T2M: Tag to Metafields: Privacy Policy
Last updated: 10 November 2026
This notice explains how Made in Evolve S.r.l. processes personal data in connection with the Shopify app T2M: Tag to Metafields (the App), available on the Shopify App Store. It is provided pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 (GDPR) and of the Italian Privacy Code (Legislative Decree 196/2003). It applies to merchants who install the App, to their staff and, where relevant, to the customers of their stores. The use of the App is also governed by the Terms of Service; for the website madeinevolve.com the general Privacy Policy applies.
1. Controller and contact details
The controller is Made in Evolve S.r.l., Via Rosalba Carriera 26, 41126 San Damaso, Modena (MO), Italy, Tax Code and VAT no. 03497200364, REA MO-392876.
| Channel | Reference |
|---|---|
| Data protection email | privacy@madeinevolve.com |
| General email | hello@madeinevolve.com |
| Certified email (PEC) | madeinevolve@pec.it |
| Telephone | +39 059 788 0854 |
| Form for privacy requests | /policy/data-removal |
Made in Evolve is the controller of the data concerning the merchant that installs the App and its staff. When the App processes data of the merchant’s customers on the merchant’s instructions, Made in Evolve acts as processor under Article 28 GDPR: the merchant remains the controller, and the Data Processing Agreement and the data protection terms that Shopify requires of app developers apply. Shopify is an independent controller of the data processed on its platform, under its own privacy policy.
The Controller has not appointed a Data Protection Officer (DPO), as the conditions of Article 37 GDPR are not met.
2. What the App does
The App converts the tags of products and customers into metafields or metaobjects according to rules defined by the merchant (prefix of the tag, destination, transformations, conflict policy). Rules can be run manually, in test mode (dry run) or on a schedule; every run is logged so that it can be reverted.
At installation the App asks Shopify only for the following permissions: read_products, write_products, read_customers, write_customers, read_product_listings, write_product_listings, read_metaobjects, write_metaobjects, write_metaobject_definitions, read_locales.
3. Data processed
| Category | Data | Source |
|---|---|---|
| Store data | Store domain, access token issued by Shopify, granted permissions, plan, monthly usage counters, time zone. | Shopify, at installation and during use |
| Settings and rules | App language, date format, time zone, notification preferences and email address for notifications if entered, mapping rules, selected items and schedules. | The merchant |
| Job history | For each run: date, status, statistics and, for each record processed, its identifier, the tag processed, the value written and the previous value (needed to revert the run). | The App, during use |
| Data of the merchant’s customers | Only when the merchant creates rules on customers: Shopify customer identifier, customer tags and the metafield values read or written. In the selection screens the customer’s display name is shown, read live from Shopify. | Shopify, on behalf of the merchant |
| Staff data | Shopify makes the store owner’s basic details (name, email, phone, address) available to all apps. The App does not store them. | Shopify |
| Support chat | Messages exchanged in the in-App support chat, the store domain and the technical data of the browser used (including IP address). | The merchant or its staff |
| Technical logs | IP address of the requests reaching the App server, date and time, requested address, outcome and error messages. | Automatically |
The App does not access orders. Customer tags and metafields may contain personal data, including, depending on how the merchant uses them, information about preferences or segments: the merchant should not create rules that copy special categories of data (Article 9 GDPR) into metafields, and should configure the rules so that only the necessary data are processed.
The App does not use cookies to authenticate the merchant: access takes place through Shopify session tokens. The support chat stores technical data in the browser to keep the conversation open between pages. The App does not use advertising or profiling tools and takes no automated decisions about people.
4. Purposes and legal bases
| Purpose | Legal basis |
|---|---|
| Installing the App and providing its functions to the merchant | Performance of the contract with the merchant (Art. 6(1)(b) GDPR) |
| Processing the data of the merchant’s customers according to the rules set by the merchant | On behalf of the merchant, as processor (Art. 28 GDPR); the legal basis is determined by the merchant as controller |
| Managing plans and billing through Shopify | Performance of the contract (Art. 6(1)(b)) and legal obligations (Art. 6(1)(c)) |
| Answering support requests | Performance of the contract (Art. 6(1)(b)) |
| Security, error diagnosis and prevention of abuse (technical logs) | Legitimate interest in keeping the service working and secure (Art. 6(1)(f)) |
| Handling Shopify privacy requests and data subject requests | Legal obligation (Art. 6(1)(c)) |
| Establishing, exercising or defending legal claims | Legitimate interest (Art. 6(1)(f)) |
Providing the store data is necessary to use the App: without them the App cannot work.
