Privacy policy

Effective date and scope

Effective October 29, 2026 · Version 2026-10-29.2

This policy applies to ShopPath websites, access requests, customer accounts, support, billing records, browser journeys, and evidence analysis. ShopPath is developed and operated by Tamga Technologies LLC ("Tamga", "we", "us").

Our role

Tamga acts as the business or controller for account, access-request, billing, security, website, and support information. When we process personal data contained in journey inputs or evidence solely for a Customer, Tamga acts as that Customer's processor or service provider under the Data Processing Addendum.

Information we collect

• Identity and business contact information, including name, work email, company, and workspace membership.
• Account and security information, including authentication activity, permissions, security events, and device or request metadata.
• Storefront configuration, approval records, URLs, test view, schedule settings, and support communications.
• Journey evidence, which may include public storefront screenshots, browser recordings, checkpoint observations, console summaries, and limited network or diagnostic metadata.
• Subscription and billing metadata, including plan, billing interval, payment status, provider identifiers, and invoice events. Payment card details are collected directly by Stripe and are not stored by ShopPath.

How we use information

• Review access and storefront authorization.
• Create and secure accounts, run requested journeys, store evidence, and deliver Journey Results and separate automated Analysis.
• Operate subscriptions, enforce plan allowances, respond to support, and communicate service or legal changes.
• Prevent abuse, troubleshoot failures, maintain service reliability, and comply with law.
• Measure and improve ShopPath using service telemetry, de-identified statistics, and feedback.

Journey Results and automated Analysis

Automated systems and artificial intelligence may contribute to both a Journey Result and the separate Analysis of captured screenshots and supporting evidence. These outputs may be incomplete, incorrect, or contain false positives or false negatives. Customers should review the supporting evidence and use their own judgment before acting on an output.

Service providers may process Customer evidence to return requested outputs, protect their systems, and comply with law under applicable contracts and settings. Tamga does not authorize Customer Content or raw Journey Evidence to be used to train a general-purpose artificial-intelligence model unless Customer separately and affirmatively opts in.

Service Metadata and de-identified information

We collect technical, usage, performance, security, and operational measurements to operate, secure, measure, support, and improve ShopPath and develop related ShopPath functionality. We may create aggregated or de-identified statistics that cannot reasonably be linked to a Customer or person. We maintain de-identified information in de-identified form, do not attempt to re-identify it, and require recipients to apply compatible restrictions where applicable.

How we disclose information

We disclose information to service providers that perform browser execution, evidence analysis, private storage, billing, hosting, security, and error monitoring on our behalf. They may use the information only to provide contracted services and protect their systems. See the current Subprocessor List. We may also disclose information in a corporate transaction, with Customer direction, or where required to protect rights, safety, or comply with law.

Shared report visits

Shared report pages record a browser opening after the report is displayed in a visible browser tab, and whether a browser interaction occurs. Authorized ShopPath administrators can see counts, timestamps, and the visitor IP address when available for the last 90 days. Visitor IP addresses are encrypted in storage and visible only to authorized administrators. An IP address may be shared or change; it does not establish a person’s identity or whether an email was read. These records do not include names, email addresses, or browser fingerprints. No visit cookies or persistent browser identifiers are used. Browser Do Not Track and Global Privacy Control signals disable this visit recording. Older visit records are removed by a daily cleanup.

Website and product analytics

ShopPath uses the standard Google Analytics tag directly on its public website and customer-facing app, including sign-in, forms, and shared report pages. Analytics starts when a page loads and does not wait for acknowledgment of the cookie notice. It measures page views, sessions, engagement, traffic sources, campaign information, browser and device information, and approximate location. Google receives technical request information such as IP addresses to provide its service.

Page addresses, page titles, and referrers are measured using Google's standard behavior. Enhanced measurement can also collect scrolling, outbound-link clicks, site searches, file downloads, form interactions, and supported video interactions, depending on the web stream's settings. We do not add custom Analytics fields containing passwords, payment details, form answers, account records, support messages, or Journey Evidence. Automatic collection of user-provided contact details is disabled. Google's email redaction and configured URL-parameter redaction help mask sensitive information before events are sent. Redaction is pattern-based and does not guarantee removal of every possible personal detail.

This integration keeps advertising storage, advertising user-data use, Google signals, and advertising personalization disabled. No Google Ads or Meta Pixel tag is added. Tamga does not sell Customer Content or Journey Evidence or use them for behavioral advertising. See Google's use of information from partner sites.

Public demo video

The public demo page embeds a player provided by Mux. Loading the player and playing the video sends technical requests, including IP address and browser information, to Mux and its delivery infrastructure. Optional Mux Data analytics and its tracking cookies are disabled. We do not pass account identifiers, private reports, Journey Evidence or the page address as player metadata; the frame also omits the referrer. A locally hosted MP4 alternative and the full transcript remain available on the demo page.

Cookies and similar technology

ShopPath uses cookies or local browser storage for authentication, security, session continuity, preferences, and Google Analytics measurement. Cloudflare Turnstile may process device and request signals to prevent automated abuse. The small cookie notice is informational: selecting "Got it" dismisses it for 180 days on that hostname and does not enable or disable Analytics. Do Not Track and Global Privacy Control do not disable Google Analytics; the separate shared-report visit recording described above continues to respect those signals. You can manage cookies in your browser or use Google's Analytics opt-out browser add-on. Browser restrictions or blocking tools may prevent measurement.

Retention and deletion

The selected plan controls customer report availability: 7 days for Trial, 30 days for Essential, 90 days for Growth, and 180 days for Scale. Enterprise report availability is set in the applicable written agreement or order form. When that period ends, the report and its files stop appearing in the Customer workspace and active public links stop working. The underlying run record, screenshots, recordings, diagnostics, and analysis are retained internally and are not automatically deleted when customer access closes.

Internal test records and account, access, support, security, contract, and billing records are retained while needed to operate, secure, support, and maintain the service and afterward where reasonably necessary for fraud prevention, dispute resolution, tax, accounting, legal compliance, or enforcement. Verified deletion and account-deletion requests are handled subject to applicable law, contractual obligations, security preservation, and backup cycles. Customers should avoid placing unnecessary personal data in storefront test flows.

Security

We use administrative, technical, and organizational safeguards designed to protect information, including restricted evidence access and time-limited artifact links. No system is perfectly secure. If you believe ShopPath data is at risk, contact us promptly.

Your privacy choices and rights

Depending on where you live and applicable law, you may request access, correction, deletion, portability, or restriction of certain personal information, or appeal a denied request. You may also withdraw consent where processing depends on consent. We will verify requests and will not discriminate for exercising applicable rights. An authorized agent may submit a request where permitted by law.

Send requests to support@getshoppath.com. We may retain information that applicable law permits or requires us to keep.

International processing

ShopPath is currently focused on United States customers. Tamga and its providers may process information in the United States and other locations where they operate. Before a Customer subject to European or United Kingdom transfer rules submits personal data, contact us to arrange the appropriate transfer terms.

Children

ShopPath is a business service and is not directed to children under 18. We do not knowingly collect personal information from children through customer account registration.

Changes and contact

We may update this policy as ShopPath changes. The version and effective date appear above, and we will provide reasonable notice of material changes. Privacy questions and requests may be sent to support@getshoppath.com. Tamga Technologies LLC is located in Raleigh, North Carolina, United States.