Privacy Policy

This Privacy Policy describes how Inforah Private Limited ("Follow The Spend", "we", "us", or "our") collects, uses, and shares information when you use our marketing attribution and analytics platform available at followthespend.com and app.followthespend.com (collectively, the "Service").

By accessing or using the Service, you agree to the terms of this Privacy Policy. If you do not agree, please discontinue use of the Service.

1. Information We Collect

1.1 Information You Provide

When you register for an account or communicate with us, we collect:

• Name and email address (via Clerk authentication)
• Shopify store domain you connect to the Service
• Billing and payment information processed by Razorpay (we do not store card details)
• Communications you send to our support team

1.2 Information Collected Automatically via the Pixel

When you install our tracking pixel (intentIQ) on your Shopify store, we collect the following data about your store's visitors on your behalf:

• Page URLs visited, referrer URLs, and UTM parameters
• Session identifiers (a first-party cookie: intentiq_id)
• Browser type, device type, and approximate geographic location (country/region level)
• Timestamp of each page view and session event
• Add-to-cart and checkout initiation events

This data is collected on your behalf as a data processor. You, the merchant, are the data controller for your visitors' data.

1.3 Shopify Order and Customer Data

Upon connecting your Shopify store via OAuth, we receive and store:

• Order IDs, order revenue, line items, and fulfilment status
• Customer IDs (not personally identifiable names or emails) used to stitch sessions to orders
• Shopify webhook events for orders, checkouts, and app uninstall notifications

1.4 Usage and Technical Data

We automatically collect certain technical data when you use the dashboard, including IP address, browser and device information, pages accessed within the application, and error logs.

2. How We Use Your Information

We use the information we collect to:

• Provide, operate, and improve the Service
• Attribute your store's orders to the correct marketing touchpoints
• Generate the analytics reports and dashboards you access
• Process subscription payments and send billing communications
• Send transactional emails (trial reminders, payment receipts, usage alerts)
• Respond to support requests
• Monitor for errors, security incidents, and service availability
• Comply with legal obligations

We do not sell your data or your visitors' data to any third party.

3. Data Sharing and Third-Party Services

We share data only with the following sub-processors required to operate the Service:

We do not share your data with advertising platforms, data brokers, or any third party for marketing purposes.

4. Data Retention

• Raw pixel event data — retained for 90 days from collection, then aggregated or deleted.
• Order and attribution data — retained for the lifetime of your active subscription, plus 30 days after cancellation.
• Account data — retained until you request deletion or 90 days after account closure, whichever is sooner.
• Billing records — retained for 7 years as required by applicable tax and accounting law.

5. Cookies

Follow The Spend sets one first-party cookie on your store's visitors: intentiq_id. This cookie is used solely to stitch sessions across page views and does not track visitors across other websites. It is not used for advertising or profiling purposes.

Our own dashboard (app.followthespend.com) uses session cookies managed by Clerk for authentication. These are necessary cookies and cannot be disabled without preventing login.

6. Your Rights

Depending on your jurisdiction, you may have the following rights with respect to your personal data:

• Access — request a copy of the personal data we hold about you
• Correction — request correction of inaccurate data
• Deletion — request deletion of your data (subject to legal retention obligations)
• Portability — receive your data in a machine-readable format
• Objection — object to processing in certain circumstances

To exercise any of these rights, email us at connect@inforah.com. We will respond within 30 days.

7. India — Digital Personal Data Protection Act (DPDP)

We are incorporated in India and are subject to the Digital Personal Data Protection Act, 2023 (DPDP Act). We act as a Data Fiduciary with respect to merchant account data and as a Data Processor with respect to your store visitors' data (for which you, the merchant, are the Data Fiduciary).

We will update this section as the DPDP Rules are finalised and notified by the Government of India. In the interim, our practices are guided by the principles of purpose limitation, data minimisation, and storage limitation described above.

8. Data Security

We implement industry-standard security measures including encryption at rest (AES-256) for sensitive tokens, TLS in transit for all data transfers, role-based access controls, and regular dependency audits. No method of transmission over the internet is 100% secure, and we cannot guarantee absolute security.

9. Children's Privacy

The Service is intended for use by businesses and is not directed at individuals under 18 years of age. We do not knowingly collect personal data from minors.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email or by displaying a notice within the dashboard. Continued use of the Service after the effective date constitutes acceptance of the updated policy.

11. Contact Us

If you have questions about this Privacy Policy or wish to exercise your data rights, please contact:

Inforah Private Limited
Ahmedabad, Gujarat, India
Email: connect@inforah.com