Privacy policy

Roles and contact

The Shopify merchant is the controller of customer data. EcoTraceIT, operated by servizi alle PMI, acts as processor under the merchant’s instructions. Privacy contact: mikforlani@gmail.com.

Data processed

We process shop domain, technical order and product identifiers, order display name, weight, product category, country, the first two postal-code characters, carrier, CO₂e estimates, packaging suggestions and the Carbon Neutral choice.

• We do not retain customer names, email addresses or phone numbers.
• We do not retain full addresses.
• Merchant authentication data is held in protected Shopify sessions.

Purposes

Data is used for environmental estimates, packaging guidance, aggregate reporting, requested offsets, security, abuse prevention and support. We do not sell data, run behavioural advertising or make decisions with legal effects on individuals.

Retention and deletion

Aggregates remain available while the app is installed and while needed for merchant reporting. Shopify data-request, customer-redaction and shop-redaction webhooks are handled; uninstall and shop/redact remove the shop’s sessions, settings, aggregates and webhook receipts.

Providers and transfers

We use Shopify for the platform, Vercel for hosting and technical logs, and Neon for PostgreSQL. Optional routing, carbon or offset providers receive only minimised weight and location data, without direct identifiers. See the Subprocessors page for the current list.

Security and rights

Data is encrypted in transit, protected at rest by our providers and restricted by least privilege. Customers exercise their rights through the merchant; merchants and authorities can contact us at the address above.