Retrics
Start free · 14 days

GEO · DATA & PRIVACY APPENDIX

What Geo
reads, and why.

The company policies below apply to everything Retrics runs. This page is the part that is specific to this product — the data it touches, and who else sees it.
All policies →About Geo →
LIVE
GeoLIVE
RUNS ONgeo.retrics.ai
CUSTOMER GRAPHOutside the shared graph
DATA FLOW DECLAREDYes

THIS PAGE IS THE URL THIS PRODUCT’S APP LISTING SUBMITS

WHERE IT STANDS

Installable and billable today.

THE DATA FLOW

Five questions, answered plainly.

WHAT IT READS
  • The visitor's country, region and city, from the request headers at the edge — never an IP address at rest
  • The visitor's IP transiently, and only where the merchant has written an IP or CIDR range into a rule — matched, then discarded
  • The order total at checkout, from Shopify's web pixel, to attribute revenue to the redirect that earned it
WHAT IT STORES
  • Redirect, banner and locator rules the merchant configures
  • One row per storefront visit: a random browser-generated id, the country decided on, the page, which rule fired, and a device class
  • Locator searches: the city or ZIP typed, and an origin rounded to about 11 km
  • Aggregate daily counts per country — the numbers the dashboard is drawn from
HOW IT IS PROTECTED
  • Shopify access tokens are encrypted with AES-256-GCM before they are stored — never written down in plain text
  • No table has a column for a visitor's IP address. The one column holding addresses holds the ranges a merchant types into a rule
  • A locator origin is rounded to about 11 km before it reaches the database, not on the way out — there is no precise coordinate stored to leak later
  • The visitor id is a random string the storefront generates in the shopper's own browser; it is not derived from an address, an email or an account
HOW LONG IT IS KEPT
  • Analytics rows and locator searches are deleted after 30 days, one year or two years, following the merchant's plan
  • A sweep runs nightly across every shop, including dormant ones with no traffic to trigger the ordinary cleanup — verified switched on in production
  • Per-country daily counts carry no personal data and are deliberately kept, because they are what the long windows sell
WHO ELSE SEES IT
  • OpenStreetMap receives the city or ZIP a shopper types into the store locator, forwarded by Retrics — it never sees the shopper's IP or browser
  • Anthropic receives merchant-written text only: a banner message to translate, and a store-list spreadsheet's header and one sample row when importing locations
  • No advertising platform receives anything from Geo

AND THE COMPANY POLICIES IT SITS UNDER

These apply to everything Retrics runs.

They are linked rather than repeated here. Twelve copies of the same policy is twelve things that drift apart.

Privacy →Subprocessors →Data processing addendum →Data rights →Data deletion →Security →Terms of service →

THIS APPENDIX IS MAINTAINED WITH THE PRODUCT · EDITING IT CHANGES NOTHING ELSE