Privacy policy — B2B Gold

What this policy covers

This page covers b2bgold.app, the website you are reading. It is not the policy for any app or extension.

Each product runs somewhere else — inside your Shopify store, or inside your browser — handles different data, and publishes its own policy. Those policies govern. The summaries further down exist so you can compare the products without opening every product’s documents, and each one carries the date printed on the document it came from. Where a summary and a product’s own policy disagree, the product’s policy is the one that counts.

What this website collects

Nothing. Not as a policy position — there is no mechanism.

No cookies. The site sets none, of any kind, for any purpose. There is no consent banner because there is nothing to consent to.
No analytics. No page-view counter, no session recorder, no tag manager, no pixel. Not a cookieless one either.
No third-party requests. Every font, image and stylesheet is served from this domain. The site’s Content-Security-Policy allows scripts, styles, images, fonts and network connections from b2bgold.app and nowhere else, so a third-party request could not be made even by accident.
One small script, for the colour theme. Each page carries one short inline script, and its only job is to apply the colour theme you choose — System, Light or Dark. Your choice is kept in your own browser’s localStorage, under the key theme (choosing System removes it), and is never sent anywhere. The only other <script> tag on a page holds application/ld+json structured data for search engines, which browsers do not execute. The site’s Content-Security-Policy allows that one script by its exact fingerprint, and a build check fails if any other appears, outside the one page below.
One page with a second script: the free tool. The Shopify bot traffic checker also loads one script file from this domain, which reads a CSV file you choose or text you paste and works out its numbers in your browser. The file is never uploaded, stored or sent: that page’s Content-Security-Policy forbids its scripts to open any network connection, and closing or reloading the tab discards the data. It is the only page allowed a script file, and the same build check enforces that.
Nothing to submit. There are no accounts, no sign-up, no checkout and no search box. The tool’s file picker and text box send nothing anywhere, and no other page has a form.

The pages are static files served from Cloudflare’s network. No application code of ours runs when you request one, so there is nothing on our side that could record your visit — no server-side logging we operate, and no database for a visit to land in. Cloudflare handles the request itself, as the network delivering the file.

If you email the studio, we keep the conversation, and we use it to answer you. Nothing else.

What is true of every product

Five things hold across the products, each of them stated in the products’ own policies. Everything else — where data is stored, for how long, and who else touches it — differs enough per product that a studio-wide answer would be wrong for at least one of them, which is what the next section is for.

Nothing is sold. X Shield, UpBar, Avis and Ori each say so in their policies. All Pixel Helper itself sends nothing off your device. cPixel transmits only to the advertising platforms you connect, at your direction.
Your store’s data is yours. For the Shopify apps you are the controller and each app is your processor: it acts on your instructions, which are the settings you choose. Telling your own customers what you have installed, and collecting any consent your jurisdiction requires, is your responsibility rather than ours — all five Shopify products say so in writing.
Shopify’s mandatory privacy webhooks are implemented by all five Shopify apps: customer data request, customer redaction and shop redaction. When a customer asks you for their data or asks to be erased, and when you uninstall, Shopify notifies the app and the app acts on it.
Data is encrypted in transit with TLS and encrypted at rest. X Shield, cPixel and Ori each add that production access requires hardware-backed passkeys rather than passwords.
Nothing here is aimed at children. X Shield, All Pixel Helper and Ori say under 13 explicitly; UpBar states its service is directed at merchants, and Avis that it is a business tool not directed at children. These are tools for merchants and for the people who debug their tracking.

What each app and extension does

One entry per product currently published, in the order the site lists them. Each summary is taken from that product’s own policy and dated to it.

Avis

Avis Product Reviews App on the Shopify App Store · summary as published 20 October 2026

Two roles. For your customers’ data — reviewer names and email addresses, review content, order references and review requests — you are the controller and Avis is your processor, acting only on your instructions under its Data Processing Agreement. Your own account data — store domain, owner name, contact email, plan and billing state, and support email — Avis holds as controller. Both documents name a sole trader trading as Avis as the party responsible.

