TayberryHow we handle your data.
To label your orders, Tayberry needs to know how sessions behaved and which order each one ended in. It never needs card numbers, and nothing is shared before we both sign a data processing agreement.
What we collect
- How a visit behaves: the timing between steps, clicks, and how fields were filled in (never what was typed)
- Browser and device characteristics
- The visitor’s IP address, to check whether the visit came from a cloud data center and which country it came from. We don’t keep it in full.
- Where the visit came from: the referring site or campaign tag, such as a link in an AI assistant’s answer
- Whether the visitor declared itself as an agent or signed its requests
- The order ID, amount and status the session ended in
- The sales channel each order came through, such as an AI assistant’s checkout
- Refunds and cancellations on those orders, and dispute outcomes if you share them
What we never collect
- Card numbers, security codes or bank details
- What customers type into form fields
- Passwords or account credentials
- Anything from your payment page
- Cookies: the tag sets none, and it doesn’t follow visitors to other sites
The three ways to join
The Shopify app is installed from a private link we send you, not from the Shopify App Store. Before you install, Shopify shows you its permissions: read access to orders, and permission to add a customer events pixel. It can’t change your theme, checkout or products, and uninstalling it removes the pixel. It shows each order’s label, with the reasons, inside your Shopify admin, starting with your last 60 days of orders. The pixel follows your Shopify customer privacy settings, so where your store asks for consent, it only runs for shoppers who allow analytics. Visits without consent aren’t measured, and the report counts how many orders that leaves unlabeled.
The Tayberry tag is one asynchronous script your developer adds directly or through a tag manager. It loads after your page, only reads, and is excluded from your payment page. If your store asks visitors for consent before analytics, the tag can run under the same consent setting. Your security team can review its code before you add it, and you can remove it at any time.
An export is a file of your holiday orders plus logs you already keep, sent over a secure upload link we provide. Nothing runs on your site.
What to send in an export
- Orders from November 27 to December 31: order ID, time, amount, currency and status, and later the refund and dispute outcome. Remove or hash names, emails and addresses first.
- Request logs you already keep from your CDN, firewall or bot-management tool, such as Cloudflare, Akamai or Fastly: time, IP address, user agent, referring page, pages requested and any bot score.
- Session data from your fraud tool, if your contract with that provider allows you to share it.
Send it by January 15, and ask your team to keep those logs now, since many tools delete them after 30 days. An export shows agents that identify themselves and agents running in cloud browsers well. Agents running inside a customer’s own browser are harder to spot without the app or tag, and the report says how many orders it couldn’t label with confidence.
Agreement first
Before you share anything, we sign a data processing agreement with you. It names exactly what is collected, where it is stored, who can access it and when it is deleted. We use your data only to show you your labels and prepare your report, and we don’t sell it. We don’t combine your data with other stores’. For any anonymous benchmark, we ask first.
Where it lives and for how long
Your store data is stored on Amazon Web Services (AWS) in the European Union, encrypted in transit and at rest. AWS is the only service that stores your store data, and we’ll tell you before adding another. Today only Idan, the founder, can access it; if that changes, your agreement says who else can. We delete it after your last dispute update unless you ask us to keep it longer. For most stores that’s in March. For travel and events, where disputes arrive later, the date is in your agreement.
Where we are today
Tayberry is a young company. We don’t have a SOC 2 report (an independent security audit) yet. What we can offer now is a short, readable tag, a clear agreement, and direct access to the person who built it. If your security team has a questionnaire, send it to contact@tayberry.xyz and we’ll answer it.