Privacy policy

1. Who this policy covers

Trenvano is operated by YAOVI HENOC ODJI, trading as Trenvano, referred to below as "we" or "Trenvano".

This policy covers two groups of people:

• Merchants. Shopify store owners and their staff who install and use the app.
• Shoppers. People who buy from a store that uses Trenvano, whether they reach checkout through the Trenvano button or in any other way.

2. Who controls the data

For shopper data, the merchant is the data controller and Trenvano is a data processor acting on the merchant's instructions. The merchant decides which Google Sheets orders are written to, which columns those sheets carry, whether purchase events are sent to their advertising accounts, and how long they keep their spreadsheets. Trenvano does not decide any of that, and does not use shopper data for its own purposes.

For merchant account data, such as the shop domain, the app settings and the connected Google account, Trenvano is the controller.

Shopify is a separate controller of the store, its checkout and its orders under Shopify's own privacy policy. Google is a separate controller of the merchant's Google account under Google's own privacy policy. Meta and TikTok are separate controllers of the events they receive, as described in section 5.

3. What Trenvano does

• It shows a cash on delivery button and the merchant's offers on the storefront. A shopper picks an offer and a quantity, and the button puts those items in the Shopify cart and opens Shopify checkout. The shopper enters their details in Shopify checkout, not in anything Trenvano runs, and Shopify creates the order.
• It listens for every new order in the store, including orders from the Trenvano button, from the store's normal checkout and from other apps, and appends each one as a row in the Google Sheets the merchant's routing rules send it to.
• It records whether each delivery to each sheet succeeded, and retries the ones that did not.
• Where the merchant has added an access token for a Meta or TikTok pixel, it reports each qualifying order to that pixel as a purchase, as described in section 5.

4. Order details routed to your Google Sheets

When an order is created in the store, Shopify notifies Trenvano. Trenvano reads the order in order to build the spreadsheet row: the order number, date, total, currency, payment method and status page link, where the order came from, the name, phone number and email address on the order, the shipping address, the items ordered, the order note and the order's custom attributes. It then appends a row to each Google Sheet the merchant's rules send that order to, using the columns the merchant chose.

To apply a rule that names a collection, Trenvano asks Shopify which collections the ordered products belong to. That is product data, not shopper data.

The Trenvano button adds a few hidden attributes to the cart, which Shopify copies onto the order: a marker that the order came through the button, the offers the shopper chose, whether the shopper had allowed marketing tracking at that moment, and the Meta and TikTok browser identifiers described in section 9. These are used for the store's discount and for the purchase event in section 5. They are not written to the merchant's sheets.

This information passes through Trenvano in order to write the row. It is not saved in Trenvano's database. What Trenvano keeps about each order is a record with no contact details in it: the Shopify order identifier and number, the order total and currency, the number of items, where the order came from, the country it ships to, whether routing succeeded, and one row per destination recording the delivery attempt, its status, the number of attempts and the last error message. A delivery that is retried reads the order from Shopify again rather than working from a stored copy.

Once a row is in the merchant's spreadsheet it is the merchant's record, held in the merchant's own Google account. Trenvano does not control it, and deleting the app does not delete it.

5. Purchase events sent to Meta and TikTok

The purchase completes in Shopify checkout, where Trenvano runs no code. So that a merchant's ads can still learn which ones led to a sale, Trenvano can report the purchase from its own server once Shopify has created the order. This is off unless the merchant adds a Meta or TikTok pixel and gives Trenvano that pixel's access token. Without a token, nothing is sent from the server.

Each event goes to Meta's Conversions API or TikTok's Events API and carries:

• the order identifier, the time of the order, its value and currency, and the products and quantities ordered;
• the shopper's email address and phone number, and for Meta also their first and last name, city, region, postcode and country, each normalised and then hashed with SHA-256 before it leaves Trenvano. A hash is a one way fingerprint: the network can compare it with a hash it already holds, and cannot read the value from it. A phone number written without its country code is read as a number in the country the order ships to, and is left out when it is not a valid number;
• the shopper's IP address and browser user agent as Shopify recorded them at checkout, and the Meta or TikTok browser identifiers described in section 9. The networks require these unhashed;
• the address of the order status page.

