Privacy policy
Last updated 16 October 2026
PromptPixel is a Shopify app that tells a store's ad platforms, starting with ChatGPT Ads, which ad clicks led to a sale. This policy explains what the app collects, why, who it is shared with and how long it is kept. It applies to merchants who install the app and to shoppers on their stores.
What we collect
From the merchant
- The store's Shopify domain and the access token Shopify gives the app when it is installed.
- The ad platform details the merchant enters, such as a ChatGPT Ads Pixel ID and Conversions API key. API keys are encrypted before they are stored.
- The app plan the store is on, as reported by Shopify.
From the store's orders
For each paid order: the order ID and number, total, currency, the products bought (product and variant IDs, names, quantities and prices) and the time of the order. We do not collect or store customers' names, email addresses, phone numbers, postal addresses or IP addresses.
From shoppers' browsers
When a shopper arrives from an ad, the link carries a click ID chosen by the ad platform (for ChatGPT Ads, the oppref parameter). PromptPixel keeps that ID so the sale can be credited to the ad:
- in a first-party cookie on the store's domain,
_promptpixel_oppref, kept for 30 days; - in a hidden attribute on the cart or order (
_promptpixel_oppref); - and, at checkout, with the address of the page (without its query string).
The click ID is a random code. It does not identify the shopper to us. If a shopper declines tracking through the store's cookie banner, PromptPixel does not collect it.
How we use it
Only to report sales to the ad platforms the merchant has connected, and to show the merchant which orders were reported. We do not sell data, build profiles of shoppers or use the data for our own advertising.
Who we share it with
- The ad platforms the merchant connects, on the merchant's instruction. For ChatGPT Ads this is OpenAI, which receives the order value, currency, products, an order event ID, the store's address and the click ID. OpenAI's own privacy policy governs what it does with that data.
- Our service providers, who store or process data for us and for no other purpose: DigitalOcean (hosting, United States) and Neon (database, United States).
- Authorities, where the law requires it.
How long we keep it
- Order events and click IDs: deleted 90 days after they are created.
- Everything we hold for a store, including its ad platform keys: deleted when Shopify tells us the store has removed the app (48 hours after uninstalling).
- When Shopify passes on a customer's request to erase their data, we delete everything we hold for the orders it lists.
Security
All traffic is encrypted in transit (HTTPS). Ad platform API keys are encrypted at rest (AES-256-GCM). Access to the servers and database is limited to the developer.
Your rights
Depending on where you live (for example under the GDPR or the CCPA), you may ask to see, correct or delete personal data held about you, or object to its use. Shoppers can ask the store they bought from, which passes requests to us through Shopify, or write to us directly. Merchants can remove the app at any time, which deletes their data as described above.
Changes
If this policy changes, the date at the top changes too. Material changes are announced to merchants in the app.