1. Who we are
Fabrik Analytics is run by JMW Digital MENA LLC, a company registered in the United Arab Emirates at SHAMS Media City, Al Messaned, Al Bataeh, Sharjah, United Arab Emirates, which provides the app, bills subscriptions and is the controller described below. Its UK affiliate, JMW Digital Marketing Ltd, is our contact for UK data protection matters and our representative in the UK under Article 27 of the UK GDPR. In this policy "we", "us" and "our" mean them. Write to us about anything in this policy at privacy@fabrik.ae.
This policy covers three groups of people, and our role is different for each:
- Visitors to fabrikanalytics.com, our website (section 2). We decide what is collected and why, so we are the controller.
- People who use the app at analytics.fabrik.ae, and the businesses they work for (section 3). We are the controller of account, sign-in and billing details.
- Our customers' shoppers, whose data reaches us from the stores and platforms a merchant connects (section 4). We process it on the merchant's behalf, under the Data Processing Agreement the merchant accepts in the app, so the merchant is the controller and we are its processor. A shopper with a question about their data should start with the store.
2. Visitors to our website
Demo requests. When you ask for a demo we collect your name and work email, and optionally your company, website, role, monthly order volume and message. We store them in our database (Supabase, EU) and email them to our team (Resend, then our mailbox on Google Workspace) so we can arrange the demo and reply. Our lawful basis is our legitimate interest in answering a business enquiry. We do not add you to a newsletter or sell your details. We keep a request while we are in touch about it, and delete it on request.
Measurement, with your permission. With your permission, Google Analytics measures how the site is used, and Meta measures whether our ads on Facebook and Instagram led to a visit or a demo request (through Meta's pixel and, with the same permission, Meta's Conversions API from Google's servers). Our lawful basis is your consent, which you can withdraw at any time from Cookie settings at the foot of every page. Without it, neither tool sets a cookie. We use Google Consent Mode in its "advanced" form: if you refuse analytics, Google Analytics still receives cookieless pings (that a page was viewed, with no cookie or identifier stored in your browser), which Google uses for modelled, aggregate figures. The cookie policy lists every cookie by name, who sets it, why and for how long, including _ga and _ga_* (Google Analytics) and _fbp and _fbc (Meta Pixel). We honour Global Privacy Control as a no to marketing.
We never send your name, email address or phone number to Google or Meta. When you request a demo, the measurement records only that a request was made, with the role and order volume you chose.
Hosting. Vercel, which hosts the website and the app, processes your IP address and browser details to serve pages and protect them from abuse. That is our legitimate interest in running a secure site.
3. People who use the app
Accounts. We collect your name, work email, password (stored only as a secure hash by our sign-in provider, Supabase) or Google sign-in, your role, the brands and agencies you can reach, and a record of changes made in the app, such as who changed a setting or someone's access. We use it to provide the app you or your employer signed up for (the contract) and to keep it secure (our legitimate interest). We send service emails, such as sign-in links, invitations and alerts you set up; we do not send marketing email from the app.
Measuring our own marketing, with your permission. When you sign up, we record where your visit came from (the campaign tags of the link you followed, the page you landed on and the site that sent you) and the cookie choice you made on this website or on the sign-up page. With analytics permission we keep your Google Analytics browser and visit ids for 13 months; with marketing permission we keep Meta's browser and ad click ids and your browser's description for 30 days. When you start a trial, open a checkout or pay, our server tells Google Analytics (with analytics permission) and Meta's Conversions API (with marketing permission; Meta hears about your first payment only), so we can see which campaigns bring customers. We send no name, email address or phone number, only those ids and a one-way code made from your account number. Our lawful basis is your consent: you can withdraw it from Cookie settings on the sign-up page, or in the app under My profile, Marketing measurement, and we stop at once and delete the ids. People invited to an account, and our own staff, are never measured this way.
Billing. Subscriptions are paid through Stripe; we do not see or store card numbers. Agency client invoices are issued from Zoho Books. We keep billing records for as long as tax and accounting law requires.
Staff of agencies using the app. An agency can connect its own Teamwork, Xero, Zoho Books and Slack accounts to the app to see its time, pay costs and margins. The agency is the controller of its staff's data; we process it on its behalf, and only people the agency allows can see it.
4. Data from connected stores and platforms
When a merchant connects their store and platforms, we collect:
- Store data, orders, products, inventory, and customer records accessed via the Shopify Admin API using scopes authorised during installation. Street addresses, phone numbers and IP addresses are removed before storage.
- Analytics events, page views, add-to-cart, and purchase events collected through Shopify's web pixel on the merchant's store, only where the store's consent settings allow analytics for that shopper. Email addresses on these events are stored only as a one-way hash.
- Ad platform metrics, spend, impressions, clicks, and attributed revenue from connected advertising accounts.
- Email marketing data from Klaviyo, when a merchant connects their Klaviyo account (section 6).
We aggregate and present this data in dashboards, reports, and alerts to help merchants understand performance and make better decisions. We use it only to provide the service the merchant asked for. We do not sell personal data, and we do not share it for advertising.
5. Data retention
We retain store data for the duration of the merchant's subscription. Storefront events are kept for a fixed time and then deleted: browser pixel events for 90 days, and server-side events for 365 days.
When a merchant uninstalls the app, we disconnect the store straight away and stop collecting data from it. The data already held is kept until Shopify sends us a deletion request for the store (shop/redact), which Shopify does 48 hours after the uninstall. When that request arrives we erase that store's shoppers' personal data and order-level data: the store's customer records, orders, storefront events and sessions, consent records, survey answers, order attribution, and the daily sales figures calculated from them. If the store has installed the app again by then, nothing is deleted.
We keep figures that identify no one: spend and performance from connected advertising accounts (Meta and Google), which do not come from the store, and anonymous totals such as product and traffic figures. Klaviyo data follows its own rule, in section 6: it is deleted 30 days after Klaviyo is disconnected.
6. Klaviyo
Merchants can connect their own Klaviyo account, from Klaviyo's app marketplace or from Settings, Integrations in Fabrik Analytics. The connection uses Klaviyo's OAuth sign-in: the merchant approves it in Klaviyo, and Fabrik Analytics never sees their Klaviyo password or a private API key.
What we read. Access is read-only: Fabrik Analytics never writes to a Klaviyo account. With the permissions the merchant approves, we read the account's name and currency (accounts:read), campaigns, their messages, audiences and performance reports (campaigns:read), flows, their messages and performance reports (flows:read), daily totals of sends, opens, clicks, bounces, unsubscribes and attributed revenue, and deliverability by inbox provider (metrics:read), the HTML of each campaign email (templates:read), and the names and sizes of the lists and segments campaigns were sent to (lists:read, segments:read). We do not read individual subscriber profiles.
How we use it. To show email and SMS performance beside the store's sales, ad spend and margin, on the timeline, in the Media Library and in reports.
Where it is stored. In Fabrik's own database and file storage, hosted by Supabase in the EU (Ireland, AWS eu-west-1). The Klaviyo sign-in tokens are encrypted at rest in a dedicated secrets vault, readable only by the back-end functions that sync the account, and are never shown in the app.
Disconnecting. A merchant can disconnect Klaviyo at any time from Settings, Integrations in Fabrik Analytics, which revokes our access at Klaviyo straight away and deletes our copy of the tokens, or by removing the app in Klaviyo, which we detect at the next sync. Either way, syncing stops.
Retention and deletion. Klaviyo data is kept while Klaviyo is connected. When it is disconnected, the Klaviyo data we hold for that brand (campaign and flow figures, stored campaign emails and their images, audiences, deliverability, and Klaviyo's entries on the timeline) is deleted 30 days later, unless the merchant reconnects before then. A merchant can ask us to delete it sooner by writing to privacy@fabrik.ae.
7. Shoppers' rights, through the store
End customers may request access to or deletion of their data through the merchant, who can initiate requests via Shopify's customer data tools. Shopify passes these requests to us through its mandatory privacy webhooks, and we act on each one when it arrives:
- Access requests (customers/data_request): we gather all the personal data we hold about the customer into one file and email the store owner a secure link to it, valid for 14 days. The file is deleted after 30 days.
- Deletion requests (customers/redact): we delete the customer's record and storefront events, remove their name and email from their orders (street addresses and phone numbers are stripped before orders are stored), and unlink their survey answers from them. Order totals remain in the store's reports without identifying the customer.
Merchants can also erase a customer's data themselves from the app's settings.
8. Security
All data is encrypted in transit (TLS 1.2 or higher) and at rest. Access tokens are scoped to the minimum permissions required; OAuth tokens for connected accounts such as Klaviyo are kept in an encrypted secrets vault. Fabrik staff who can reach merchant data must use two-factor sign-in.
9. Where data is processed, and who processes it
We store and process app data in the EU (Ireland). The services that process data on our behalf are:
- Supabase: database, file storage, sign-in and back-end functions, EU (Ireland).
- Vercel: hosting the app and the website, on a global edge network.
- Resend: transactional email, United States.
- Stripe: subscription billing, United States and EU.
- Google: our company email (Google Workspace), and Google Analytics on the website with your permission.
- Zoho: invoicing for agency clients (Zoho Books).
- Slack: delivering report digests and alerts, only to a Slack workspace the merchant or its agency connects.
Meta receives website measurement data with your permission (section 2) as a separate controller under its own terms.
Connected platforms (Shopify, Klaviyo, Meta, Google Ads, and an agency's Teamwork, Xero, Zoho Books and Slack) are the sources a customer chooses to connect, not sub-processors: we read from them on the customer's instruction.
10. International transfers
App data is held in the EU. Our team works from the United Arab Emirates and the United Kingdom, and some of the services above are in the United States, so personal data can be accessed from or sent to countries outside the UK and the EEA. Where that happens, we rely on the safeguards in each provider's data processing terms: the EU-US Data Privacy Framework and its UK extension where the provider is certified, or the European Commission's Standard Contractual Clauses with the UK's International Data Transfer Addendum.
11. Your rights
UK and EU. You can ask us for a copy of your personal data, to correct it, to delete it, to restrict or object to how we use it, and to receive it in a portable form. Where we rely on your consent, you can withdraw it at any time; on the website, use Cookie settings. You can object at any time to processing based on our legitimate interests.
United Arab Emirates. Under the UAE Personal Data Protection Law you have the same core rights: access, correction, deletion, restriction, objection, portability, and withdrawal of consent.
United States. Where a US state privacy law applies to you, you can ask to know, correct and delete your personal data, and you can opt out of the sale or sharing of personal data for targeted advertising. We do not sell personal data. Using the website's marketing measurement can count as sharing under California law, so it is off unless you allow it, and a Global Privacy Control signal turns it off.
To use any of these rights, write to privacy@fabrik.ae. We reply within one month, and we may ask you to confirm who you are. If your data reached us from a store (section 4), we will pass your request to the merchant, who decides on it, and help them act on it.
Complaints. You can complain to a data protection regulator: in the UK, the Information Commissioner's Office (ico.org.uk, 0303 123 1113); in the EU, the regulator in the country where you live or work; in the UAE, the UAE Data Office. We would welcome the chance to put things right first.
12. Children
Fabrik Analytics is a service for businesses. It is not meant for children, and we do not knowingly collect data from anyone under 18.
13. Changes to this policy
We will update this policy when what we do changes, and change the date at the top. If a change matters to how we use your data, we will tell app users by email or in the app before it applies.
14. Contact
For privacy enquiries, write to privacy@fabrik.ae.