For an order placed through the Trenvano button, the event is sent only when the shopper had allowed marketing tracking when they pressed the button. A merchant can also choose to report every order in the store. An order that did not come through the button is then sent only when the shopper accepted marketing at Shopify checkout. Test orders are never sent.

Trenvano sends each order once and keeps no copy of what it sent. The access tokens are encrypted at rest as described in section 11 and are never shown back to anyone, including the merchant. Once an event reaches Meta or TikTok, that network is an independent controller of it under its own privacy policy, and it goes to the merchant's own advertising account, not to Trenvano's.

6. Merchant and shop data

To run the app, Trenvano stores:

• The Shopify session. The shop domain, the access token Shopify issued to Trenvano, the permissions granted, and, where Shopify issues a token for an individual staff member, that person's Shopify user identifier, name and email address. This record is created and managed by Shopify's own app library.
• Shop record. The store domain, when the app was installed and uninstalled, the current plan, the subscription status and dates taken from Shopify billing.
• Settings. The button and offer settings, the tracking pixel IDs and their encrypted access tokens, the connected Google accounts, the destination spreadsheets and their column layouts, and the routing rules with their conditions.
• Operational records. The order and delivery records described in section 4.

Trenvano does not receive payment card details. Shoppers pay in Shopify checkout or on delivery, and subscriptions are charged by Shopify through the merchant's Shopify account.

7. Google account data and the access Trenvano requests

Connecting a Google account is optional and is done by the merchant. It is what allows Trenvano to write orders into spreadsheets. Trenvano requests these scopes and no others:

What is stored

For each connected account Trenvano stores the Google account identifier, the email address, the access token, the refresh token, the token expiry time, the scopes granted, the connection status and the last error reported by Google. The access token and the refresh token are encrypted before they are written to the database, using AES-256-GCM with a fresh random initialisation vector for every value and an authentication tag that is verified on decryption. The encryption key is held in the application environment and is not stored in the database. Tokens and authorisation codes are never written to application logs.

Trenvano does not read, index or copy the contents of the merchant's spreadsheets beyond what it needs to place a row correctly, and does not access any file the merchant has not chosen.

How to withdraw access

A merchant can disconnect a Google account at any time from the Google accounts section of the app. Disconnecting asks Google to revoke the grant, deletes the stored account record and both encrypted tokens, and removes the sheet destinations that depended on it along with the routing rules pointing at them. Rows already written to the spreadsheets are left alone.

A merchant can also revoke access directly at myaccount.google.com/permissions. Doing so stops Trenvano writing to their sheets, and the app will show the connection as needing to be reconnected.

Uninstalling the app does not by itself revoke the Google grant. The stored tokens are deleted when Shopify sends the shop redaction request described in section 13, but that deletion removes them from Trenvano rather than revoking them at Google. A merchant who wants the grant revoked immediately should either disconnect the account in the app before uninstalling, or revoke it at the Google page above.

8. Google API Services User Data Policy and Limited Use

Trenvano's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Google states those requirements as follows. This quotation is taken from the Google API Services User Data Policy; the policy itself is the authoritative version.

Limited Use: Your use of data obtained via the product's specified scopes must comply with the below requirements. These requirements apply to the raw data obtained from the scopes and data aggregated, anonymized, or derived from them.

1. Limit your use of data to providing or improving user-facing features that are prominent in the requesting application's user interface;
2. Transfers of data are not allowed, except:
   1. To provide or improve your appropriate access or user-facing features that are visible and prominent in the requesting application's user interface and only with the user's consent;
   2. For security purposes (for example, investigating abuse);
   3. To comply with applicable laws; or,
   4. As part of a merger, acquisition, or sale of assets of the developer after obtaining explicit prior consent from the user.
3. Don't allow humans to read the data, unless: you first obtained the user's affirmative agreement to view specific messages, files, or other data; it is necessary for security purposes (for example, investigating a bug or abuse); it is necessary to comply with applicable laws; or in the further limited circumstances set out in the policy.

