See the offer

Cookies and tracking

Our Privacy Policy covers how a Shopify store handles your data in general. This page covers the specific tools we chose to run, what each one collects, and the legal basis for it. Between the two you have the whole picture. If anything here contradicts the Privacy Policy, the more specific statement on this page is the one we stand behind.

Who is responsible

Exact Words is responsible for the data described here. Email support@exact-words.com. Our full business details are in our Legal Notice. Because we are established in the EU, the GDPR applies to everything below, wherever you live.

The short version

To sell you a digital book we need your email address and a payment. To know whether our advertising pays for itself, we measure which pages and buttons people use, and we tell Meta when a purchase happens. We do not record your screen, we do not sell your data for money, and every tool is named below.

The tools that actually run here

  • Shopify hosts the store and our files, runs the checkout and takes payment. Card details go to Shopify Payments and its processors. We never see or store them. Shopify also sends your order confirmation, which is your receipt and has the buttons that open your files, and it counts visits and sales for our store reports.
  • PostHog is our product analytics, hosted in the United States. It records which pages you view, how far down a page you get, which buttons, links and FAQ items you click (including repeated clicks), whether you tick the Documentation Vault box, which ad, email or website sent you, your device, browser, screen size and language, how fast the page loads, and any error the page’s code runs into (the error message and where in the code it happened). It keeps a random ID in your browser so it can tell a return visit from a new one. It receives your IP address and works out an approximate location, at country and city level, from it. IP addresses are not anonymized in our current setup. PostHog does not receive your name or your email address.
  • Meta pixel and Conversions API, through Shopify’s Facebook & Instagram app. The pixel reports page views, product views, add to cart, checkout steps and purchases, and keeps a random ID in your browser. Shopify also sends these events to Meta from its servers, with scrambled (hashed) versions of the contact details you give at checkout: your email address, name, phone number, and the city, state and ZIP code of your billing address. That lets Meta match a sale to the ad you clicked, which is how we find out whether an ad is worth paying for.
  • Shopify Messaging, Shopify’s email app, sends our marketing emails if you signed up for them, on our page or at checkout, including a reminder if you leave checkout before paying. It records whether an email is opened and which links are clicked, and the links carry campaign tags so we can see which email led to a visit.
  • hCaptcha checks that our signup and contact forms are sent by a person, not a bot. It sees your IP address and browser details when you use a form.
  • Microsoft 365 hosts our support mailbox. If you email us, your message is stored there.
  • Claude, an AI assistant made by Anthropic, helps us read and answer support email and look up orders. It sees what you write to us and the details of your order while we work on your request.

PostHog in checkout. Our checkout also tells PostHog when you start checkout, add payment details and complete your order, with the order’s ID, products and total, the ad or email tags and the page version. It sends no name, email address, phone number or postal address. It runs only where Shopify allows analytics: in the EU, the EEA and the UK, only after you accept our cookie banner.

We do not record your screen. Session replay is switched off. There is no video of your mouse, no keystroke capture, and no reading of what you type into a form before you submit it.

What is saved with your order

When you tap a buy button, the link to checkout carries a few details, and Shopify saves them with your order: which version of our page you saw, whether you were browsing inside a social media app, and the tags of the ad or email that brought you here (the utm tags and the ad’s click ID), with when and on which page you first arrived. They tell us which ad or email led to a sale. We keep those tags in your browser for up to 7 days, so they still count if you come back and buy later. If your device’s time zone suggests you may be in Europe and you have not accepted our cookie banner, or your browser sends a Global Privacy Control signal, we leave the tags and the first-visit details off and do not keep them in your browser. Our own test orders also carry a test flag.

The legal basis for each of these

This is the part a general policy cannot give you, because it depends on choices we made.