5. Retention
| Data | Retention period |
|---|---|
| Access token and sessions | Deleted when the App is uninstalled. |
| Schedules | Deleted when the App is uninstalled, so that no run starts after uninstallation. |
| Store data, rules and job history | For as long as the App is installed, to allow the merchant to revert runs; deleted when Shopify sends the shop/redact request (48 hours after uninstallation). |
| Data of a specific customer | Deleted from the job history within 30 days of the customers/redact request forwarded by Shopify. |
| Support chat | For as long as needed to provide support and in any case no longer than 24 months from the last message; it can be deleted earlier on request. |
| Technical logs | For a limited period, no longer than 12 months. |
At the end of these periods the data are deleted or made anonymous, unless they must be kept longer to comply with a legal obligation or to defend a right. Billing data are kept by Shopify, which issues the invoices for the App.
6. Recipients and sub-processors
Data are processed by authorised staff and collaborators of Made in Evolve bound to confidentiality, and only to the extent necessary for their tasks. They are also processed by the following parties:
| Party | Activity | Role | Location |
|---|---|---|---|
| Shopify International Limited (Ireland) and its group companies | Platform on which the store runs: the App reads and writes data only through the Shopify APIs; Shopify also manages the App’s billing | Independent controller | Ireland, Canada and other countries, under its own safeguards |
| DigitalOcean, LLC (United States) | Hosting: cloud servers and database of the App | Processor | See section 7 |
| Crisp IM SAS (France) | In-App support chat | Processor | EU |
Data may also be disclosed to public authorities where required by law, and to professional advisers bound to confidentiality where necessary to establish, exercise or defend legal claims. We do not sell personal data, do not use them for advertising and do not use them to train artificial intelligence models.
7. Transfers outside the European Economic Area
The App’s data are stored on DigitalOcean infrastructure. DigitalOcean, LLC and Shopify have their parent companies outside the European Economic Area (United States and Canada), and the support chat provider may use technical sub-processors outside the EEA. Where personal data are transferred, or may be accessed, outside the EEA, the transfer takes place on the basis of an adequacy decision of the European Commission (including, for US providers that participate in it, the EU-US Data Privacy Framework) or of the Standard Contractual Clauses adopted by Decision (EU) 2021/914. A copy of the safeguards can be requested at privacy@madeinevolve.com.
8. Shopify privacy requests (mandatory webhooks)
The App is subscribed to the three privacy webhooks that Shopify requires of all public apps, and accepts them only if their cryptographic signature is valid:
customers/data_requestandcustomers/redact: When a customer of the store asks the merchant for their data, Shopify forwards the request to the App: Made in Evolve provides the merchant, within 30 days, with the data of that customer contained in the job history. When the merchant or Shopify asks for a customer’s data to be erased, the App deletes that customer’s identifiers and values from the job history within 30 days, unless retention is required by law.shop/redact: Shopify sends it 48 hours after the App has been uninstalled, if it has not been reinstalled in the meantime. On receipt, the App permanently deletes all the data of that store from its database.app/uninstalled: on uninstallation the App immediately deletes the store’s access credentials.
9. Your rights and how to exercise them
Under Articles 15 to 22 GDPR you may ask at any time and free of charge for access to your data and a copy of them, rectification, erasure, restriction of processing, portability of the data you provided, and you may object to processing based on legitimate interest. Where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of the processing carried out before.
Requests can be sent through the privacy request form or by email to privacy@madeinevolve.com. We reply within one month of receipt, extendable by two further months where necessary given the complexity or number of requests (Article 12(3) GDPR). Uninstalling the App does not limit these rights.
If you are a customer of a store that uses the App, the store is the controller of your data: please contact it first. Requests received directly by Made in Evolve are forwarded to the store without undue delay, and we assist the store in responding.
If you believe that the processing infringes the GDPR, you may lodge a complaint with the Italian supervisory authority, the Garante per la protezione dei dati personali, or with the authority of the Member State where you live or work.
10. Security
Traffic between the merchant’s browser, Shopify and the App is always encrypted (HTTPS). Access tokens are used only to call the Shopify APIs within the permissions granted, messages from Shopify are accepted only with a valid signature, and access to servers and databases is limited to authorised staff. The measures adopted are described in the Information Security Policy.
11. Changes to this notice
This notice may be updated when the App, its providers or the applicable rules change; the date at the top shows the latest version. Substantial changes (new categories of data, new purposes, new sub-processors or different retention periods) are announced in the App before they take effect.
12. Contacts
For any question about this notice or about the processing of personal data through the App, write to privacy@madeinevolve.com.