Legal

Privacy Policy

Xevio Tracking for Shopify. Last updated 13 November 2026.

Who we are

Xevio Tracking is provided by Xevio GmbH, Kaiser-Wilhelm-Ring 22, 50672 Köln, Germany, registered at Amtsgericht Köln under HRB 114267. Contact: hello@xevio.io, +49 173 2534659. The app is developed by Servola.de.

The store that installs the app decides to use it for its advertising with Xevio. For the data its visitors produce, the store is the controller and Xevio processes the data on the store’s behalf.

What the app does

When a visitor arrives from a Xevio campaign, the link carries a click id. The app keeps that click id in the visitor’s browser and reports three events back to the campaign’s tracker, so the store and Xevio can see which ads lead to sales.

Data in the visitor’s browser

  • The click id from the campaign link, stored as xoClickId in local storage and in a first-party cookie on the store’s domain.
  • The cookie expires after 30 days. Nothing else is stored in the browser.

Data sent to the tracker

  • Add to cart and checkout started: the click id, the event name and a time stamp.
  • Purchase: the click id, the order value, the currency and the order number.
  • Nothing is sent for visitors without a click id. The app never sends names, email addresses, phone numbers, postal addresses or payment details.
  • Events go to the tracking domain the store sets in the app, by default promopage.net, which runs on the Voluum tracking platform used by Xevio.

Consent

Each store chooses one of two modes. “No consent needed” runs for every visitor and is not a sale of data. “Waits for consent” starts only after the visitor accepts marketing and data sale in the store’s cookie banner; before that nothing is stored or sent. The store is responsible for picking the mode that fits the laws where it sells.

Data the app keeps about the store

  • The store’s Shopify address, the access key Shopify issues to the app, and the app’s settings (tracking domain, cookie domain, privacy mode).
  • This is kept on our own server in Germany while the app is installed.
  • When a store uninstalls the app, its access key is deleted at once; all remaining store data is deleted when Shopify asks for it, at the latest 48 hours after uninstall.

Legal basis

Processing for the store takes place under a data processing agreement (Art. 28 GDPR) and the store’s own legal basis, which is consent (Art. 6 (1) (a) GDPR, § 25 TDDDG) in “Waits for consent” mode or legitimate interest (Art. 6 (1) (f) GDPR) where the store’s law allows it.

Your rights

You can ask for access to, correction or deletion of your data, restrict or object to its processing, and withdraw consent at any time in the store’s cookie settings. You can also complain to a data protection authority. Write to hello@xevio.io; requests that reach Shopify are passed to us and answered within the time Shopify sets.

More about Xevio’s own website: xevio.io/datenschutz.