Who we are
The Passo Agency is the trading name of Passo Agency Ltd, a company registered in England and Wales (company number 17208051). Our registered office is 5 Croftway, York, YO26 5LU. If you have any questions about this policy, contact us at hello@passoagency.com.
What this policy covers
This page covers the public marketing site at passoagency.com. The privacy notice covering the Shopify merchant app, including merchant data, customer data, and connected ad-account data, is presented during install and is also available on request.
What we collect on this site
This site collects the following data, and only when you give your consent:
- Analytics cookies via Google Analytics 4. These record pages visited, time on page, and approximate location at country or city level. No personally identifiable information is collected.
If you submit your email address to join our waitlist, we store that address solely to notify you when we launch. We do not share it with third parties or use it for any other purpose.
What we collect inside the Shopify app
When a Shopify merchant installs the Passo app, we read order history, customer cohorts, and catalogue data through the Shopify App Bridge under the scopes declared in our App Store listing. We also connect, on the merchant’s explicit instruction and via OAuth, to Google Ads, Meta Ads, and Google Analytics, on a read-only basis. The full breakdown of what we read from each source, why, and how it is protected is published on our data & privacy page.
Legal basis
Analytics cookies on this marketing site are processed on the basis of your consent (UK GDPR Art. 6(1)(a)). You can withdraw consent at any time by clearing your browser’s local storage for this site. Waitlist emails are processed on the basis of your consent to be contacted about the launch. Inside the Shopify app, processing of merchant and customer data is performed on the basis of the merchant’s contractual instruction to us.
How long we keep it
Google Analytics retains data for 14 months by default. Waitlist email addresses are deleted on request, and in any case once the platform has launched and you have either installed the app or unsubscribed. Inside the Shopify app, raw report rows are retained for 13 months rolling and are then aggregated and the row-level detail deleted; encrypted refresh tokens are deleted immediately on disconnect; if you uninstall the app, all merchant data is purged within 30 days, including encrypted backups.
Where the data lives
Inside the Shopify app, all raw and derived data is stored in a Supabase-managed Postgres database in eu-west-2 (EU). Application servers run on Vercel, in the same region. We do not currently process merchant data outside the EU. Marketing-site analytics are processed by Google in accordance with their privacy policy and may be transferred outside the UK or EEA under standard contractual clauses approved by the ICO.
Third parties
We use Google Analytics (operated by Google LLC) on this marketing site. Inside the Shopify app, we use Supabase (storage and database), Vercel (hosting), Stripe (billing), Anthropic (AI narrative synthesis), ElevenLabs (voiced audio), and OpenAI (image generation). A current subprocessor list is available on request.
Your rights
Under UK GDPR you have the right to:
- Access the personal data we hold about you
- Request correction or deletion of your data
- Object to or restrict processing
- Withdraw consent at any time
- Lodge a complaint with the ICO (ico.org.uk)
To exercise any of these rights, email hello@passoagency.com.
Last updated: April 2026.