Privacy Policy

Last updated: 27 October 2026. Tilltrend is pre-launch: this policy describes how Tilltrend handles data for merchants who connect their store.

Tilltrend is an analytics app for Shopify. For the data inside your store, the person who operates Tilltrend acts as a data processor on your behalf: you are the controller of your customers' personal data, and Tilltrend processes it only to provide the analytics you ask for. We wrote this the same way we built the product: plainly, with no claims we can't stand behind.

The roles, stated plainly

Data-protection law assigns specific roles, and we want them to be unambiguous:

• You, the merchant, are the controller. You decide why and how the personal data in your store is processed.
• The person who operates Tilltrend is the processor. We process that personal data only on your documented instructions, to provide the service.
• Your customers are the data subjects: the people whose personal data (names, contact details, order history) may sit in your store.

Note the distinction: the app itself is not the processor. Tilltrend is software; the processor is the person who operates Tilltrend (identified below). The controller and that processor are bound by a Data Processing Agreement (DPA), which governs the details of how we process personal data on your behalf.

Who we are

The person who operates Tilltrend is the data processor for your store data:

• Name: Vladimir Vukojičić
• Location: Belgrade, Serbia
• Contact email: contact@tilltrend.app

We read messages ourselves.

What we access and process

• Shopify store data you authorize: orders, products, and customer records, read through the Shopify API under the scopes you approve when you install the app. This can include personal data about your customers (names, contact details, order history) that lives in your store.
• Account & install details: your store domain, the access token issued by Shopify at install, and your contact email.
• Billing: handled entirely through Shopify's Billing API. We see your subscription status, not your card details.
• Operational logs: requests, errors, and timestamps needed to run, secure, and debug the service.

How we use it

• To build your governed metrics, answer your questions in the app, and prepare the data exports you request.
• To operate, secure, support, and improve the service.
• To bill you for the plan you chose (via Shopify).

We process this personal data only on your documented instructions as the controller, including any instruction to transfer it to another country or international organisation, unless we are required to act otherwise by a law that applies to us. We do not sell your data, and we do not use one merchant's data to serve another. If we ever determined the purposes and means of processing personal data ourselves, we would become a controller for that processing and take on the corresponding obligations; this policy describes us acting only as your processor.

AI processing (the honest detail)

Tilltrend's Ask feature uses a third-party AI provider (Anthropic) to interpret your question and phrase the answer. The model never receives your database credentials and does not author queries; the governed metric and its SQL live in Tilltrend, and the model cannot retrieve anything on its own.

Two things are sent to Anthropic's API. First, the question you type, exactly as you type it: we do not filter or edit it, so please do not put a customer's personal details into it. Second, if you ask for a written interpretation of an answer, the results of the governed query behind it. Those results can include one row per customer (a pseudonymous customer identifier, country, and that customer's order count and spend), for example when you ask about your highest-value customers.

No direct identifier is ever sent. No governed metric returns a name, email address, phone number, postal address or date of birth, so none of those can reach the model through an answer. Anthropic processes what it does receive under its commercial API terms and does not use it to train its models. We will tell you here before that materially changes.

Sub-processors

• Shopify: the platform your store and billing run on.
• Anthropic (United States): the AI provider behind the Ask feature. Receives the question you type and, when you ask for an interpretation, the governed query results behind the answer, which can include per-customer rows. Never a direct identifier. See "AI processing" above.
• Hetzner Online GmbH (Germany): cloud hosting; the Tilltrend service runs on Hetzner infrastructure in the EU (Falkenstein, Germany).
• Neon: managed Postgres; your analytics warehouse is stored in Neon's eu-central-1 region (Frankfurt, Germany, on AWS infrastructure).
• Cloudflare: network edge; traffic between your browser or store and the app passes through Cloudflare's network (DNS, TLS, and tunnel).

We keep this list current and will note material changes on this page. The DPA sets out how we engage sub-processors, your right to be notified and to object, and the flow-down of our obligations to them.

Cross-border transfers

The Tilltrend service and your analytics warehouse are hosted in Germany (EU). The Ask feature sends the question you type and, when you ask for an interpretation, the results of the governed query behind the answer (which can include per-customer rows) to Anthropic in the United States. Because we are established in Serbia and you or your customers may be elsewhere, providing the service can involve cross-border transfers of personal data. We carry out such transfers only on your instructions as controller and where appropriate safeguards are in place, as described in the DPA.

How long we keep it

We retain your store data while the app is installed. When you uninstall, we deprovision your tenant and delete the warehouse built from your store. On the public Tilltrend app from the Shopify App Store, Shopify sends a shop/redact request after you uninstall and the deletion runs when we receive it, without anyone having to ask. Design-partner stores run on a private, single-store app, which is subscribed to the same request. On either app you can also ask us to delete at any time, including after you have uninstalled, and we will run the same deletion by hand and confirm to you when it is done. When a customer exercises a deletion right, Shopify sends customers/redact, which we honor; because your analytics are rebuilt from your store, a customer removed at the source falls out of Tilltrend on the next sync. On termination, we delete or return all personal data and all copies on your decision as controller, unless a law that applies to us requires us to retain it.

Your rights, and your customers' rights

Depending on where you and your customers live (for example, under GDPR or your local data-protection law), you may have rights to access, correct, export, or delete personal data. Requests from your customers flow through Shopify's mandatory privacy webhooks (customers/data_request, customers/redact, shop/redact), which Tilltrend implements. For your own account data, email us and we'll act on verified requests.

How the law applies (ZZPL & GDPR)

The person who operates Tilltrend is established in Serbia, so the Serbian Law on Personal Data Protection (ZZPL) is our home regime. Where you, the merchant, or your customers are in the EU, GDPR Art. 28 applies to us as your processor, alongside the ZZPL. The DPA reflects these processor obligations.

Security

We limit access to your data and credentials to what's needed to run the service. Concretely, today: the access tokens and connected credentials issued at install are encrypted at rest; analytics and BI connections use a read-only, least-privilege database role; the authenticity of every Shopify webhook is verified before we act on it; the service is backed up nightly with a tested restore procedure; and an independent monitor checks the service's health every 15 minutes. No method of storage or transmission is perfectly secure, and we won't claim otherwise.

Cookies & tracking

This marketing site uses no advertising or tracking cookies. The app uses only the essential cookies and authentication needed to keep you signed in.

Children

Tilltrend is a business tool and is not directed to children.

Changes to this policy

We'll post any changes here and update the date above; material changes will be called out.

Contact

Questions about privacy: contact@tilltrend.app.