GTM Kit privacy policy
Last updated: November 13, 2026
GTM Kit ("GTM Kit", "we", "us") is a Shopify app published by SpringApps, Splaiul Independentei 202m, Bucharest, 060023, Romania. This policy explains what information GTM Kit collects when a merchant installs it, how it is used, how long it is kept, and who it is shared with.
Questions about this policy or your data: amaze_apps@outlook.com.
Who is responsible for what
- Merchants (Shopify store owners who install GTM Kit): we process the store's information to provide the app.
- Shoppers (visitors and customers of a merchant's store): the merchant decides which analytics and advertising tools run on their store and is responsible for the shopper data those tools collect. GTM Kit processes shopper data only on the merchant's behalf and on their instructions, as described below. Shoppers who want to exercise their privacy rights should contact the store; Shopify forwards those requests to us and we act on them.
Information we collect from merchants
When a merchant installs and uses GTM Kit we store:
| Information | Why | How long |
|---|---|---|
| The store's Shopify address (myshopify.com domain) and the access token Shopify gives the app | To act for the store through Shopify's API | Until the app is uninstalled |
| Settings: Google Tag Manager container ID, tag and measurement IDs, ADCELL IDs, which features are on | To run the features the merchant chose | Until uninstall |
| Credentials for server-side tracking (for example a GA4 API secret, or a Google Ads connection) | To send events to the platforms the merchant connected | Encrypted; deleted immediately on uninstall |
| The plan the store is on | To check that the store has an active plan (payments are handled by Shopify, never by us) | Until uninstall |
| An email address for tracking alerts, if the merchant enters one | To tell the merchant when tracking stops working | Until uninstall or until removed |
| Daily counts of checkouts, purchases and events sent | To show the merchant that tracking works | About four months |
We read the store's contact email from Shopify only at the moment an alert is sent, and do not store it.
Information about shoppers
GTM Kit runs on the merchant's store in three ways:
- The storefront embed loads the merchant's own Google Tag Manager container and passes it shopping events (products viewed, added to cart, checkout started). Google Tag Manager and the tags in it are the merchant's: what they collect is governed by the merchant's and Google's policies. GTM Kit passes the shopper's cookie consent to Google Tag Manager (Google Consent Mode) as the store's cookie banner reports it.
- GTM Kit's checkout pixel (a Shopify web pixel) runs only for shoppers who allowed analytics. For each checkout and purchase it reports the order ID, value, currency, products, and the shopper's consent choices to GTM Kit's server.
- Server-side sending, only if the merchant switched it on: GTM Kit forwards purchases to Google Analytics 4 with the order details, the shopper's Google Analytics cookie IDs, IP address and browser user agent, and only for shoppers who allowed analytics. If the merchant connected Google Ads and turned on customer matching, GTM Kit can send Google Ads the shopper's email and phone number, hashed in the shopper's browser (never readable), and ad click IDs, only for shoppers who allowed marketing.
What we keep about shoppers:
| Information | Why | How long |
|---|---|---|
| For each tracked order: order ID, value, currency, the shopper's consent choices, and whether each platform accepted it | To count each order once and show the merchant a purchase log | 10 days |
| Event IDs | To ignore duplicate reports | 3 days |
| Results of a tracking test the merchant runs in their own browser | To show the merchant the test | 1 day |
We do not store shoppers' names, email addresses, phone numbers, postal addresses or payment details. IP addresses and user agents are passed to Google when server-side sending is on, and are not stored by us.
If the merchant uses the order comparison feature, GTM Kit reads the store's recent orders (order number, time, sales channel and total; nothing about the customer) to show how many were tracked. It does not store them.
If the merchant uses the ADCELL feature, the ADCELL script on the store's checkout sends ADCELL the order's net value, voucher codes and ADCELL's own click cookie, only for shoppers who allowed marketing.
Who we share information with
We do not sell personal information, and we do not use it for our own advertising.
We share information only with:
- Shopify, which hosts the stores and the app's extensions.
- The platforms a merchant connects: Google (Google Analytics, Google Ads) and ADCELL, as described above, and only when the merchant switches that feature on.
- Service providers that run GTM Kit: DigitalOcean (server and database hosting, Frankfurt, Germany) and Tidio (the support chat in the app's admin pages, used by merchants, not shoppers).
We may disclose information if the law requires it.
Security
Connections to GTM Kit use HTTPS. Credentials merchants save for server-side tracking are encrypted (AES-256-GCM). Shopify access tokens expire and are renewed, and Shopify accepts the app's API requests only from its own server.
Deleting data
When a merchant uninstalls GTM Kit, its tracking pixel and saved credentials are removed immediately. Shopify then asks the app to erase the store's remaining data, and we do. Shoppers' erasure requests that reach us through Shopify remove the matching orders from the purchase log. Merchants can ask us to delete their data at any time at amaze_apps@outlook.com.
Your rights
Depending on where you live, you may have the right to access, correct, delete or object to the processing of your personal information. Merchants can contact us at amaze_apps@outlook.com. Shoppers should contact the store they bought from; requests Shopify passes to us are answered within the time the law requires.
If you are in the European Economic Area, you can also complain to a data protection authority. Ours is the Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP, www.dataprotection.ro); you may also contact the authority where you live.
Changes
We will update this page when GTM Kit's handling of information changes, and change the date at the top.