Privacy Policy

This Privacy Policy explains how Rawsoft, Inc. collects, uses and shares personal information across our websites (rawsoft.com and tagpipes.com), the TagPipes platform, TagPipes Companion and TagPipes for Shopify, and the choices you have.

The short version

• We collect what you give us in forms and accounts, plus the usage data our websites and cookies collect.
• When businesses use TagPipes on their websites, we process their visitors' data for them, on their instructions.
• We do not sell personal information for money. Our websites use advertising cookies, and you can opt out through Your Privacy Choices or the Global Privacy Control.
• You can ask to see, correct or delete your information through our privacy request form or at privacy@rawsoft.com.

1. Who We Are and What This Policy Covers

Rawsoft, Inc. ("Rawsoft," "we," "us," or "our") is a digital analytics and privacy company based in Atlanta, Georgia. We own and run:

• rawsoft.com, our company website, including the Digital Maturity Index and Website Privacy Index pages;
• tagpipes.com, the website for our TagPipes product, including its free tools;
• the TagPipes platform: the TagPipes app at my.tagpipes.com and the scripts and services our customers install on their own websites (such as Shield, Echo, Activate, Lens and our tag scripts);
• TagPipes Companion, our Chrome extension;
• TagPipes for Shopify, our Shopify app (see section 15);
• our consulting and implementation services.

This policy explains what personal information we collect through all of these, how we use it, who we share it with, and the choices and rights you have.

Two roles. For our own websites, our own marketing, and TagPipes accounts, Rawsoft decides how personal information is used. When a business uses TagPipes on its website, we process information about that website's visitors on the business's behalf and under its instructions. In that case the business's own privacy policy explains how it uses the information, and our agreement with the business governs our part. If you visited a website that uses TagPipes and have a question about your data, please contact that website first. We will help them respond.

2. Information We Collect

Information you give us

• Forms on our websites. When you contact us, ask for a demo, quote, audit, assessment, case study or scan, or join our newsletter, we collect what the form asks for: typically your name, email address, company, website, and your message. Some forms also ask about the service you are interested in, your ad spend, or your current setup.
• Index and tool requests. When you request a scan on rawsoft.com, we collect your email address, company and the website you ask about. When you use a free tool on tagpipes.com, we collect the website address you enter and, if you ask to be notified, your email address.
• Privacy requests. When you send a privacy request through one of our forms, we collect your name, email address, request type and details, and anything optional you choose to add, such as a phone number, country or state, account ID, or an identity document if one is needed to verify the request.
• Conversations. Information you share with us by email, phone, or in meetings while we work with you.

TagPipes accounts and billing

• Account details: first and last name, email address, company, your role in the company account, a securely hashed password, API tokens you create, and when you last signed in.
• How you found us: when you sign up, we record the campaign tags (UTMs) in the link you used and, only if you have allowed advertising cookies, the Google Ads click ID.
• Billing: payments are handled by Stripe. We keep the Stripe customer reference and the card details Stripe returns to us (such as card brand, last four digits and expiry date). We never receive or store your full card number.
• Support: messages you send us and any diagnostic details attached to them.

Information collected automatically on our websites and app

When you visit rawsoft.com, tagpipes.com or my.tagpipes.com, we and our providers collect your IP address, browser and device type, operating system, language, referring page, the pages you view and actions you take, the time of your visit, and an approximate location (country, region or city) derived from your IP address. We do not collect precise location. Much of this comes from cookies and similar technologies, described in section 6 and in our Cookie Policy.

Information we process for TagPipes customers

When a business installs TagPipes on its website, TagPipes processes information about that website's visitors on the business's behalf. Depending on the features the business uses, this can include:

• Consent records (Shield): the visitor's consent choices, a consent ID, country and region, language, whether a Global Privacy Control or Do-Not-Track signal was sent, and, if the business chooses to supply one, an identifier such as a hashed email address or customer ID. Shield does not store the visitor's IP address or user agent with consent records.
• Website activity (Echo and tag scripts): pages viewed, events such as clicks, form steps and purchases, referring page, campaign tags and ad click IDs, IP address, approximate location derived from it, and browser information.
• Privacy requests (Shield forms): the details a visitor submits in a business's privacy request form, as listed above.
• Website monitoring and audits: technical scans of the business's own website, such as tags found, network requests, cookies set and screenshots.
• Analytics data (Lens): data the business connects from its own sources, such as Google Analytics or advertising accounts.

