Privacy Policy

Tutti is operated by Profox Pty Ltd (trading as Tutti), 1/22 Westpool Drive, Hallam, VIC 3803, Australia ("Tutti," "we," "us"). This policy applies to tutti.haus, app.tutti.haus, and any successor domain Tutti operates the service from.

Tutti serves Shopify store owners directly — you sign up, connect your own tools, and use the dashboard. But some of the data Tutti processes belongs to your customers, not you: the Tutti Pixel installed on your storefront (see below) captures browsing and click data from the people who shop at your store.

For that second category, you (the merchant) are the data controller and Tutti is a data processor acting on your instructions — the same relationship you already have with Shopify, Google Analytics, or any other tool installed on your storefront. Tutti processes your end customers' data only to power the attribution features you've enabled, and you remain responsible for your own store's privacy notice to your shoppers.

Account data

Signing in to Tutti uses Google OAuth (via Auth.js) exclusively — there's no separate password. We receive your name, email address, profile picture, and Google account identifier from Google, and store enough to keep you signed in and to identify your workspace.

Data from the tools you connect

Tutti is read-only against every third-party platform it connects to — it fetches data to power your dashboard and never writes back to Shopify, Meta, or Google, with the one explicit exception described in "Sending data to Meta" below. When you connect a platform, we access (via OAuth) roughly:

• Shopify — your orders, order line items, customer names/emails/phone numbers on those orders, products, and store details like currency and timezone.
• Facebook Ads (Meta) — your ad account's campaigns, ad sets, ads, spend, and performance metrics.
• Google Ads — the same, for your Google Ads account.
• Google Analytics 4 (GA4) — session and channel-level traffic data from your property.

The OAuth access and refresh tokens that grant this access are encrypted at the application layer (AES-256-GCM) before they're ever written to our database — even direct database access doesn't expose a usable token.

The Tutti Pixel — data from your storefront visitors

Once Shopify is connected, a first-party tracking pixel is installed on your storefront (a Shopify Web Pixel Extension). It captures, from your shoppers' own browsers: pages and products viewed, searches, cart activity, checkout steps, the completed order, and whatever brought the shopper there — ad click identifiers (Meta's fbclid, Google's gclid), UTM parameters, referring page, and browser/device details. It sets a first-party cookie on your store's own domain to recognize a returning visitor within one browsing session. This never uses fingerprinting or any technique designed to identify a visitor without a real, first-party cookie or identifier.

Data we derive

From the data above, Tutti computes attribution matches (which channel likely earned a sale, with a confidence score and a plain-language reason), health-check findings, dashboard metrics, and activity logs. This derived data is stored so your dashboard doesn't need to recompute it on every page load.

Ask Tutti conversations

Messages you send to the "Ask Tutti" chat assistant, and the assistant's replies, are stored so your conversation persists across sessions. Answering a question may involve Tutti sending relevant workspace data (e.g. recent orders, campaign performance) to Anthropic's Claude API to generate a response — see "Third parties we share data with" below.

• To run your dashboard — blended revenue, spend, ROAS, and per-channel breakdowns.
• To match each sale to the channel that most likely earned it, and show you how confident that match is.
• To run background health checks and propose Tasks worth your attention.
• To power the Ask Tutti chat assistant, which can query your own connected data to answer questions.
• To keep your integrations working — refreshing tokens, syncing new orders, registering webhooks.
• To operate, secure, and improve the product, and to communicate with you about your account.

Tutti has one feature that sends data to a third party rather than only reading from it: if you explicitly turn on Conversions API (CAPI) sync in Settings and provide a Meta Pixel ID, Tutti automatically reports purchases it has already matched to a real Meta ad click back to Meta's advertising system, so Meta's algorithm can learn from real, confirmed sales.

Tutti doesn't sell your data. We share data with the following categories of third parties, each strictly to provide the service:

• Google — for sign-in (OAuth), and for Google Ads/GA4 data if you connect those.
• Shopify, Meta (Facebook/Instagram Ads) — to read the data you've explicitly connected, and to send hashed purchase data back to Meta only if you've turned on CAPI sync.
• Anthropic — the Ask Tutti chat assistant is powered by Anthropic's Claude models; relevant workspace data may be sent to Anthropic's API to generate a response to your questions.
• Vercel — hosts the application and runs its scheduled background jobs.
• Neon — hosts the Postgres database Tutti's data is stored in.

We may also disclose data if required by law, or to protect the rights, property, or safety of Tutti, our customers, or others.

If you invite a team member to your workspace, they see the same connected accounts, dashboards, Tasks, attribution data, and Ask Tutti conversation you do — it's one shared workspace, not separate copies per person. Only the workspace owner can connect or remove an integration, or invite/remove team members. See our Team Members documentation for the full model.

A small, explicitly allowlisted set of internal Tutti accounts can view limited, aggregated cross-workspace data (e.g. subscription status, connection health, error rates) through an internal admin panel, for legitimate business operations like support and monitoring service health — not general browsing of individual customers' attribution data or connected-account content.

OAuth access and refresh tokens for every connected platform are encrypted at the application layer (AES-256-GCM) before being stored — not stored in plaintext in our database under any circumstance. Data in transit uses HTTPS. Access to production data is limited to what's needed to operate the service. No method of storage or transmission is 100% secure, and we can't guarantee absolute security, but we take reasonable, real technical measures to protect your data.

We retain your data for as long as your account is active. If you delete your account (available directly from Settings), the deletion is real and immediate — every connected account, every piece of derived attribution data, every Task and activity log, and your login itself are permanently removed in one operation. This can't be undone, and there's no way for us to restore it afterward. If you leave a workspace as an invited team member instead, only your own login and membership are removed — the workspace owner's data is untouched.

Depending on where you're located, you may have rights to access, correct, export, or delete your data. In practice:

• Access & export — your dashboard already shows your real data directly, and several views (Live Orders, the Attribution table) support CSV export.
• Correction — connected-platform data reflects the source platform (e.g. Shopify); update it there and Tutti's next sync will reflect it.
• Deletion — a real, working "Delete account" flow is available in Settings, described above.
• Opt-out of the Meta CAPI sync — turn it off any time in Settings; it's off by default.

To exercise any right not covered by the in-app tools above, contact us using the details below.

Tutti is a business tool for Shopify store operators and isn't directed at children. We don't knowingly collect personal information from anyone under 16. If you believe a child has provided us with personal information, contact us and we'll remove it.

Tutti is operated from Australia. The infrastructure providers we rely on for hosting (Vercel) and database storage (Neon) may process and store data in countries other than your own. By using Tutti, you understand your data may be transferred to and processed in other countries, which may have data protection laws different from those in your own country.

We may update this policy as Tutti's product changes. We'll update the "Last updated" date above when we do, and for material changes we'll make a reasonable effort to notify you directly (e.g. by email).

Questions about this policy or your data can be sent to tsaar@maltandbrew.com, or by mail to Profox Pty Ltd, 1/22 Westpool Drive, Hallam, VIC 3803, Australia.