Privacy Policy

Who we are.

Candler Analytics ("Candler", "we", "us") runs Candler at candleranalytics.com and app.candleranalytics.com. We decide how the information in this policy is used, so we're its controller. Reach us at hello@candleranalytics.com or 3278 Deer Ln, Kirbyville, MO 65679.

What we collect.

When you or your team use Candler

• Account details: your name, email address and password. The password is stored only as a one-way hash we can't reverse.
• Store details: store name and address, timezone and currency.
• Team details: the name, email address and role of everyone on the account, including people you invite before they accept.
• From BigCommerce: if you install the Candler app for BigCommerce, BigCommerce gives us the email address and BigCommerce user ID of whoever installs or opens the app, and your store's name, address, timezone and currency. We use them to set up your login and website, and to give your staff their own logins when they open the app.
• From Shopify: if you install the Candler app for Shopify, Shopify gives us your store's name, myshopify.com and store addresses, timezone and currency, whether it's a development store, and the plan you pick for Candler. Whoever opens the app is identified by their Shopify user ID, and the first time they open it, Shopify gives us their name and email address. We use these to set up your login and website, to give your staff their own logins, and to set your plan. We also receive Shopify's privacy requests about your shoppers (see below).
• Billing details: your plan, billing period and subscription status, and the ID Stripe or Shopify gives your subscription. Stripe collects your card and billing address. We can see your card's brand, last four digits and expiry date, your billing address and any tax ID, but never the full card number. If you pay through the Candler app for Shopify, Shopify charges you on your Shopify bill and we see only the plan and its status.
• Excluded addresses: IP addresses or networks your team adds so its own visits aren't recorded, such as your home or shop. They're kept until you remove them. A visit from one of them is dropped when it arrives, and nothing about it is stored.
• Sign-ins: a random sign-in token (stored only as a hash), your browser's user agent, and when you were last active.
• A security log: sign-ins, failed sign-ins and changes to settings, keys and team members. It stores a salted hash of the IP address, never the address itself.
• Server logs: our web server records requests to the app, including the address requested, the browser's user agent and a shortened IP address. The last part of the IP is removed before it's written, so it points to a network, not a device.
• Messages: anything you send us by email.

When you read this site

We use Candler on candleranalytics.com, the same way a store does, so we can see how people use the site and fix what confuses them. It collects what's listed under if a store records your visit, except there are no carts or orders here and no staff notes about you. For this site we're the controller, not a store. It sets the cookies on the cookies page and doesn't store your IP address with your visit. Browsers that send the Global Privacy Control signal aren't tracked, and this opt-out link turns it off in your browser. There are no ad pixels or other analytics, the fonts come from our own server, and the server that sends the pages keeps no log of visits. Cloudflare, which runs our DNS and can carry traffic to our servers, processes your IP address to deliver the page and protect it from attacks. The how-to videos are stored with Cloudflare too, and load from there only when you press play.

How we use it.

• To run your account and the Service, and sign you in.
• To bill you through Stripe, or read the plan you pay for through Shopify, and keep the records tax law requires.
• To send emails the Service needs: signup and password reset links, invitations, receipts, security alerts, and notice of changes to prices, terms or this policy.
• To send the summary emails you choose in Settings: daily, weekly, every two weeks or monthly totals for your websites. Owners get the weekly one for a new website. Each has a link that stops it without signing in.
• To send the alert emails you choose in Settings when something on your store looks broken, such as no orders for longer than usual, and an all clear when it's back. To do that we check your websites' totals against earlier weeks every few minutes. Owners get every alert for a new website. Each email has links that stop that alert, or pause alerts for a day, without signing in.
• To answer you when you write to us.
• To keep Candler secure, stop abuse and fix errors.
• To see, in aggregate, which features get used, so we know what to improve.
• To meet legal obligations and enforce our terms.

If we ever send product news, every email will have a one-click unsubscribe.

Our legal bases in the EU and UK.

• Contract: running your account, billing, and service emails.
• Legitimate interests: security, preventing abuse, fixing errors and improving the product. You can object to these.
• Legal obligation: tax and accounting records, and answering lawful requests.
• Consent: anything we ask your permission for. You can withdraw it at any time.

Who we share it with.

Only the providers that help us run Candler, each under a contract that limits them to that job:

We also share information when the law requires it, to protect people from harm, with professional advisers under confidentiality, or with a buyer if Candler is sold, who would then be bound by this policy.

We don't sell personal information, and we don't share it for cross-context behavioral advertising. We haven't done either in the last 12 months.

If a store records your visit with Candler.