What it handles

What a shopper sends with a review, a question or an answer: the name they type, their email address if they give one, the rating, title and text, any photos or videos, and the product. A review written from a review-request link also records the order reference, so it can be labelled a verified purchase. Only a salted hash of the shopper’s IP address is stored, never the address itself.
For review requests, the order’s customer name, email address, order reference, products, language, customer tags and shipping country, sent by Shopify when an order is paid, fulfilled or delivered. The country is used only to time the email and choose its language; nothing else from the shipping address is kept.
Opens are recorded only for customers who accepted email marketing. Every email carries a one-click unsubscribe, and an opt-out is kept as a hash of the address, never the address.
Review photos and videos are uploaded straight into your own Shopify Files, and the star ratings, review counts and the first page of reviews on each product are written to your store’s own metafields.
With AI features on, review text, ratings, product titles, your replies and a reduced 640-pixel copy of review photos are processed by AI models: Cloudflare’s Workers AI, and Google’s Gemini for the review summary. When you import a file Avis doesn’t recognise, Gemini also matches its columns, seeing sample values only from columns that can’t identify a person. Reviewer names, email addresses, order references and customer IDs are never sent to a model.
Services you connect yourself — Klaviyo, Omnisend, Mailchimp, Slack, Gorgias, Shopify Flow, your own webhooks, and Google Merchant Center through the reviews feed — receive only the events you choose. They are your providers, not Avis’s sub-processors.
No phone numbers, postal addresses, payment card data or raw IP addresses are collected, and the storefront widget sets no advertising cookies and loads no third-party trackers.

How long it keeps it

Store record and access tokens: while the app is installed, deleted within 48 hours of uninstall.
Reviews, questions and the moderation log: while the app is installed, deleted on Shopify’s shop-redaction request, which Shopify sends 48 hours after uninstall.
Review-request records: 90 days after the request completes, is cancelled, fails or the customer unsubscribes; one emailed but never answered, one year after its last email.
Follow-up and notification emails: 90 days after they are sent or cancelled.
Deliveries to connected services: 30 days, or 90 days for those that failed.
Operational logs: up to 30 days, with no personal data in them.
Unsubscribe records: indefinitely, as a hash of the email address, so an opt-out stays an opt-out.
Free-period record: a numeric store ID and the date the store first used Avis while every feature was free, kept after uninstall indefinitely, so a store that joined during that period keeps those features when paid plans return, also after a reinstall. It contains no personal data.
Support correspondence: up to 2 years.
Star ratings, review counts, the first page of reviews saved on each product and the review photos and videos in your Files stay in your Shopify account after uninstall, because they are yours.

Shared with. Cloudflare, Inc. (hosting, database, email delivery and Workers AI) and Google LLC (the Gemini model behind the review summary and the matching of imported files, which never receives a reviewer’s name, email address, order reference or customer ID), with 30 days’ notice before a sub-processor is added. Shopify is listed in the DPA for completeness. Operational alerts to Avis’s own team go through Telegram and carry no shopper data.

Where it is processed. Cloudflare’s global network, including the United States, and Google’s processing of Gemini requests in the United States and other countries, under the EU Standard Contractual Clauses and the UK Addendum.

Its own documents. Avis privacy policy · Avis Data Processing Agreement

cPixel

cPixel Facebook Pixel CAPI GA4 on the Shopify App Store · summary as published August 2026

You are the controller, B2B Gold is the processor, and your instructions are the platforms you connect and the settings you choose. The advertising platforms themselves are independent controllers or your own processors under your agreement with them — not sub-processors of ours.

What it handles

Online identifiers: advertising click identifiers and platform cookies.
Technical data: IP address and browser user agent.
Transaction data: order value, currency, line items, order and checkout identifiers.
Customer email address and phone number, SHA-256 hashed on your store before transmission and never sent in readable form. The Shopify customer id is hashed for Meta and OpenAI Ads, and carried unhashed only in Google Analytics 4’s user_id field, the one form that platform accepts.
Those customer identifiers are sent only while Shopify’s Protected Customer Data approval is in force. The restriction is enforced in code: without the approval they are withheld and matching falls back to click identifiers, IP address and user agent.
Customer names and postal addresses are not processed at all. They are neither requested from Shopify nor sent to any platform. No special-category data is processed.

How long it keeps it

Event data: not stored — transmitted and discarded.
Match data (click identifiers, cookies, IP, user agent): 7 days.
Queued order identifiers: 7 days.
Reconciliation records: 45 days.
Live debug sessions: not stored — redacted, streamed to your browser, discarded.
Store configuration and credentials: until uninstall, then deleted on shop redaction.
Free-period install record (the store’s myshopify.com domain, a date and its source; no customer, order or event data): kept after uninstall and shop redaction, so a store that installed while the app was free keeps the free plan if paid plans return; deleted on your request.

Shared with. Cloudflare, Inc. for all compute, database, storage and email delivery. Notice is given before a sub-processor is added, and you may object.

Where it is processed. Cloudflare’s global network, under Cloudflare’s own processing terms and transfer mechanisms.

Ori

Ori Order Printer: PDF Invoice on the Shopify App Store · summary as published October 2026

Two roles. Order and customer data is yours: Ori processes it on your instructions as your processor, and telling your own customers about it is yours to do. Your store details, settings and the store owner’s email address B2B Gold holds as controller, to run the app and support you.

