fields the merchant adds. Stored encrypted. The email is also kept as a keyed hash to find the contact without decrypting it.
• Visits: only when the visitor has given analytics consent in the store, a Shopify web pixel records pages viewed, the campaign or channel the visit came from (UTM parameters, ad click IDs and the referring site), device type, cart and checkout steps, and the ID and total of an order. The visitor is identified by a pseudonymous code derived from Shopify’s browser ID with a per-store key. The App does not store IP addresses, and does not store names or emails from visits.
• Business Manager connection: if the merchant connects GOM Tools Business Manager, the connection key is stored as a hash.

The App does not read the store’s customer list through the Shopify API.

Cookies and browser storage

Only with analytics consent, the web pixel saves in the visitor’s browser the visit ID (gomt_sid, while the visit lasts) and the campaign that brought them (gomt_ft, for the merchant’s attribution window, 30 days by default). The App also remembers in the browser how many times a tracking event fired, so it is not sent twice.

Why we use it

• To show the merchant’s buttons and forms, save contacts and notify the merchant of new submissions.
• To show the merchant reports on visits, channels, campaigns, contacts and sales, and which campaign a contact or sale came from.
• To send the events the merchant configures to Google Analytics, Google Ads, Meta or Google Tag Manager, from the visitor’s browser and only with the visitor’s consent.
• To apply the merchant’s plan, which Shopify bills.

We do not sell data and do not use it for advertising of our own.

Sharing

• Shopify, which runs the store and bills the App.
• Our hosting provider, where the App’s servers and database run.
• GOM Tools Business Manager, only if the merchant connects it, to credit sales to campaigns.
• Google and Meta, only for the events and pixels the merchant configures; their own policies apply.

Retention and deletion

• Visits and events are kept according to the merchant’s plan: 30 days to 13 months. Daily totals without personal data, 14 months.
• Submissions discarded as spam: 30 days.
• Contacts and submissions: until the merchant deletes them.
• When a customer asks the store to erase their data, Shopify notifies the App and their contact and submissions are deleted.
• 48 hours after the App is uninstalled, Shopify notifies the App and all the store’s data is deleted.

Security

HTTPS on every connection; contacts, submissions and tokens encrypted at rest; keys stored as hashes; every store’s data kept separate; a database backup before every update; and the App is not indexed by search engines.

The data processing agreement with merchants is part of the Terms of Service of GOM Tools for Shopify, accepted when the App is installed.

Your rights and changes

Store visitors and customers should first contact the store, which decides about their data; we help it respond. Merchants can request access, correction or deletion by writing to info@gomnetwork.com, under Colombian Law 1581 of 2012 and other applicable laws. Changes to this policy will be published on this page with a new date.