Privacy Policy
Effective date: October 7, 2026
This Privacy Policy explains how 1Pixel, a Commerce7 app made by 7Labs ("the App", "we", "us"), handles data when a winery installs and uses it.
1. What the App Does
The App receives Commerce7 webhooks (orders, including tasting room and Tock bookings, club memberships, reservations and customer registrations) and sends them to Meta as Conversions API events on the winery's behalf.
If the winery adds our website script (a pasted tag or our WordPress plugin), the App also sends browsing events from the winery's website to Meta: page views, wine views, add to cart and checkout started. On pages that have no Meta Pixel, the script may load the winery's Meta Pixel.
To warn about duplicate tracking, the App reads the winery's public website and any Google Tag Manager containers on it and records which Meta tags it finds.
2. Our Role
For personal information about a winery's customers and website visitors, we act as the winery's service provider (under the CCPA and similar US state laws) and processor (under the GDPR, where it applies). The winery decides what is collected and sent to Meta, and is responsible for its own notices and consents. Our commitments as a service provider are in our Terms of Service.
For information about the winery staff who use the App (such as sign-in details), we are responsible for it ourselves.
3. Data the App Handles
Meta Pixel ID, Meta access token, App settings
Entered by the winery
Until changed or the App is uninstalled
Customer email, name, phone, address and Commerce7 customer ID
Commerce7 webhooks
Hashed (SHA-256) before sending to Meta. Never stored in readable form; hashed copies only in failed events (below)
Order details: order number, wines and SKUs, value, sales channel
Commerce7 webhooks
Sent to Meta. The order reference is kept in the event log
Buyer's IP address and browser type on web orders
Commerce7 webhooks
Sent to Meta unhashed, as Meta requires. Kept only in failed events
Meta browser cookies (_fbp, _fbc), Meta click ID, IP address, browser type, page address without anything after ? or #
Website script
Up to 7 days, to match orders to ad clicks, then deleted automatically
Wine and cart details of browsing events
Website script
Sent to Meta, not stored
Failed events (the event as it would have gone to Meta, with hashed customer details)
The App, when Meta can't be reached
Retried automatically, then kept until delivered, replayed from the dashboard, or the App is uninstalled
Event log: event name, status, Commerce7 reference, error messages
The App
Until the App is uninstalled
Website address and the Meta tags found on it; WordPress plugin connection and test results
Site tag check, WordPress plugin
Until the App is uninstalled
Winery staff sign-in: Commerce7 user ID, IP address, browser type
Commerce7 sign-in
Security log, 90 days. Session cookie until it expires
4. How We Use Data
Only to run the App for the winery: sending events to Meta, matching orders to ad clicks, showing the dashboard, giving support and keeping the App secure. We do not sell or share this data, use it for our own advertising, or combine one winery's data with another's.
5. Who Receives Data
- Meta Platforms, Inc., the destination the winery connects. Meta's use of the data is governed by Meta's Privacy Policy and the winery's own agreements with Meta.
- Fly.io, Inc., which hosts the App and its database on servers in the United States.
- Commerce7, which sends the App its data and handles billing.
6. Privacy Controls
- Limited Data Use: applied automatically to customers with a California address, and to any customer whose Commerce7 record has
facebook-limited-data-use set to true.
- Full opt-out: nothing is sent for a customer whose Commerce7 record has
1px-opt-out set to true.
- Global Privacy Control: the website script sends nothing and doesn't load the Meta Pixel for visitors whose browser sends this signal.
- Consent tools: the winery can hold website events until its cookie consent tool says the visitor agreed.
7. Security
- Data travels over HTTPS and is stored on encrypted disks, in a database only the App server can reach.
- The App's settings and dashboard are available only to people signed in to the winery's Commerce7 account.
- If we become aware of a security incident affecting a winery's data, we tell that winery without undue delay.
8. Retention and Deletion
When a winery uninstalls the App, we delete its settings, credentials, event log, failed events and browser data within 7 days. While deletion is pending, the App sends nothing from the winery's website. Security log entries expire after 90 days. To have a specific customer's data removed sooner, the winery can email us and we will help.
9. Requests from Customers
The winery handles requests from its own customers (for example, to access, delete or opt out). We help wineries respond to them. If a customer contacts us directly, we will pass the request to the winery.
10. Children's Privacy
The App is a business tool for wineries. It is not directed at children, and wine sales are limited to adults of legal drinking age.
11. Changes to This Policy
We will tell wineries about material changes by email or in the App before they take effect, and update the effective date above.
12. Contact
Questions about this Privacy Policy or your data: 7labs@dmitru.com.