In practice, this is how Trenvano meets each requirement:

• Google account data is used for one visible feature: choosing a spreadsheet and writing orders into it. That feature is the reason the app exists and is the first thing a merchant sets up.
• Trenvano does not transfer Google user data to anyone. It is not sold, rented, shared with advertisers or data brokers, or used to build any profile or model.
• No member of staff reads a merchant's Google data as a matter of course. A person would look at it only where the merchant has asked for help with a specific problem and agreed to it, where it is necessary to investigate a security issue or abuse, or where the law requires it.
• Google account data is never used for advertising of any kind, including retargeting, personalised advertising or interest-based advertising.

9. Cookies, advertising and analytics

Trenvano sets no cookies of its own on this website or on the storefront, and stores nothing in the shopper's browser storage. This website loads no analytics, no advertising tags and no tag manager. It requests one webfont stylesheet from Shopify's content delivery network.

By default the Trenvano button on a merchant's storefront communicates only with the merchant's own domain, through Shopify's cart and Shopify's app proxy, and makes no requests to any third party. The one exception is the marketing pixels described below, which a merchant switches on themselves.

Marketing pixels

A merchant can connect Meta (Facebook) pixels, TikTok pixels, or both, by entering the pixel ID in the Trenvano admin. This is off by default. When a merchant has not switched a pixel on, the storefront loads no code from Meta or TikTok and sends them nothing at all.

When a merchant does switch a pixel on, the storefront loads that network's own script from the network's servers and sends it events when a shopper views the product and when they press the button. Those events carry the product, the value and the currency. They do not carry the shopper's name, phone number or delivery address. The network sets its own cookies at that point and becomes an independent controller of the data it collects, governed by its own privacy policy rather than this one. When the shopper presses the button, the values of Meta's _fbp and _fbc cookies and TikTok's _ttp cookie, where they exist, are copied onto the order so the purchase event in section 5 can be matched to the same browser.

These browser events are sent only when the shopper's tracking consent allows it. Trenvano checks Shopify's Customer Privacy API before loading any pixel script and before sending any event, and where a shopper has declined marketing tracking, no script is loaded and no event is sent. The same consent is recorded on the order and decides whether the purchase event in section 5 is sent. Because the merchant chooses to enable a pixel and decides what to tell their shoppers about it, the merchant is responsible for their own cookie notice and for any consent their local law requires.

Shopify sets its own cookies on the storefront, in checkout and in the Shopify admin. Those are governed by Shopify's privacy policy and by the merchant's own cookie notice, not by this one.

Trenvano does not sell personal data. Trenvano does not use personal data for its own advertising, and the pixels and purchase events described above send data to the merchant's own advertising accounts, not to Trenvano's.

10. Who else processes this data

Trenvano uses a small number of service providers. It uses no analytics service and no error tracking service.

Meta and TikTok are listed because a merchant can choose to enable them. Where a merchant has not, no data reaches either of them.

Data is disclosed to no one else, except where the law requires it.

11. How data is protected

• All traffic to and from the app is over HTTPS. Calls to Shopify, Google, Meta and TikTok are server to server over TLS.
• Google access and refresh tokens, and Meta and TikTok access tokens, are encrypted at rest with AES-256-GCM, as described in section 7. A pixel access token is never sent back to the browser, so not even the merchant can read it again once saved.
• Every request from the storefront arrives through Shopify's app proxy, which signs the request. Requests that are not correctly signed are rejected.
• Every webhook from Shopify is verified against its signature before it is processed. Anything unsigned or altered is rejected.
• The link used to connect a Google account carries a signed, time-limited value that ties the consent to one shop and expires within ten minutes, so a link that leaks cannot be used to point one merchant's Google account at another merchant's shop.
• Tokens, authorisation codes and shopper contact details, hashed or not, are kept out of application logs and out of error messages. Logs record the shop domain, the order number and counts.

