Cookies and tracking

Our Privacy policy covers how a Shopify store handles your data in general. This page covers the specific tools we chose to run, what each one collects, and the legal basis for it. Between the two you have the whole picture. If anything here contradicts the Privacy policy, the more specific statement on this page is the one we stand behind.

Who is responsible

Emanuel Chereji, sole proprietorship (Einzelunternehmen), Hofmannsthalweg 20, 4030 Linz, Austria. Email support@exact-words.com. Full business details are in our Legal notice. Because we are established in the EU, the GDPR applies to everything below, wherever you live.

The short version

To sell you a digital book we need your email address and a payment. To know whether our advertising pays for itself, we measure which pages and buttons people use, and we tell Meta when a purchase happens. We do not record your screen, we do not sell your data for money, and every tool is named below.

The tools that actually run here

  • Shopify hosts the store, runs the checkout, and processes payments. Card details go to Shopify Payments and its processors. We never see or store them.
  • PostHog is our product analytics, hosted in the United States. It records pages viewed and when you leave them, how far you scroll, which buttons and FAQ items you click, whether you tick the Documentation Vault box, your device, browser, screen size and language, and page performance. It receives your IP address and derives an approximate location at country and city level from it. IP addresses are not anonymised in our current configuration. PostHog does not receive your name.
  • Meta pixel and Conversions API. A Meta pixel reports page views, add to cart, checkout started, payment information added, and purchases. Separately, our store sends those same purchase events to Meta from the server, including a hashed version of your email address, so Meta can match the sale to the advertisement you clicked. That is how we find out whether an ad is worth paying for.
  • Digital Downloads, a Shopify app, delivers your files and sends the download email.
  • Shopify Email and Shopify Flow send order confirmations and, if you agreed to them, our marketing emails. Links in our marketing emails carry campaign tags so we can see which email led to a visit.

We do not record your screen. Session replay is switched off. There is no video of your mouse, no keystroke capture, and no reading of what you type into a form before you submit it.

The legal basis for each of these

This is the part a general policy cannot give you, because it depends on choices we made.

  • Performing our contract with you: taking the order, taking payment, delivering the files, honouring the guarantee, answering support.
  • Our legitimate interests: understanding how the page is used so we can improve it, measuring whether our advertising works, and preventing fraud and abuse. We weighed these against your interests, which is why session replay is off and why we collect no more than the funnel needs.
  • Your consent: marketing emails, and advertising and analytics technologies where consent is required. You can withdraw consent at any time, and withdrawing it does not affect what happened before.
  • Legal obligation: keeping invoices and accounting records under Austrian tax law.

How long we keep it

Order records, invoices and accounting records: seven years, because Austrian tax law requires it. Analytics events: up to 84 months, and they are not used to build a profile of you as a named individual. Marketing subscriptions: until you unsubscribe, plus a suppression record so we do not email you again by mistake. Support emails: as long as they remain useful, then deleted.

Where your data goes

Shopify, PostHog and Meta process data in the United States and other countries outside the EEA. Transfers rely on the European Commission's Standard Contractual Clauses, or on the EU-US Data Privacy Framework where the provider is certified. Ask us and we will point you at the specifics.

Your choices

Unsubscribe from any marketing email using the link at its foot. Order and delivery emails are not marketing and will still reach you.

Use the Your Privacy Choices link in the site footer to opt out of data sharing for advertising. Adjust what Meta shows you in your Facebook or Instagram advertising settings. Block or delete cookies in your browser. We honour Global Privacy Control signals where they reach us.

If you live in the United States

Sending purchase events to Meta so it can match a sale to an ad counts as sharing personal information for cross-context behavioural advertising under several US state privacy laws. We say that plainly rather than leave you to infer it. It is not a sale: no money changes hands for your data, in either direction.

In California, Colorado, Connecticut, Virginia and other states with a privacy law, you have rights to know what we hold, to delete it, to correct it, and to opt out of sharing for targeted advertising. We will not give you a worse price or a worse product for using any of them. Email us or use the Your Privacy Choices link.

Your rights, wherever you live

You can ask us for a copy of your data, ask us to correct it, ask us to delete it, ask us to restrict or stop a particular use, object to processing based on legitimate interests, and ask for your data in a portable format. Email support@exact-words.com. You will not be charged, you do not need to explain why, and a human answers, usually within one business day and always within one month.

If you think we have handled your data badly, please tell us first. You can also complain to a data protection authority. Ours is the Austrian Data Protection Authority (Österreichische Datenschutzbehörde, Barichgasse 40-42, 1030 Vienna, dsb.gv.at). You may also complain to the authority where you live.

Automated decisions

We do not make any decision about you by automated means that produces a legal or similarly significant effect. Advertising platforms choose which ads to show you using their own systems, which you control in their settings.

Children

This is a product for working adults. It is not directed at children and we do not knowingly collect data from anyone under 16. If you believe a child has given us data, email us and we will delete it.

Changes

If we add a tool or change what we collect, we update this page and the date below. Material changes will be obvious, not buried.

Last updated 30 July 2026.