What it handles

Store details Shopify shares with the app (store name, contact email, the owner’s name and email, billing address, currency, tax display), and the business details you enter to print on documents: company name, address, phone, email, representative, website, invoice registration number or tax ID, legal details and social accounts. No bank, card or other payment details.
Your seal, logo and background images, designs, numbering, automation rules and email templates, and the support requests you send with their attachments.
When you issue a document — by hand, in bulk or by an automation rule — what the document needs from that order: order number and dates, line items, prices, taxes, discounts, shipping, payment and fulfilment status, and the customer’s name, company, billing and shipping address, email, phone and, where present, tax and customer numbers. The issued PDF and a record of it are stored in your archive.
A document you email goes to the customer’s email address on the order, from Ori’s sending address, with the reply-to address you set.
With customer self-issue on, a customer issuing a receipt for their own order on the thank-you or order status page: Ori receives the order through Shopify’s signed session and only the name and description the customer types.
A sample document you upload for AI Template Import goes to an AI analysis provider, together with PDFs of the candidate designs built from it, which can carry your seal, logo, registration number and other business details from Settings. Nothing from your orders is sent. The upload is kept privately and is not used to train the provider’s models.
Once, at install, the IP address and country of the browser that installed the app, sent to the team’s internal notice. Ori does not track storefront visitors or set cookies on your storefront.

How long it keeps it

Issued documents and their records: for at least the retention period you choose in Settings, 7 or 10 years, every version of a reissued document included. They are kept after you uninstall, and an export of the archive, of at most 5,000 documents, is prepared then and sent to you on request.
Settings, designs and images: while the app is installed and, after an uninstall, alongside your archive so that a reinstall restores them.
AI Template Import uploads and what was read from them: deleted when you save or discard the import, or when the file is refused. For an import nobody finishes, a one-day storage expiry rule and a daily clean-up remove them, which can take about two days.
Automation run logs: 90 days for runs that completed; failed runs are kept.
Support requests: closed ones and their files one year after closing, and all of them once Shopify asks for your shop’s data to be erased after an uninstall.
Documents that name a customer who asks to be erased are tax records you must keep, so they are retained unaltered for at least the retention period and used for nothing else.

Shared with. Shopify, the platform the app runs on, and service providers bound to process data only on B2B Gold’s instructions: infrastructure providers for hosting, storage, background processing and email delivery; an AI analysis provider for AI Template Import only, which receives the upload and PDFs of the designs built from it; and an internal messaging provider for notices to the team, which never carry order or customer details. The policy names none of them; their names are available on request.

Where it is processed. Japan, the United States, the European Union, Vietnam and other countries where its processors operate, under standard contractual clauses and equivalent safeguards.

Its own documents. Ori privacy policy

UpBar

UpBar: Free Shipping Bar Goal on the Shopify App Store · summary as published October 2026

UpBar stores no personally identifiable information about your customers or shoppers. It holds shop-level records only.

What it handles

Your Shopify shop domain and the Shopify-issued offline access tokens used to keep the app working between sessions.
Your app settings — bar content, free-shipping thresholds, per-country display rules. These are stored as a metafield on your shop, inside your Shopify account, not in a separate database here.
An approximate visitor country or region, determined at request time to pick which shipping estimate to show. It is not stored and not linked to a person.
Permission scopes are limited to reading your theme and reading and writing files. The app does not request access to your customers, orders, Markets or shipping settings.

How long it keeps it

Shop records and access tokens: deleted within 48 hours of uninstall.
App configuration: removed when you uninstall or delete it, since it lives in your own Shopify metafield.
Free-access record: if you install UpBar while it is offered free with every feature, your shop domain, Shopify store ID and the date you joined are kept after you uninstall, including after a shop redaction request, so your store keeps free access to those features if paid plans are introduced later. It holds nothing about you as a person, your customers or your orders. It is deleted when you ask, and your store then loses that free access.
Operational and webhook logs: up to 90 days.
Support conversations: up to 2 years.
Anonymised or aggregated statistics: may be kept indefinitely.

Shared with. The policy names cloud hosting and infrastructure providers bound by data protection agreements, without listing them individually.

X Shield

X Shield Fraud Country Blocker on the Shopify App Store · summary as published October 2026

Two roles at once. Storefront and order data is yours and is processed on your instructions. Your store details, settings and the store owner’s email address are held by B2B Gold as controller, to run the app and support you.

