Overview
Ceres Data Layering ("Ceres", "we", "our") is a Shopify application that injects GA4-compatible dataLayer tracking into your storefront via Shopify Script Tags and a Web Pixel extension. This policy explains what data we collect, how it is used, and your rights as a merchant.
Data We Collect
Merchant data
- Shop domain — your
.myshopify.com domain, used to identify your store and serve the correct tracking bundle. - OAuth session tokens — issued by Shopify during installation, stored in our database to authenticate future admin requests.
- App configuration — your GA4 Measurement ID, GTM Container ID, and the list of events you have enabled. Stored as a Shopify metafield on your shop (not in our database).
Data we do not collect
- We do not collect or store your customers' personally identifiable information (PII).
- We do not log or retain order, purchase, or payment data on our servers.
- All ecommerce event data pushed to the
dataLayer goes directly from your storefront to your own Google Analytics 4 property or Google Tag Manager account — Ceres never receives this data.
How We Use Your Data
- To authenticate your Shopify admin session and display your dashboard.
- To generate and serve the per-store JavaScript tracking bundle.
- To register and update a Shopify Script Tag on your storefront.
- To display live event logs in the app dashboard (in-memory only; not persisted).
We do not sell, rent, or share your data with third parties for marketing purposes.
Data Storage and Security
- OAuth sessions are stored in a hosted relational database. Data is encrypted in transit (TLS) and at rest per our hosting provider's standards.
- App configuration is stored as a Shopify metafield, meaning it lives within Shopify's own infrastructure and is subject to Shopify's security controls.
- Session data is deleted when you uninstall the app (via the
app/uninstalled webhook).
Third-Party Services
- Shopify — our platform provider. Your data is subject to the Shopify Privacy Policy.
- Vercel — our hosting provider. Infrastructure is subject to the Vercel Privacy Policy.
- Google Analytics 4 / Google Tag Manager — data flows from your storefront directly to your own GA4 property. Ceres does not act as an intermediary for this data.
Merchant Rights (GDPR / CCPA)
If you are located in the European Economic Area, United Kingdom, California, or another jurisdiction with applicable privacy law, you have the right to:
- Request a copy of the personal data we hold about your shop.
- Request correction of inaccurate data.
- Request deletion of your data (uninstalling the app triggers this automatically).
- Object to or restrict processing of your data.
To exercise these rights, contact us at privacy@qodespace.com.
Children's Privacy
Ceres is a business-to-business application intended for Shopify merchants. We do not knowingly collect data from individuals under the age of 18.
Changes to This Policy
We may update this policy from time to time. Significant changes will be communicated via the app dashboard. Continued use of Ceres after changes constitutes acceptance of the updated policy.