No system is perfectly secure. If a breach affects personal data, we will notify the affected merchants and the relevant supervisory authority as the law requires.

12. How long data is kept

Trenvano keeps data for as long as the app is installed on the store. None of what it keeps contains a shopper's name, phone number, address or email address. The order and delivery records in section 4 are kept while the shop exists so that the merchant can see their own order history and so that failed deliveries can be retried. Purchase events are sent and not kept.

When a merchant uninstalls the app, the Shopify session and its access token are deleted straight away and the shop is marked as uninstalled, which stops all routing and all purchase events. Settings are deliberately kept at that point, because merchants often uninstall and reinstall while trialling an app, and losing their configuration would mean setting everything up again.

Shopify sends a shop redaction request 48 hours after an uninstall. On receiving it, Trenvano deletes the shop record and everything attached to it: the button, offer and pixel settings, the encrypted pixel access tokens, the connected Google accounts and their encrypted tokens, the destinations, the routing rules and the order history. Nothing about that shop remains.

A merchant who wants their data deleted sooner can ask us at the address in section 18, or disconnect their Google accounts, remove their pixels and remove their destinations in the app, which deletes those records immediately.

Rows already written into a merchant's Google Sheets are the merchant's own records and are not affected by any of this. They stay in the merchant's Google account until the merchant deletes them.

13. Shopify data requests, erasure and shop redaction

Shopify requires every app to handle three privacy requests. Trenvano implements all three.

customers/data_request

Sent when a shopper asks a merchant what data an app holds about them. Trenvano holds no personal data about shoppers, so there is nothing to return. It acknowledges and records the request using the request and customer identifiers only, and the merchant answers the shopper from their own Shopify records and Google Sheets, which is where the order lives.

customers/redact

Sent when a shopper asks for their data to be erased. Trenvano holds no name, phone number, address or email address for any shopper, so there is nothing in its records to erase. Its order records hold order identifiers, totals, source, shipping country and delivery status only. The request is acknowledged and recorded using identifiers only.

Rows already appended to the merchant's Google Sheets are the merchant's own records in the merchant's own Google account, and the merchant handles those as the controller. Purchase events already sent to Meta or TikTok are held by those networks as independent controllers.

shop/redact

Sent 48 hours after a shop uninstalls the app. Trenvano deletes the shop and everything attached to it, as described in section 12.

14. Where data is processed

The Trenvano application and its database are hosted on Render in Frankfurt, Germany, which is inside the European Economic Area. Trenvano is operated from Côte d'Ivoire, so the people who run it reach that data from outside the EEA. Shopify, Google, Meta and TikTok process data on their own global infrastructure under their own terms. Where personal data leaves the European Economic Area or the United Kingdom, that transfer relies on the safeguards those providers put in place, including the standard contractual clauses where they apply.

15. Children

Trenvano is a business tool sold to Shopify merchants. It is not directed at children and we do not knowingly collect data from them. Orders are placed by whoever is buying from the merchant's store, and the merchant is responsible for who they sell to.

16. Your rights

Depending on where you live, you may have the right to ask for a copy of your personal data, to have it corrected or deleted, to object to or restrict how it is used, and to complain to a data protection authority.

If you are a shopper, please contact the store you ordered from. They hold your order, and they decide what happens to it. Trenvano will help that merchant answer you.

If you are a merchant, contact us using the details in section 18 and we will respond within 30 days.

You may complain to the Autorité de Régulation des Télécommunications/TIC de Côte d'Ivoire (ARTCI). If you are in the United Kingdom you may instead complain to the Information Commissioner's Office, and if you are elsewhere in the European Economic Area, to your own national supervisory authority.

17. Changes to this policy

If the app starts handling data in a way this policy does not describe, this page will be updated before that change goes live, and the date at the top will change with it. Where the change affects how Google account data is used, merchants will be asked to agree to the updated policy before the new use begins.

18. Contact

Questions about this policy, or about data Trenvano holds, go to: