Privacy Policy

Last updated: 25 October 2026

TrackFly is a Shopify app that sends a store's storefront and checkout events to the advertising pixels the merchant connects (Meta Conversions API and TikTok Events API). It is operated by Miranda Network, S.L. (CIF B-75866194), Carretera TF-643, 21, piso 01, puerta 1 B, 38600 Granadilla de Abona, Santa Cruz de Tenerife, Spain ("we"). Contact: support@mirandanetwork.es.

Data we collect from merchants

• Your shop domain and the access token Shopify issues when you install the app, used only to run the app for your shop.
• The pixels you connect: platform, pixel ID, an optional name and test code, and the platform access token. Access tokens are stored encrypted (AES-256-GCM) and are never shown again in the app.

Data processed about your customers

When a visitor browses your store or checks out, Shopify passes TrackFly the event (for example page viewed, product viewed, added to cart, checkout started, purchase), with product IDs, value and currency, the page URL and, for purchases, the order ID. To let the ad platforms match the event to the person who saw your ad, TrackFly also forwards the identifiers those platforms ask for: email, phone, name, city, postal code and country (hashed with SHA-256 before they leave our servers, as Meta and TikTok require), the IP address and browser user agent, and the platforms' own cookies and click IDs.

These identifiers are used only to build the request to the pixels you connected, and are then discarded: we do not store customers' names, emails, phones, addresses or IP addresses. What we keep for your dashboard is the event name, value, currency, order ID, time, and whether each platform accepted it.

Consent

TrackFly follows the consent your store collects through Shopify's Customer Privacy settings. Events from visitors who haven't allowed marketing in a region where consent is required are not sent to advertising platforms. A purchase confirmed from Shopify's orders is only sent when the buyer allowed marketing during that checkout. You are responsible for showing a cookie banner where the law requires it.

Shopify permissions

• Write pixels and read customer events (write_pixels, read_customer_events): to install TrackFly's web pixel and receive storefront and checkout events.
• Read orders (read_orders): to confirm purchases from Shopify's orders, so a sale is still sent if the buyer closes the page before the thank-you page loads (only with that buyer's marketing consent).

How we use the data

• To send your store's events to the pixels you connected, and retry when a platform is temporarily unavailable.
• To show you in the app how many events were sent and accepted.
• We never sell data, use it for our own advertising, or share it with anyone other than the platforms you connected and the infrastructure providers that host the app.

Legal basis and roles

We process merchant data to perform our contract with you (providing the app). For your customers' data, you are the controller and we act as your processor, sending it to the recipients you chose (your Meta and TikTok accounts), which process it under their own terms.

Hosting and transfers

The app and its database run on cloud infrastructure providers. Where data is processed outside the European Economic Area, transfers rely on the providers' Standard Contractual Clauses.

Retention and deletion

Event records and delivery results are deleted automatically after 30 days. Order references used to count orders against your plan are deleted after 400 days. If you uninstall TrackFly, your access token is deleted immediately, and Shopify's shop/redact request (sent 48 hours after uninstall) deletes your pixels, events and deliveries. We answer Shopify's customer data requests and redaction requests; since we store no customer personal data, there is nothing to return or delete.

Your rights

You can ask us for access, correction, deletion or portability of your data, or object to its processing, by writing to support@mirandanetwork.es. You can also complain to the Spanish Data Protection Agency (aepd.es).

Security

Connections are encrypted (HTTPS), access tokens are encrypted at rest, and access to the database is restricted.

Changes

We will update this page if this policy changes and change the date above.