Section 6 lists the cookies TagPipes can set on a customer's website.

Website scans for our research

For the Website Privacy Index and Digital Maturity Index, we scan publicly available websites and record technical facts about them, such as which tags load, which cookies are set, and how a consent banner behaves. These scans describe websites, not people.

Sensitive information

We do not ask for sensitive personal information. The only exception is an identity document a person may choose to upload to verify a privacy request, which is used only for that purpose.

3. How We Use Information

• To provide our services and the TagPipes platform, including running the features our customers turn on.
• To respond to your requests, send you what you asked for, and provide support.
• To create and secure TagPipes accounts, sign you in, and bill for subscriptions.
• To send service messages, such as account, security and billing notices.
• To send our newsletter and occasional marketing emails, which you can unsubscribe from at any time.
• To understand how our websites and products are used and to improve them.
• To measure our own advertising and show our ads to people who have visited our websites.
• To keep our websites and services secure and to prevent fraud and abuse.
• To meet legal obligations and to protect our rights and the rights of others.

We use information we process for TagPipes customers only to provide TagPipes to that customer, under their instructions. We do not use it to market to their visitors, and we do not combine visitors' data across different customers to build profiles.

4. Legal Bases (EEA, UK and Switzerland)

If you are in the European Economic Area, the United Kingdom or Switzerland, we rely on these legal bases:

• Contract: to provide the services and TagPipes account you signed up for, or to take steps you asked for before signing up.
• Consent: for non-essential cookies and similar technologies, and for marketing where consent is required. You can withdraw consent at any time.
• Legitimate interests: to run, secure and improve our websites and products, to respond to business inquiries, and to market our services to business contacts. We weigh these interests against your rights, and you can object at any time.
• Legal obligation: where the law requires us to process information.

5. Who We Share Information With

We do not sell personal information for money. We share it only as described here.

Service providers. These companies process information on our behalf to run our websites and products:

Platforms our customers connect. When a TagPipes customer connects an advertising or analytics platform, such as Meta, Google Analytics, Google Ads, TikTok, Pinterest, Snapchat, Reddit, LinkedIn or Microsoft Ads, TagPipes sends that customer's website events to it on the customer's instructions. The platform's use of that data is governed by its own terms and the customer's agreement with it.

Legal and safety. We may disclose information when the law requires it, or to protect the rights, property or safety of Rawsoft, our customers or others.

Business transfers. If Rawsoft is involved in a merger, acquisition, financing or sale of assets, information may be transferred as part of that transaction, subject to this policy.

6. Cookies and Similar Technologies

On our websites and app

rawsoft.com, tagpipes.com and my.tagpipes.com use cookies and similar technologies for consent, sign-in and security, analytics (Google Analytics, Microsoft Clarity), and advertising (Google Ads, plus Pinterest on rawsoft.com and LinkedIn on tagpipes.com). Our Cookie Policy lists them, straight from our consent tool. You can change your choices at any time through Your Privacy Choices, in the footer of every page.

Targeted advertising. Our advertising cookies let Google, Pinterest and LinkedIn measure our ads and show them to people who visited our websites. Some US state laws treat this as "sharing" personal information or "targeted advertising." You can opt out through Your Privacy Choices or by turning on the Global Privacy Control (GPC) in your browser, which we honor automatically.

On TagPipes customers' websites

Depending on the features a business uses, TagPipes can set the following on that business's website. The business decides which features run and how its consent banner controls them.

TagPipes can also read cookies set by the website's own analytics and advertising tools, such as Google Analytics (_ga, _ga_*) and Meta (_fbp, _fbc), so the business can match activity in those tools.

7. AI Features

TagPipes Lens offers optional AI features. They are off unless a customer turns them on for a property or company.

• Tile summaries send the data shown in a Lens chart to an AI provider (OpenAI or Anthropic) to write a short summary.
• Ask Lens sends your question and a description of the available data fields, not the data rows themselves.

We use these providers' business APIs, which by default do not use the data we send to train their models. We do not use AI to make decisions about individuals.

8. How Long We Keep Information

We keep personal information only as long as we need it for the purposes in this policy, or as long as the law requires.

