Last updated 5 August 2026
Holdfast is a Shopify app operated by Fineprint Labs. It migrates a merchant's legacy checkout tracking scripts to Shopify Web Pixels and forwards purchase events to the analytics and advertising platforms that the merchant configures.
When a merchant activates the app, we process order-level commerce data for each completed checkout:
We do not request, receive, or store customer names, email addresses, phone numbers, or postal addresses. The app is configured for order-level data only, and Shopify withholds those fields from it.
We also store the merchant's own configuration: shop domain, destination platform identifiers, and any API credentials the merchant supplies for their own analytics accounts.
Solely to deliver the service the merchant installed the app for: forwarding purchase events to the merchant's own analytics and advertising destinations. We do not sell data, share it with third parties for their own purposes, build cross-merchant profiles, or use it to train models.
Purchase events are transmitted only to the destinations the merchant configures — for example Google Analytics 4, Meta, or TikTok. Those platforms process the data under their own privacy policies and the merchant's account terms.
Purchase events are forwarded in real time. We retain a short activity log of order identifiers, values, and delivery status so merchants can confirm their tracking is working; it holds no customer personal data. Merchant configuration is retained while the app is installed. If you uninstall, it is held briefly so that reinstalling restores your setup, and is then erased in full — the activity log, your configuration, and your sessions — when Shopify sends the shop redaction request that follows an uninstall.
Credentials a merchant provides are stored server-side and are never exposed in storefront or checkout code. All transmission occurs over HTTPS.
We honour Shopify's mandatory privacy webhooks. On a customer data request or customer redaction request we confirm that no customer personal data is held. On a shop redaction request we delete the shop's stored configuration, activity log, and sessions.
Merchants installing Holdfast are covered by our Data Processing Agreement, which sets out our role as processor, the categories of data, security, retention, and sub-processors.
Questions or requests: saviswarup@gmail.com