Privacy Policy
Who this covers
This policy describes how Tillsight (“we”) handles data when a winery (the “Merchant”) installs the Tillsight app on Commerce7. Tillsight processes the Merchant’s customer data on the Merchant’s instructions; the Merchant is the data controller and Tillsight is the processor. Tillsight does not sell data and does not use Merchant data for any purpose other than providing the service described here.
What we receive from Commerce7
When the Merchant installs Tillsight, Commerce7 sends us webhook notifications for orders, club memberships, reservations and carts. For each event we receive the Commerce7 record, which includes the order or membership ID, the channel (web, point of sale, phone, club), the order value and currency, the date and time, and the customer’s name, email address, phone number and postal address. We also read the Merchant’s club definitions to calculate average member value (Pro and Group plans only).
What we collect on the Merchant’s website
With the Merchant’s permission, a small script on the Merchant’s storefront reads advertising click identifiers (Google’s gclid, gbraid and wbraid) and campaign parameters (UTM values) from the page URL, keeps them in the visitor’s browser storage (localStorage) for up to 90 days, and attaches them to the visitor’s Commerce7 cart. If the Merchant’s website runs Google Analytics, the script also reads the visitor’s Google Analytics client ID from Google Analytics’ own _ga cookie, so a later sale can be joined to that visit in the Merchant’s GA4 property. The script sets no cookies of its own and collects no other browsing data.
What we send to Google
For each order, club signup or reservation, we send Google Ads a conversion record containing: the conversion value and currency, the date and time, the Commerce7 record ID (used to prevent duplicates), the click identifier when one was captured, and, where no click identifier exists, the customer’s email address, phone number, first name, last name and postal code hashed with SHA-256 before transmission. Google uses these hashes to match the conversion to a signed-in user who clicked the Merchant’s ad; Google’s handling is governed by Google’s privacy policy and the Google Ads Data Processing Terms.
We send the same events to the Merchant’s Google Analytics 4 property with no customer identifiers other than the Google Analytics client ID captured on the website or, when none was captured, a random ID that Tillsight generates. On the Pro and Group plans, with the Merchant’s configuration, we send the same hashed identifiers to Meta’s Conversions API and Microsoft Advertising, and we send hashed customer lists to Google Ads Customer Match for the Merchant’s own audience targeting.
What we receive from Google
With the Merchant’s authorization, we read the connected Google Ads account’s campaign and ad group names, daily cost, clicks and conversion totals, so the dashboard can show ad spend against sales. We store these as aggregated daily totals.
What we never do
We do not send Merchant or customer data to any artificial intelligence service, large language model or coding assistant. We do not sell or rent data. We share it only with the advertising and analytics accounts the Merchant connects (Google Ads, Google Analytics 4 and, on the Pro and Group plans, Meta and Microsoft Advertising) and with the service providers listed below that run Tillsight. We do not use one Merchant’s data to benefit another Merchant.
Service providers
Tillsight runs on third-party infrastructure that processes data only to operate the service: a cloud hosting provider for the application and its database, an error-monitoring service that receives technical error reports (configured not to include customer names, email addresses or phone numbers), Netlify, which hosts tillsight.io and receives its launch-form submissions, and Google Workspace for email support. Each provider is bound by a data processing agreement. A current list of providers is available on request at hello@tillsight.io.
What we store
We keep the event records and conversion logs for 90 days so the Merchant can see what was sent and why, then delete them automatically. We keep aggregated daily totals (spend, conversions, revenue by channel) for the dashboard for as long as the app is installed. We store the Merchant’s Google OAuth refresh token encrypted at rest and use it only for the purposes listed under Google API Services below. When a visitor who arrived from an ad becomes a known Commerce7 customer, we keep that click identifier against the customer’s Commerce7 ID for up to 90 days, so a later tasting-room or phone order can be credited to the same ad, and then delete it. We do not store raw customer identifiers beyond the 90-day event log; hashes are computed at send time and not retained separately.
Security
Data is encrypted in transit (TLS) and at rest. Webhook requests are authenticated. Each Merchant’s data is isolated by tenant. Access to production systems is limited to Tillsight’s operator and protected by two-factor authentication.
Deletion and access
Uninstalling the app stops all processing immediately and deletes the Merchant’s stored data within 30 days. A Merchant can request earlier deletion, or a copy of what we hold, by emailing hello@tillsight.io. If an individual customer asks the Merchant to delete their data, the Merchant can forward the request to us and we will remove any event records that reference that person within 10 business days.
Google API Services
Tillsight asks the Merchant for three Google permissions, and uses each only as described here:
- Google Ads (the Google Ads API): to create and manage the conversion actions Tillsight uses, and to read campaign names, cost, clicks and conversion totals for the dashboard.
- Google Data Manager (the Data Manager API): to send conversions and adjustments to the Merchant’s Google Ads account and, on the Pro and Group plans, to update Customer Match lists.
- Google Analytics (edit access to the Merchant’s GA4 property): to create the key events Tillsight sends and a Measurement Protocol secret, and to send events to that property.
Tillsight’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We do not use Google user data to serve ads, we do not sell it, and no person at Tillsight reads it except with the Merchant’s permission for support, for security, or where the law requires.
On tillsight.io
The launch notification form on this website collects your email address. It is stored by our website host, Netlify, and used only to send you one email when Tillsight launches. We delete it on request. tillsight.io sets no cookies and runs no analytics.
Businesses only
The service is for businesses only.
Changes
We will post changes here and notify Merchants by email at least 14 days before a material change takes effect.