  • Performing our contract with you: taking the order, taking payment, delivering the files, honoring the guarantee, answering support.
  • Your consent: marketing emails you sign up for on our pages. In the EU, the EEA and the UK also analytics and advertising: our cookie banner asks first, and PostHog and the Meta pixel run only after you accept. PostHog also waits for that yes whenever your device’s time zone suggests you may be in Europe. You can change your choice at any time with the Cookie preferences link at the foot of every page. Withdrawing consent does not affect what happened before.
  • Our legitimate interests: outside the EU, the EEA and the UK, understanding how the page is used so we can improve it, and measuring whether our advertising works (PostHog, Meta and the details saved with your order). Everywhere, preventing fraud and abuse and keeping bots out of our forms. Emails to our customers about our own similar products: the box at checkout is ticked for you, you can untick it there, and every email has an unsubscribe link (Austrian TKG § 174(4)). We weighed these against your interests, which is why session replay is off and why we collect no more than the funnel needs. You can object at any time: see Your choices below.
  • Legal obligation: keeping invoices and accounting records under Austrian tax law.

How long we keep it

Order records, invoices and accounting records, including the details saved with an order: seven years, because Austrian tax law requires it. Analytics events: up to 84 months, and they are not used to build a profile of you as a named individual. The ad tags kept in your browser: up to 7 days. Marketing subscriptions: until you unsubscribe, plus a suppression record so we do not email you again by mistake. Support emails: as long as they remain useful, then deleted.

Where your data goes

The providers named above process data in the United States and other countries outside the EEA. Transfers rely on an adequacy decision of the European Commission, including the EU-US Data Privacy Framework where the provider is certified, or on the Commission’s Standard Contractual Clauses. You are entitled to a copy of the safeguards we rely on: email us and we will send it.

Meta and us: joint responsibility

For collecting the pixel and purchase events on our pages and sending them to Meta, Meta Platforms Ireland Limited and we are joint controllers under Art 26 GDPR. We are responsible for having a legal basis for collecting the data and sending it to Meta, for telling you about it (this section), and for making this summary available. Meta is responsible for its own security, for keeping records of the processing, and for handling your requests about the data once it has arrived. What Meta does with the data afterwards is Meta's own responsibility, not ours. You can exercise your rights against either of us; whichever one you contact, the request is valid.

Your choices

Unsubscribe from any marketing email with the link at its foot. Order and delivery emails are not marketing and will still reach you.

Use the Your privacy choices link at the foot of every page to opt out of data sharing for advertising, and the Cookie preferences link to change your cookie choice. If your browser sends a Global Privacy Control signal, PostHog does not run on our pages, and we record that you have opted out of data sharing, which keeps the Meta pixel from running in your browser. You can also adjust the ads Meta shows you in your Facebook or Instagram settings, and block or delete cookies in your browser.

If you live in the United States

Sending visit and purchase events to Meta so it can match a sale to an ad counts as sharing personal information for cross-context behavioral advertising under several US state privacy laws. We say that plainly rather than leave you to infer it. It is not a sale: no money changes hands for your data, in either direction.

In California, Colorado, Connecticut, Virginia and other states with a privacy law, you have rights to know what we hold, to delete it, to correct it, and to opt out of sharing for targeted advertising. We will not give you a worse price or a worse product for using any of them. Email us or use the Your privacy choices link.

If you are in Washington State. Some of what Exact Words covers may be treated as consumer health data under the My Health My Data Act, including where that status is inferred from which pages you looked at rather than from anything you told us. We collect that data only to sell you Exact Words and to measure the advertising that brought you here. We do not sell it. You may ask us to delete it, and we will delete it from our own systems and instruct our providers to do the same, by emailing support@exact-words.com. The providers who receive it are named in The tools that run here above.

Your rights, wherever you live

You can ask us for a copy of your data, ask us to correct it, ask us to delete it, ask us to restrict or stop a particular use, object to processing based on legitimate interests, and ask for your data in a portable format. Email support@exact-words.com. You will not be charged and you do not need to explain why. We reply within two business days and complete your request within one month at the latest.

If you think we have handled your data badly, please tell us first. You can also complain to a data protection authority. Ours is the Austrian Data Protection Authority (Österreichische Datenschutzbehörde, Barichgasse 40-42, 1030 Vienna, dsb.gv.at). You may also complain to the authority where you live.

Automated decisions

We do not make any decision about you by automated means that produces a legal or similarly significant effect. Advertising platforms choose which ads to show you using their own systems, which you control in their settings.

Children

This is a product for working adults. It is not directed at children and we do not knowingly collect data from anyone under 16. If you believe a child has given us data, email us and we will delete it.

Changes

If we add a tool or change what we collect, we update this page and the date below. Material changes will be obvious, not buried.

Last updated September 30, 2026.