• Inquiries, leads and newsletter subscriptions: while they are useful to our relationship with you. We delete them on request, and you can unsubscribe at any time.
• TagPipes accounts: while the account is active. After an account closes, we delete or anonymize its personal information on request, except what we must keep for legal, tax or accounting reasons.
• Data processed for TagPipes customers: for as long as the customer's agreement requires, and deleted on the customer's instructions.
• Shield consent state: about 13 months (395 days) after the last update. The consent cookie in the visitor's browser lasts 12 months by default.
• Free tool scans on tagpipes.com: 7 days by default.
• Advertising platform credentials: deleted as soon as the customer disconnects the platform.
• Backups: some systems keep rolling backups for up to 35 days, after which deleted data is gone from them too.

9. How We Protect Information

We send information over encrypted connections (HTTPS) and store it with encryption at rest. Passwords are stored as one-way hashes. Credentials our customers give us for advertising platforms are kept encrypted in a separate credential store and are never shown back to anyone. Access to personal information is limited to Rawsoft staff who need it to run and support our services.

No method of transmission or storage is completely secure, so we cannot guarantee absolute security. If we learn of a security incident affecting your personal information, we will notify you as the law requires.

10. International Transfers

Rawsoft is based in the United States, and we and our providers process and store information in the United States. If you are outside the United States, your information will be transferred there. Where the law requires a transfer mechanism, we rely on the European Commission's Standard Contractual Clauses or another lawful mechanism.

11. Children

Our websites and services are for businesses and are not directed to children. We do not knowingly collect personal information from anyone under 18. If you believe a child has given us personal information, contact us at privacy@rawsoft.com and we will delete it.

12. Your Privacy Rights

Depending on where you live, you may have the right to:

• know whether we process your personal information, and get access to it and a copy of it;
• correct inaccurate information;
• delete your information;
• receive your information in a portable format;
• object to or restrict how we use it;
• opt out of targeted advertising, "sale" or "sharing" of personal information, and profiling;
• withdraw consent you gave us;
• not be treated differently for using these rights;
• appeal if we decline your request.

We offer these rights to everyone, wherever you live, though the law may limit them in some cases.

How to make a request. Use our privacy request form or email privacy@rawsoft.com. To opt out of targeted advertising on our websites, use Your Privacy Choices or turn on the Global Privacy Control in your browser. To stop marketing emails, use the unsubscribe link in any of them.

Verification and agents. We will verify your identity before acting on a request, using information we already hold where we can. You may use an authorized agent; we will ask for proof that you authorized them.

Response times. We respond within the time the law sets for your location, usually within 30 to 45 days. If we need more time, we will tell you why.

Appeals and complaints. If we decline your request, you can appeal by replying to our decision or emailing privacy@rawsoft.com. If you are not satisfied, you can contact your state attorney general or, in the EEA, UK or Switzerland, your local data protection authority.

Visitors to TagPipes customers' websites. If your request is about data a business collected on its own website using TagPipes, please send it to that business. Many of them use a TagPipes privacy request form, which delivers your request straight to them. We will help the business respond.

13. Do-Not-Track and Global Privacy Control

We honor the Global Privacy Control (GPC) signal on our websites as a request to opt out of targeted advertising and sharing. There is no common standard for the older Do-Not-Track (DNT) signal, so we do not respond to it. On customers' websites, Shield records whether a GPC or DNT signal was sent and applies the rules the business has configured.

14. TagPipes Companion

TagPipes Companion is a Chrome extension for inspecting tags, consent and storage on the pages you open. It runs locally in your browser while Chrome DevTools is open. What it captures about the pages you inspect is shown to you in the extension and is not sent to Rawsoft. It needs no account. It shows the names of cookies and storage items, not their values. Nothing leaves the extension unless you choose to export or copy it.

The extension asks Chrome for one permission, storage, which it uses to save your own settings. If it downloads reference information from TagPipes, such as our public list of known vendors, that request contains no information about the pages you inspect.

15. TagPipes for Shopify

This section covers TagPipes for Shopify (the "App"), which merchants install from the Shopify App Store. The rest of this policy also applies. For a merchant's store visitors and customers, the merchant decides to use the App and Rawsoft processes their information on the merchant's behalf, under the merchant's instructions and our agreement with the merchant.