What it handles

A security event for each storefront page load: the visitor’s IP address, the country, continent and city derived from it, the network behind it (ASN, provider, threat score), the browser user agent, the page and referring URL, a timestamp, and identifiers the app generates for the visitor and the session.
Where a visitor is signed in and your storefront exposes it, the Shopify customer id, display name and email address, so a blocked visit can be traced back to a real account and so access and erasure requests can be answered.
Your store domain, plan, install status and every rule you configure. Blocking decisions are made in the visitor’s browser; the app does not read form input or payment details.
Sessions on the app’s own admin pages are recorded with Microsoft Clarity. The only identifier sent is your myshopify.com domain, never the owner’s name or email, and it does not run on your storefront.
Order data only if you switch order protection on: each new order’s IP address, customer identifiers and Shopify’s fraud signals, written back to the order as an assessment. It never cancels or refunds an order.
Only if you set a protection to ask visitors to verify they are human instead of blocking them: the visitor is shown a check from Cloudflare Turnstile, served from the app’s own domain. Cloudflare receives technical signals from the visitor’s browser and connection, such as the IP address, browser user agent and TLS fingerprint, to run the check, and also uses them as an independent controller, under its Turnstile Privacy Addendum, to improve its bot detection. A visitor who passes gets a signed token holding your store’s identifier, their IP address and its issue and expiry times, stored only in their browser; the app keeps no copy and its verification service does not log the IP address. Whether a visitor was asked, and whether they passed, is recorded with the security event.

How long it keeps it

Raw security events: 90 days, dropped automatically day by day.
Aggregated dashboard and report counts: 90 days.
Human-verification tokens: only in the visitor’s browser, valid for the period you choose, from 1 hour to 30 days. No copy is held.
App configuration and merchant settings: deleted within 48 hours of uninstall.
Privacy request records, including anything exported: up to 180 days.
Merchant contact details: while you are subscribed, deleted within 30 days of opting out or uninstalling.
Support conversations: 2 years.

Shared with. Shopify, Google Cloud (BigQuery), MongoDB, Railway, Cloudflare (including the Turnstile human check, if you turn it on), Brevo, and Microsoft (Clarity, on the app’s admin pages only) — each under a data-processing agreement. For Turnstile, Cloudflare is also an independent controller, to improve its bot detection.

Where it is processed. The United States, the European Union and Vietnam, under standard contractual clauses and equivalent safeguards.

All Pixel Helper

All Pixel Helper - Tag, dataLayer & Consent Debugger on the Chrome Web Store · summary as published September 2026

The extension collects, transmits and sells nothing. It runs entirely on your device, and it has no network code that contacts any backend.

What it handles

Outbound requests are observed through Chrome’s webRequest API, which lets the extension see requests but not block or change them. Only requests matching a built-in list of advertising and analytics endpoints are decoded; everything else is ignored. Nothing is blocked, modified or redirected.
Page-side JavaScript globals such as window.fbq, window.gtag, window.dataLayer and window.ttq are read to detect which pixels are installed, and consent banners are queried for their current state.
To show dataLayer activity, a script on each page creates an empty window.dataLayer if the page has none and copies each dataLayer.push() to the extension. That changes the page, but sends nothing anywhere.
The Tools tab acts only when you use it. It can load a Google Tag Manager container into the page, which fetches Google’s script, or push an event into the page’s dataLayer. Either can make the page’s own tags send data to their vendors, including conversions to live ad accounts.
Performance timing entries are read for known pixel script URLs, to flag scripts that load after the page completes.
Access to all URLs is requested because pixels can fire on any domain and the extension cannot know in advance which sites you will debug.

How long it keeps it

Captured events live in chrome.storage.session, which Chrome wipes when you close the browser.
A bounded buffer of at most 500 events per tab. Nothing is written to disk-persistent storage.
No cookies, no localStorage, no IndexedDB.

Shared with. Nobody. No third-party SDK or service is embedded or called at runtime, and no telemetry, crash report or usage analytic is sent anywhere.

Core Web Vitals (iframes)

Core Web Vitals (iframes) on the Chrome Web Store

No summary is published here yet. Its Chrome Web Store listing is the authoritative source for what this extension does with your data.

HTTP Header Modifier

HTTP Header Modifier on the Chrome Web Store

No summary is published here yet. Its Chrome Web Store listing is the authoritative source for what this extension does with your data.

Making a data request

If you are a shopper and want to know what a store holds about you, ask the store. The merchant is the controller; Shopify has a built-in flow for exactly this, and it reaches every installed app through the mandatory webhooks above.

If you are a merchant, you can raise a request through Shopify or write to us directly to access, correct, export or delete data, or to object to processing. X Shield’s policy is the most explicit about how these are handled: a person reviews each request before anything is exported or erased, and it is completed within the 30-day statutory deadline.

For All Pixel Helper there is nothing to request. Everything it captures sits in session storage on your own machine and Chrome discards it when you close the browser.

Changes to this policy

The date at the top of this page changes whenever this page does. A material change to a product’s own policy is announced inside that product — that is what X Shield, UpBar and Ori commit to — and All Pixel Helper’s policy is versioned alongside the extension itself.

Contact

Privacy questions about this website or about any product go to support@b2bgold.app. A product’s store listing also carries its own support route, which is faster for anything specific to that app.

B2B Gold is established in Ho Chi Minh City, Vietnam. The terms of use cover the rest.