Legal

Privacy Policy

Xevio Tracking for Shopify. Last updated 13 November 2026.

Who we are

Xevio Tracking is provided by Xevio GmbH, Kaiser-Wilhelm-Ring 22, 50672 Köln, Germany, registered at Amtsgericht Köln under HRB 114267, VAT ID DE 359994371. The app is developed by Servola.de.

Privacy contact: Leon Soliman, [email protected]. General contact: [email protected], +49 173 2534659.

A store that installs the app is the controller for the data of its own visitors. Xevio processes that data on the store’s behalf and only to measure the store’s advertising with Xevio.

What the app does

When a visitor arrives from a Xevio campaign, the link carries a click id. The app keeps that click id in the visitor’s browser and reports three events back to the campaign’s tracker, so the store and Xevio can see which ads lead to sales.

Data stored in the visitor’s browser

  • The click id from the campaign link, stored as xoClickId in local storage and in a first-party cookie on the store’s own domain.
  • Both expire after 90 days; browsers with their own limits, such as Safari, may remove them sooner.
  • Nothing else is stored in the browser, and nothing is stored for visitors who did not arrive from a Xevio campaign link.

Data sent to the tracker

  • Add to cart and checkout started: the click id, the event name and a time value.
  • Purchase: the click id, the order value, the currency and the order number.
  • The app never sends names, email addresses, phone numbers, postal addresses, payment details or the contents of the cart.
  • Events go to the tracking domain the store sets in the app, by default promopage.net, which runs on the Voluum tracking platform that Xevio uses for its campaigns.

Consent

Each store chooses one of two modes in the app. “No consent needed” runs for every visitor and is not a sale of data. “Waits for consent” starts only after the visitor accepts marketing and data sale in the store’s cookie banner; until then nothing is stored or sent, and it stops again when consent is withdrawn. The store chooses the mode that fits the laws of the countries it sells to.

Data the app keeps about the store

  • The store’s Shopify address, the access key Shopify issues to the app, and the app’s settings (tracking domain, cookie domain and privacy mode).
  • This is kept on our own server in Germany while the app is installed. The app keeps no data about shoppers on its server.
  • When a store uninstalls the app, its access key is deleted at once and all remaining store data is deleted when Shopify sends its deletion request, at the latest 48 hours after uninstall.

Recipients

  • Shopify, which runs the store and loads the app’s pixel.
  • The tracker at the store’s tracking domain (Voluum by default), which receives the events listed above.
  • Our hosting provider in Germany, which runs the app’s server.
  • We do not sell data and we do not pass it to anyone else.

Legal basis

Processing for a store takes place under a data processing agreement (Art. 28 GDPR) and the store’s own legal basis: consent (Art. 6 (1) (a) GDPR and § 25 TDDDG) in “Waits for consent” mode, or legitimate interest (Art. 6 (1) (f) GDPR) where the store’s law allows it. Store data is processed to provide the app (Art. 6 (1) (b) GDPR).

Your rights

You can ask for access to your data, its correction or deletion, restrict or object to its processing, and withdraw consent at any time in the store’s cookie settings. Clearing your browser’s cookies and site data removes the click id at once. You can also complain to a data protection authority.

Write to [email protected]. Requests that reach a store through Shopify are passed to us and answered within the time Shopify sets.

Changes

We update this policy when the app changes how it handles data. The date at the top shows the latest version. Xevio’s website has its own policy at xevio.io/datenschutz.