What the App collects

From merchants:

• store details from Shopify: store name, store domain, store ID, currency and time zone;
• a TagPipes account created automatically for the store, which contains no merchant staff names or email addresses;
• if the merchant connects Meta or Google Ads, the access credentials those platforms issue and the selected ad account, pixel or conversion action;
• messages the merchant sends through "Get help", and the diagnostic details attached to them.

From store visitors, through Shopify's Web Pixel. The App records store activity: pages and products viewed, cart and checkout steps, purchases, and searches. If the merchant turns them on, it can also record custom app events and page interactions such as clicks and form activity. It never records the values typed into forms. Each event can include:

• the page address and referring page;
• campaign information such as UTM tags and ad click IDs;
• order details for purchases (order ID, value, currency, items);
• browser information (user agent);
• the visitor's IP address, which is recorded with each event, and an approximate location (country, region, city) derived from it;
• the visitor's privacy choices as reported by Shopify's customer privacy settings;
• identifiers set by the store's own analytics and advertising tools, such as Google Analytics (_ga, _ga_*) and Meta (_fbp, _fbc) cookies.

The App sets one first-party cookie, _tp_ctx, on the store's domain. It remembers how the visit arrived (campaign and session) for up to 30 days.

From Shopify orders. To check that sales were tracked, the App reads the store's orders: order ID and number, when the order was created and paid, payment status, currency, totals (subtotal, tax, shipping, discounts) and items. Customer names, email addresses, phone numbers and addresses are not requested from Shopify, and where Shopify includes them in a notification, they are removed before anything is stored.

The App does not collect customer names, email addresses, phone numbers or postal addresses.

How the App uses it

• To show the merchant whether their store tracking and connected ad platforms are working.
• To reconcile Shopify orders against tracked sales and flag orders that were not tracked correctly.
• To provide reporting to the merchant.
• If the merchant connects Meta or Google Ads, to send the store's purchase and shopping events to those platforms on the merchant's behalf.
• To provide support and keep the App secure.

We do not sell information collected through the App, and we do not use it to build profiles of visitors across different merchants' stores.

Meta and Google credentials

Credentials from Meta or Google Ads are stored encrypted in TagPipes' separate credential store. They are never shown back to anyone, including the merchant, and are deleted when the merchant disconnects the platform. Meta access tokens currently expire after about 60 days, after which the merchant reconnects.

Who the App shares it with

• Advertising platforms the merchant connects (Meta, Google Ads), once connected. Their use of the data is governed by their own terms.
• Our service providers: Amazon Web Services (processing, storage and email), ClickHouse Cloud (analytics storage), Netlify (the App's web server) and Slack (support messages), all in the United States.
• When required by law, or to protect the rights and safety of Rawsoft, merchants or others.

Visitors' privacy choices

The App runs through Shopify's Web Pixel system, which applies the privacy settings the merchant configures in Shopify. Each event carries the visitor's privacy choices, and events are only forwarded to an advertising platform when those choices allow it. Store visitors and customers should send requests about their data to the merchant; merchants can contact us at privacy@rawsoft.com.

Data requests and deletion

The App responds to Shopify's privacy requests. For a customer data request (customers/data_request), we provide the merchant with the data we hold about that customer within 30 days. For a customer redaction request (customers/redact), we delete that customer's data within 30 days. When a merchant uninstalls the App, data sending stops immediately, and after Shopify's shop redaction request (shop/redact) we delete the store's data within 30 days. We may keep records the law requires us to keep.

How long the App keeps information

We keep store data while the App is installed and as long as the merchant needs it for reporting, and delete it as described above. Meta and Google credentials are deleted as soon as the merchant disconnects the platform.

Security and transfers

Information is sent over encrypted connections and stored with encryption at rest in the United States. Access is limited to Rawsoft staff who need it to run and support the App. Section 10 explains international transfers. The App is not directed to children.

16. Changes to This Policy

We will update this policy when our practices or products change. The "Last updated" date at the top shows when it last changed. If we make material changes, we will highlight them on this page and, where appropriate, notify TagPipes customers by email.

17. Contact Us

Questions about this policy or your personal information can be sent to privacy@rawsoft.com, through our privacy request form, or by mail to:

Rawsoft, Inc., 3480 Peachtree Rd NE, 2nd Floor, Suite 137, Atlanta, GA 30326, USA