Legal

Privacy policy

Last updated: October 16, 2026

The short version

Siftraq is a measurement tool for online stores. A merchant connects a store, and Siftraq shows where its orders came from.
Signing in with Google gives Siftraq your name and email address, and nothing else from your Google account.
From a connected Shopify store, Siftraq keeps orders and the marketing visits behind them. It also keeps shoppers' names, email addresses and phone numbers, encrypted, so that the store's own team can see who a customer is; everywhere else, including the reports' data and anything an AI assistant receives, emails and phone numbers are one-way hashes. Postal addresses and payment details are not collected.
Where a store uses Siftraq's own tracking (on a Shopify store, the Siftraq app adds it when the app is installed), visits to the store's site are recorded only after the visitor has allowed analytics. A visitor's IP address is encrypted on arrival, shown to no one, and deleted within 30 days.
Connecting Google Analytics is optional. Siftraq reads the data where it already is, in the merchant's own Google Cloud project, and does not copy it.
Siftraq does not sell data, does not use it for advertising, and does not use it to train AI models.
Uninstalling the app or asking us deletes a store's data within 30 days.

1. Who we are

Siftraq is operated by Md Abdullah Al Mamun, an individual based in the United States ("Siftraq", "we", "us"). You can reach us about anything in this policy at privacy@siftraq.com.

This policy covers the Siftraq website (siftraq.com), the Siftraq web application, the Siftraq app for Shopify, and the connection Siftraq offers to AI assistants.

2. Whose data, and in what role

Two groups of people appear in Siftraq, and we stand in a different position towards each.

People who use Siftraq: merchants, their staff and the agencies that work for them. We decide how their account data is handled and are responsible for it.
A store's shoppers and visitors, whose orders and visits appear in the store's data. The merchant decides why and how that data is processed; Siftraq processes it on the merchant's behalf and on the merchant's instructions, as a service provider (a "processor"). If you are a shopper with a question about your data, the store you bought from is the right place to ask, and we help the store answer.

3. What we collect

When you sign in

Siftraq signs you in with Google. We ask Google for your basic profile only and receive:

your name and email address;
the identifier Google assigns to your account, which is how we recognise you next time;
the address of your profile picture, which is shown while you are signed in and is not kept afterwards.

Signing in does not give Siftraq access to your Gmail, Drive, Google Analytics or any other Google data, and we do not keep any Google access token from it. We also record when you first and last signed in, and which stores your account belongs to.

When a store installs the Siftraq app for Shopify

Siftraq asks Shopify for permission to read orders and customers, and stores:

About the store: its Shopify address, time zone, currency, whether it is a development store, and the access Shopify granted (kept encrypted).
About each order: its number and dates, payment and fulfilment status, the sales channel it came through, amounts (totals, tax, shipping, discounts, refunds), currency, discount codes, the items bought (title, variant, SKU, quantity, price), and whether it is a test or cancelled order.
About the visits behind an order, as Shopify records them for roughly the 30 days before the purchase: the time of the first and last visit, the landing page address, the referring address, and campaign tags and the advertising and email platforms' click identifiers (for example utm_source or gclid). Other parts of a landing page address are removed before it is stored, in the same way as the addresses Siftraq's own tracking collects (below).
About each customer: Shopify's identifier for the customer, when the record was created and changed, the number of orders and amount spent, and whether they have agreed to email or SMS marketing.
Contact details: a shopper's first and last name, from their customer record in the store, and the email address and phone number on their customer record and on each of their orders. They are kept so that the store's members can see who a customer is on the store's pages in Siftraq, and find a customer by name, email address, phone number or order number. They are stored encrypted, in Siftraq's application database and apart from the store's other data, and are shown only to the store's members. They are never written to Siftraq's analytics tables or logs and never sent to an AI assistant. To make search possible without decrypting them, Siftraq also keeps keyed fingerprints of the beginnings of the words in a name and in an email address's first part, and of the whole email address and phone number; nothing can be read back from a fingerprint.
Hashed contact details: the email address and phone number are also converted into SHA-256 hashes the moment they are received. The store's analytics data, on which its reports are worked out, holds only the hashes, which let Siftraq tell that two orders belong to the same person. Hashes are still treated as personal data.