Stores and other websites use Candler to understand how people use them. When they do, the store decides what's collected and why. The store is the controller, and we process the data on its behalf under the Data Processing Addendum. The store's own privacy policy applies to it.

What Candler can record for a store:

• The pages you view, your clicks, how far you scroll, and your mouse position on a computer, about once a second.
• A replay of how the pages looked and changed during your visit.
• Your device type, browser, screen size, language and timezone, the country you're in (from Cloudflare, not stored IP addresses), whether your connection comes from a cloud or hosting network (also from Cloudflare, used to tell people from bots; the network itself isn't stored), and the site or campaign that sent you.
• Carts and orders: products, amounts and the order number.
• A random ID in a cookie that recognizes you when you come back. The cookies page lists every one.
• If store staff add them, your name, email, phone and notes about you.

What it doesn't record: anything you type into a form is masked in your browser before it's sent, and payment card fields aren't recorded at all. Your IP address isn't stored with your visits.

How long it's kept depends on the store's plan and settings. Recordings are kept between 14 and 180 days.

Opting out. Browsers that send the Global Privacy Control signal aren't tracked. A store's opt-out link, its address with ?candler_optout=1 added, turns Candler off in that browser for that store, even if its cookie banner allows analytics. Clearing your cookies resets your ID, and also clears an opt-out.

Shopify stores. On a store that uses the Candler app for Shopify, Candler follows the store's cookie banner: where the store asks for consent, nothing is recorded until you allow analytics, and turning it down stops it. When you ask a Shopify store for your data, Shopify tells us, and we send the store's owners links to whatever Candler holds that's tied to your orders or contact details. When the store asks Shopify to delete your data, we delete your visits, recordings and orders in Candler too.

Your rights over that data. Contact the store. If you contact us instead, we'll pass your request to the store and help it respond. We can't act on that data without the store's instructions.

How long we keep it.

Where it's stored.

Candler's servers and database are in Nuremberg, Germany. Session recordings are kept in Cloudflare's storage in the EU, encrypted with a key that stays on our server. Backups are kept in Germany too, with an encrypted copy in Cloudflare's storage in the EU. We're based in the United States and work on the Service from there, Stripe, Cloudflare and Resend are US companies, and Shopify is a Canadian one. When personal data from the EU, the UK or Switzerland goes to the US, we rely on the European Commission's Standard Contractual Clauses (with the UK Addendum and Swiss changes), or on the provider's certification under the EU-US Data Privacy Framework.

How we protect it.

Connections are encrypted with HTTPS. Passwords are hashed with scrypt. Sign-in tokens, reset links and API keys are stored only as hashes. Each account's data is kept apart from every other's, and access inside an account follows the roles its owner sets. Our servers only accept web traffic and key-based administrator logins, and they install security updates automatically. The security annex has the full list.

Found a security problem? Email hello@candleranalytics.com. Please give us a chance to fix it before telling anyone else.

Your rights.

Wherever you live, you can ask us for a copy of your information, to correct it, or to delete it. You can change most account details yourself in Settings. For anything else, email hello@candleranalytics.com from the address on your account.

EU, UK and Switzerland. You also have the right to object to processing based on legitimate interests, to restrict processing, to receive your data in a portable format, and to complain to your data protection authority.

US states with privacy laws, including California, Colorado, Connecticut, Virginia, Utah, Texas and Oregon. You have the right to know what we collect and why, to get a copy, to correct it and to delete it. You can also opt out of the sale or sharing of personal information and of targeted advertising, though we do neither. We won't treat you differently for using these rights. An authorized agent can make a request for you. We verify requests by matching them to the email address on the account.

For Californians, the categories we collect are: identifiers (name, email, IP address in server logs), commercial information (plan and billing history), internet activity (how you use the dashboard), and account login details. We use them for the purposes in How we use it, and disclose them only to the providers in Who we share it with.

We answer requests within 30 days, or 45 days where US state law allows it, and tell you if we need longer. If we turn down a request, you can appeal by replying to our answer with "appeal". We'll respond within 60 days, and if you're still not satisfied, you can contact your state's attorney general.

Children.

Candler is for businesses and isn't meant for anyone under 18. We don't knowingly collect children's information. Stores may not use Candler on sites aimed at children, under our Acceptable Use Policy.

Changes to this policy.

When we change this policy, we update the date at the top. If a change matters, we'll email account owners before it takes effect.

How to reach us.

Email hello@candleranalytics.com, or write to Candler Analytics, 3278 Deer Ln, Kirbyville, MO 65679.