Privacy Policy

Effective date: April 15, 2026 Last updated: April 15, 2026

Tact ("we", "us", "our") is operated by Toni Väisänen, based in Finland. This privacy policy explains how Tact collects, uses, and protects data when a Shopify merchant installs our app and it runs on their online store.

Who is the data controller?

The merchant who installs Tact is the data controller for their store visitors' data under GDPR. Tact acts as a data processor on behalf of the merchant.

For questions about how a specific store uses Tact, contact the store owner directly. For questions about Tact as a service, contact us at [email protected].

What data we collect

Tact collects anonymous browsing events from store visitors. This includes:

• Page views and navigation paths
• Scroll depth
• Click and form interactions
• Session timing (start, duration, end)
• Cart activity (add to cart, checkout started, checkout completed)
• A first-party visitor identifier cookie (_tact_vid)

We do not collect names, email addresses, physical addresses, payment information, or any other personally identifiable information (PII).

How we use the data

We process browsing events to provide merchants with analytics about their store's visitor behavior, including:

• Conversion funnel analysis
• Friction point identification
• Visitor segmentation (e.g., high-intent, casual, returning)
• Returning visitor patterns

All processing is done in batch. We do not make real-time decisions or target individual visitors.

Cookies

Tact sets a single first-party cookie:

Cookie	Purpose	Duration
_tact_vid	Anonymous visitor identifier	Session

This cookie contains a randomly generated ID with no connection to personal identity.

Data retention

• Raw browsing events: 90 days
• Aggregated analytics: retained indefinitely (no individual visitor data)

Merchants can request deletion of all their data at any time by contacting [email protected] or by uninstalling the app.

Sub-processors

We use the following third-party services to operate Tact:

Service	Purpose	Location
Fly.io	Application hosting	EU (Frankfurt)
Neon	Database (PostgreSQL)	EU (Frankfurt)
Cloudflare	CDN, DNS, event proxy	Global
Sentry	Error monitoring	EU

Data sharing

We do not sell, rent, or share visitor data with any third party. Data is only processed by the sub-processors listed above for the sole purpose of operating the service.

Your rights under GDPR

If you are a visitor to a store using Tact, you have the right to:

• Access the data we hold about you
• Rectification of inaccurate data
• Erasure of your data ("right to be forgotten")
• Data portability in a machine-readable format
• Object to processing based on legitimate interest
• Lodge a complaint with your local data protection authority

Since we only collect anonymous data, we may not be able to identify your specific records. If you have questions, contact the store owner or reach us at [email protected].

Security

We protect data using:

• Encrypted connections (TLS) for all data in transit
• Encrypted storage at rest
• Token-based authentication for the event pipeline
• Rate limiting on event ingestion
• Access controls limited to the service operator

Changes to this policy

We may update this policy from time to time. Changes will be posted on this page with an updated "Last updated" date. Continued use of the service after changes constitutes acceptance.

Contact

Toni Väisänen Email: [email protected]