Siftraq does not collect or store shoppers' postal addresses or payment card details. Shoppers' IP addresses are handled only as described under tracking, below.

When a store uses Siftraq's tracking on its site

A store can have Siftraq's own tracking script on its site, to record the visits that lead to its orders. On a Shopify store the script is an app pixel: the Siftraq app adds it to the store when the merchant installs and opens the app, Shopify runs it on the store's pages, checkout and order confirmation page, and it is removed when the app is uninstalled. The script does nothing until the visitor has allowed analytics through the store's privacy settings or banner (on Shopify, the store's customer privacy settings; where a store asks its visitors for no consent, Shopify reports analytics as allowed): before that, nothing is stored on the visitor's device and nothing is sent to Siftraq. If the visitor refuses or later withdraws, the script stops and removes what it stored. A visitor who has opted out of the sale or sharing of their data but has allowed analytics is still measured for the store itself; the opt-out is recorded with every event, and Siftraq does not sell or share the data in any case. For a visitor who has allowed it, Siftraq records:

What happened on the site: pages, collections and products viewed, searches of the store, items added to or removed from the cart, the steps of checkout, and the purchase (its value, currency, items and the store's order number), each with its time.
Where the visit came from: the page's address and the address of the page that linked to it. Before an address leaves the browser it is cut down: of everything after the "?", only campaign tags and the advertising and email platforms' click identifiers are kept (for example utm_source, gclid or fbclid); parts of an address that belong to one person, such as a checkout or order link, are removed. Where an email platform's mark identifies the recipient, Siftraq keeps only the fact that the mark was there.
Identifiers: a random identifier for the browser and one for the visit, which the script keeps in first-party cookies and storage on the store's own site (_sq_v, for about 13 months; _sq_s, for 30 minutes; and, briefly, events that could not yet be sent); the store platform's own identifiers for the visitor, cart, checkout, customer and order; and, when a shopper gives an email address or phone number at checkout or is signed in, a SHA-256 hash of it, made in the shopper's browser. The address or number itself is never sent to Siftraq by the script.
About the browser: its user-agent text, language and screen size, and whether the request appears to come from automated software. The user-agent text is also used to tell when a visit was made in the browser built into an app such as Instagram or TikTok, when nothing else says where the visit came from.
What the visitor allowed: the visitor's choices for analytics, marketing, preferences and sale of data at the time of each event.
The IP address, which every request carries. The country and region it points to are worked out on arrival and kept with the visit. The address itself is encrypted the moment it arrives and stored apart from everything else, together with a keyed fingerprint that lets two stored addresses be compared without reading either. It is used only as evidence that two browsers may belong to the same shopper. It is never shown in the application, to the merchant or to anyone else, and it is deleted automatically within 30 days of being recorded. The address of a request that identifies itself as automated software is not kept at all.
Which browsers are one shopper's. From the identifiers above, Siftraq works out which browsers belong to the same shopper, so that a visit can be tied to the order it led to. Where two browsers carried the same order, customer, email hash or phone hash, the same store visitor identifier, or the same cart or checkout, the link is certain, and it is worked out afresh from the stored records each time. Where the only evidence is that two browsers used the same IP address within 24 hours, on an address that no more than three browsers used, Siftraq saves a record that the two are probably the same shopper. That record holds the two random browser identifiers, the time, and how strong the evidence was. It does not hold the IP address or anything made from it, and it is kept, marked as probable, after the address itself has been deleted. A link of this kind never joins two shoppers who are each known by an order, an email address or a phone number, and it can be undone.

The script does not read what a visitor types into forms, does not record keystrokes, mouse movement or the screen, and does not build a device fingerprint. On Shopify it runs in Shopify's sandbox, which gives it no access to the page itself: the email address or phone number it hashes is the one Shopify reports for a checkout or a signed-in customer.

When a store connects Google Analytics (optional)

A member of a store can connect the store's Google Analytics 4 property. Siftraq asks Google for one permission at a time, each only when it is needed:

To connect a property: viewing Google Analytics. Siftraq lists the properties the person can see, so that they can choose one, and asks Google Analytics for the chosen property's own daily totals of purchases and purchase revenue, to show the store how they compare with its real orders. These are totals per day, not individual purchases, and are shown without being stored.
To add session and attribution reports: BigQuery. Siftraq reads the property's BigQuery export by running read-only queries inside the merchant's own Google Cloud project, and lists that Google account's Google Cloud projects when one has to be chosen. The export stays where it is. Siftraq does not copy it into its own systems, and never changes or deletes anything in BigQuery.
Only if the person asks Siftraq to set up the export for them: editing Google Analytics. Siftraq uses this once, to create the link between the property and the Google Cloud project the person picked, with a daily export (and a streaming export, if they tick it). The permission is not stored: Siftraq cannot use it again without asking again. This is the only change Siftraq ever makes in Google Analytics.

We store the permission itself (encrypted), and the chosen property's name and identifier, the Google Cloud project and location of its export, and its time zone and currency. Report pages can show members of the store visitor-level rows from that export, identified only by Google Analytics' own pseudonymous identifiers; those rows are displayed, not stored by Siftraq.

When a store connects Google Ads (optional)

An owner of a store can connect the store's Google Ads account. Siftraq asks Google for one permission, to manage Google Ads campaigns, because Google offers no permission that only reads. Siftraq only reads: it never creates, changes or deletes anything in Google Ads, and sends Google Ads nothing about the store's orders or shoppers. With the permission, Siftraq lists the Google Ads accounts the person can reach, including those under a manager account, so that they can choose one.

We store the permission itself (encrypted), and the chosen account's name and identifier, the manager account it is reached through, if any, and its currency and time zone.

Once an account is chosen, Siftraq copies from Google Ads, for the 90 days before and then each night (the last three days again, as Google corrects them), into the store's own data:

What the ads cost and did, per day: for each campaign, ad group and ad, its name and identifier, cost, impressions, clicks, and the conversions and conversion value Google Ads itself reports, in the account's currency. These are totals about ads; they contain nothing about any person.
Which ad each click came from: for each click on the store's ads, Google's click identifier (gclid), its date, and the campaign, ad group and ad it came from. A visit that arrives with that identifier can then be credited to the right ad. No name, email address, IP address or other detail about the person who clicked is in it. Because a click identifier belongs to a single click, Siftraq treats it like the other identifiers of a visitor: it stays in the store's own data, is never written to logs and is never sent to an AI assistant.

When you connect an AI assistant

You can let an AI assistant, such as Claude or ChatGPT, ask Siftraq questions about your stores. We store which assistant you connected, when, which stores you chose, and when the connection was last used. We count how many questions are asked about each store and how much data they read; we do not store the questions' content or the answers.

An AI assistant receives totals and breakdowns only (for example, orders and revenue by channel). Nothing about an individual shopper or visitor is ever sent to it. What the assistant then does with an answer is governed by that provider's own terms and privacy policy.

When you write to us through the website

The early-access and contact forms on siftraq.com send what you type to Siftraq's application, which keeps it in its database: your email address and, if you give them, your name, your website or company, which product you are interested in or what your message is about, and your message, with the time it was sent and the page of the website it was sent from. We use it only to reply to you and, for early access, to tell you when a place is ready. It is not added to a mailing list and not shared. Your IP address is used for a moment, in the server's memory, to limit how many messages one address can send, and is not stored.

Technical data

One cookie. The web application sets a single session cookie that keeps you signed in for up to 24 hours. It is necessary for the service to work. The application uses no advertising or analytics cookies; the website's analytics cookies are described under "The website", below. (The cookies Siftraq's tracking sets for a store's visitors, on the store's own site, are described above.)
Your browser's storage. To make reports open faster, the application keeps recent report results and your chosen date range in your own browser. That copy stays on your device. Pages that show shoppers' contact details keep no such copy.
Server logs. Our servers record requests and errors (time, address requested, outcome) to keep the service running and secure. Logs do not contain report results, access tokens or shoppers' details.
The website. siftraq.com is delivered through Cloudflare, which processes visitors' IP addresses to deliver pages and block abuse. It uses Google Analytics to count visits and see which pages are read and where visitors came from: Google receives the page address, the referring page, the browser, the device type and approximate location, and sets first-party cookies (_ga and _ga_ followed by an identifier, for up to 2 years) to recognise a returning browser. For visitors in the European Economic Area, the United Kingdom and Switzerland these cookies are not set and Google receives only cookieless signals. Google's advertising features (Google signals and ad personalisation) are off, nothing typed into the website's forms is sent to Google, and the application and stores' data are never sent to Google Analytics. Google keeps this data for 14 months. You can block it with your browser's cookie settings or Google's opt-out add-on.

4. What we use it for

To provide Siftraq: showing a store's orders, revenue, visits and marketing attribution, and who its customers are, to the people the store has let in, and answering the questions they ask through an AI assistant they connected.
To keep it secure and within fair limits: signing people in, checking who may see which store, limiting how often and how much can be asked.
To answer you when you write to us, and to tell you about important changes to the service.

We do not sell personal data, share it for advertising, build advertising profiles, or use it to train AI or machine-learning models.

5. Google user data

This section restates, in one place, how Siftraq handles information received from Google.

Accessed: at sign-in, your name, email address, profile picture address and Google account identifier. If a store connects Google Analytics: the list of Google Analytics properties and their BigQuery links, and the property's daily totals of purchases and revenue as Google Analytics reports them. If the store adds its BigQuery export: the list of the person's Google Cloud projects, and the contents of the export, which Siftraq queries but does not copy. If the person asks Siftraq to create the BigQuery link: the property's data streams, to include them in the link. If a store connects Google Ads: the list of Google Ads accounts the person can reach, with their names, identifiers, currencies and time zones; and, for the chosen account, its daily cost and results per campaign, ad group and ad, and which ad each click identifier came from.
Used for: signing you in, producing the store's own reports for the store's own members, and, once and on request, creating the property's BigQuery link. Nothing else.
Stored: your name, email address and Google account identifier; for a Google Analytics connection, the permission to view Google Analytics and, if given, to use BigQuery (a refresh token, encrypted), and the details of the chosen property listed above. The permission to edit Google Analytics is never stored. For a Google Ads connection, the permission to manage Google Ads campaigns (a refresh token, encrypted), used only to read, the details of the chosen account listed above, and the account's daily ad results and click identifiers, copied into the store's own data as described above.
Shared: with no one, except the infrastructure providers in section 6 who store it for us, and, as aggregated figures only, with an AI assistant that a member of the store has chosen to connect.
Deleted: disconnecting Google Analytics or Google Ads in the store's Siftraq settings deletes the stored permission immediately; the Google Ads results already copied stay with the store's other data and are deleted with it. You can also withdraw Siftraq's access at any time in your Google account, under third-party access.

Siftraq's use of information received from Google APIs, and any transfer of it to another app, adheres to the Google API Services User Data Policy, including its Limited Use requirements.

6. Who we share it with

Only with those needed to run the service, and only as far as needed:

Google Cloud (United States): stores each store's data in a separate dataset, and hosts the application and its database.
Cloudflare: delivers the website and protects the network.
Google Analytics (Google): counts visits to the website siftraq.com, as described under "The website". Not the application, and never a store's data.
Shopify: the platform the store's data comes from; Siftraq talks to it using the access the merchant granted.
AI assistants you connect: aggregated answers only, as described above.
Authorities, when the law requires it, and then only what is required.

If Siftraq is ever transferred to another operator, data would move with it under this policy, and we would tell merchants beforehand.

