Andromia Ltd ("we", "us") operates the Servpipe platform — the multi-brand ecommerce infrastructure that powers conversion tracking, Shopify integration, and platform-level operations across multiple brand storefronts. Servpipe is accessible at app.servpipe.net; this policy describes how Andromia Ltd processes personal data through that platform.
Andromia Ltd is registered in England & Wales (company number 15931114). Our registered office is Office 6721, 58 Peregrine Road, Ilford, Essex IG6 3SZ.
Contact: privacy@andromia.works — Andromia Ltd correspondence is on the corporate domain; the Servpipe product runs on app.servpipe.net.
This policy describes how Andromia processes personal data when:
app.servpipe.net domain.This policy does NOT describe how each individual brand operating on Servpipe handles its own customer relationships — each brand has its own privacy policy posted on its own storefront. Andromia Ltd is a data processor acting on behalf of those brands; the brands are the data controllers for their customers.
eso-world.myshopify.com)Conversion events the brand's storefront forwards to us. Each event includes:
fbclid, gclid, ttclid) when presentWe do not receive raw email addresses, phone numbers, payment card details, or other directly-identifying information. Our PII canary middleware actively strips any unhashed personal data that a brand storefront accidentally sends.
Standard web analytics across the Servpipe product surface (app.servpipe.net) and the Andromia Ltd corporate site (andromia.works) — page views, referrer, country-level location. No advertising cookies. No third-party trackers.
| Purpose | Legal basis |
|---|---|
| Operating the Servpipe platform on a brand's behalf | Contract (with the brand) + Legitimate interest |
| Forwarding conversion events to ad platforms (Meta, Google, Klaviyo, etc.) at the brand's direction | Brand's lawful basis (typically consent or legitimate interest) — we act as processor |
| Storing audit logs of our own admin actions | Legitimate interest (security + compliance) |
| Responding to data subject requests | Legal obligation (UK GDPR Art. 15 / 17, CCPA) |
| Marketing andromia.works to potential merchants | Legitimate interest |
Data flows from Andromia onward to ad platforms only at the brand's direction. The platforms each brand activates may include:
Each platform has its own privacy policy. Each brand chooses which platforms to activate via its Servpipe configuration.
| Sub-processor | Purpose | Location |
|---|---|---|
| Hetzner Online GmbH | Compute hosting for the conversion-server | Germany (EU) |
| deSEC e.V. | DNS authoritative for app.servpipe.net | Germany (EU) |
| Google LLC | DNS authoritative for andromia.works (Google Cloud DNS) | USA / Global |
| GitHub Inc. | Source code + automation | USA |
| Anthropic PBC | Internal development assistance (not in production data path) | USA |
A current list is available on request to privacy@andromia.works.
| Data | Retention |
|---|---|
| Merchant access tokens | Until uninstall + 30-day grace, then deleted |
| Conversion event records (Redis idempotency keys) | 7 days then deleted |
| Audit log entries | 90 days then trimmed |
| Aggregate metrics (no personal data) | Indefinitely |
| Backups | 30 days rotating |
Under UK GDPR / EU GDPR / California Consumer Privacy Act, individuals have rights to access, correct, delete, port, and restrict processing of their personal data.
To exercise these rights:
We respond to verified requests within 30 days.
A detailed security posture overview is available on request.
Conversion events processed on behalf of brands may be forwarded to platforms outside the UK / EEA (notably US-based ad platforms). Each onward transfer relies on the platform's own transfer mechanism (typically Standard Contractual Clauses + UK Addendum, or the EU–US Data Privacy Framework). Andromia does not store personal data outside the EEA except in transit.
Servpipe is not directed at children. Brands using the Servpipe platform are responsible for ensuring their own storefronts comply with applicable child-protection requirements.
Material changes will be announced via email to registered merchants and via a banner on app.servpipe.net. The "Last updated" date at the top of this page reflects the most recent revision.
If you have a concern we have not resolved, you have the right to lodge a complaint with the UK Information Commissioner's Office (ICO):
EU residents may complain to their national data protection authority.
Andromia Ltd (company number 15931114)
Office 6721, 58 Peregrine Road
Ilford, Essex IG6 3SZ
United Kingdom
Email: privacy@andromia.works