7. Where it is processed

Siftraq's systems are in the United States. If you use Siftraq from another country, your data is transferred to and processed in the United States.

8. How long we keep it

Data	Kept for
A store's orders, customers and visits, including what Siftraq's tracking recorded	While the app is installed. Deleted within 30 days of the app being uninstalled, or of the merchant asking.
Shoppers' contact details (name, email address, phone number)	While the app is installed, replaced when they change in the store. Deleted with the store's data, when the merchant deletes the customer in Shopify (the details from their customer record), and on a deletion request.
What you send through the website's early-access and contact forms	Up to 24 months from when it was sent, then deleted automatically; sooner if you ask.
Visitors' IP addresses	At most 30 days from when each was recorded; deleted automatically.
Records that two browsers are probably one shopper's (they contain no IP address)	As long as the store's visits are kept; deleted with them, or earlier with a shopper's data on a deletion request.
A shopper's data, when the merchant or Shopify sends a deletion request	The shopper's contact details, including those kept from their orders, their hashed contact details and their customer record are deleted; what tracking recorded from their browsers is deleted, including a browser linked to theirs only by a shared IP address, together with the records linking those browsers; the records of which ad their browsers' clicks came from are deleted; and their orders are kept as anonymous sales, within 30 days.
A store's Google Ads results (daily cost and results per ad) and the records of which ad each click came from	While the app is installed, and deleted with the store's other data. A shopper's click records are deleted with their data on a deletion request.
A Google Analytics or Google Ads connection	Until it is disconnected, or the store's data is deleted.
Your account (name, email, memberships)	Until you ask us to delete it.
Sign-in sessions	24 hours.
An AI assistant's connection	Until you disconnect it; it ends by itself after 30 days without use.
Counts of AI questions per store	90 days.
Server logs	Up to 30 days.
Visits to the website, in Google Analytics	14 months, then deleted by Google.

After deletion, copies can remain in our providers' backup and recovery storage for up to 30 more days before they are overwritten. They are not used in that time.

9. How we protect it

Connections to Siftraq are encrypted (HTTPS).
Access granted by Shopify and Google is stored encrypted, and is never shown in the application or written to logs.
Shoppers' names, email addresses and phone numbers are stored encrypted, apart from the store's other data, and are shown only to the store's members. Everywhere else, email addresses and phone numbers are hashed before storage. Visitors' IP addresses are encrypted before storage.
Each store's data is kept in its own dataset, and every request is checked against the stores the signed-in person belongs to.

No system is perfectly secure. If a breach affecting your data occurs, we will tell the affected merchants without undue delay.

10. Your choices and rights

Disconnect Google Analytics, Google Ads or an AI assistant at any time in your Siftraq settings.
Uninstall the Siftraq app from your Shopify admin to stop all collection from the store and start deletion.
Ask us for a copy of your account data, to correct it, or to delete your account, at privacy@siftraq.com. We answer within 30 days.
Shoppers: ask the store you bought from. Stores can send us access and deletion requests through Shopify, and we carry them out. A copy of a shopper's data includes what tracking recorded from the browsers that are certainly theirs. A browser linked to theirs only by a shared IP address is listed in the copy, but what it recorded is left out, because it may be another person's.
Visitors to a store's site: Siftraq's tracking follows the choice you make in the store's privacy banner or settings, and records nothing unless you allow analytics there.

Depending on where you live, the law may give you further rights, such as to object to or restrict processing, or to complain to a data protection authority. Where European or UK law applies to data for which we are responsible, we rely on our contract with you to provide the service, and on our legitimate interest in keeping it secure.

11. Children

Siftraq is a tool for businesses. It is not directed to children, and we do not knowingly collect account data from anyone under 16.

12. Changes to this policy

When this policy changes, the date at the top changes with it. If a change materially affects how data is used, we will tell account holders by email or in the application before it takes effect.

13. Contact

Md Abdullah Al Mamun, Siftraq — privacy@siftraq.com