Connector privacy policy
Studio Connector for WooCommerce® is independent software operated by Sitetrail LLC. This policy covers this connector and its Google account connection, store connection, team workspaces, billing and operational notices. It does not describe Sitetrail’s other products. Last updated: 9 November 2026.
Google user data we access and why
Google sign-in provides your Google account identifier, verified email address and basic profile/display name. We use these to authenticate you, label your workspace and enforce team membership. We store the Google access and refresh credentials needed to maintain the connection you authorize.
The Google Workspace™ Studio starter permission lets us notify only the flows registered by their owners. We process the registered trigger identifiers, flow configuration, delivery records and the input/output fields needed for the steps you choose. Inputs you map from earlier Studio steps can contain Google Workspace™ user data. The Apps Script external-service permission allows the add-on to communicate with our connector backend.
This connector does not request permissions to read Gmail™ messages, Google Drive™ files, spreadsheet contents, Google Chat™ messages or Google Photos™. Those services’ content is not independently fetched by this connector. You can separately choose native or other providers’ steps in your Studio flow.
Other information the connector processes
We process the WooCommerce store address and API credentials you supply, the store events and action inputs required for your workflows, team membership, subscription identifiers, usage counts, delivery history and error references. Store payloads can contain customer identifiers, names, email/contact and address details, order items, totals and status, product/stock fields and technical metadata sent by your store.
Direct bridge actions and existing event routes
For the direct bridge route, Google sends the signed action payload to your WordPress site and receives its result directly. Your site downloads accessible image files from the configured source URLs. These direct action content bodies, image URLs/files and results are not relayed through Sitetrail’s Cloudflare service. Our access service processes the verified Google account and team membership, registered site/installation, action name, operation identifier, signed input hash, subscription and content-free completion metadata (resource identifier, revision hash, modification time and status). Site-side retry history can retain the operation inputs’ hash, saved progress and original result on your own hosting.
Existing event starters and legacy backend actions continue to pass the store data needed for those operations through Sitetrail. Direct writes can also emit WooCommerce events into that starter route. Optional event starters default off for new bridge connections. Enabling them sends store event records through Sitetrail even when no flow is listening, including events from direct writes. Existing paired connections preserve their setting. Disabling pauses this connector’s hooks; queued records can finish. Direct actions and WordPress stay available. This is direct action content routing, not a claim that no store information ever reaches us. Direct-action metadata is retained for up to 30 days; site-side operation records remain on your site to prevent duplicate writes. A small list of at most ten recent bridge error codes, UTC times and request identifiers/body-size/format metadata stays on your site and contains no payload bodies, keys or customer records.
The shared plugin’s WordPress and WooCommerce modules use separate account connections, signing permissions and subscriptions. The WordPress module does not require WooCommerce.
Information is used to provide and secure the connector, run your configured flows and store actions, manage billing and usage, prevent duplicate actions, and provide requested support. We do not sell Google user data or use it for advertising.
Data protection and security mechanisms
- Encryption in transit: browser connections, Google API calls and connected-store API calls use HTTPS/TLS. Store connections must use HTTPS.
- Encryption at rest: Google OAuth access and refresh tokens, store API credentials, webhook secrets, retained event payloads, action results and checkpoints in the connector database are encrypted using AES-256-GCM. Each encrypted record uses a random nonce and an account/record-specific context. The application encryption key is kept separately in Cloudflare Worker Secrets.
- Database storage: Cloudflare also encrypts D1 database storage at rest, including identity, account and operational records. See Cloudflare’s D1 security information.
- Access controls: a verified Google identity and workspace membership are checked before store access. Each flow owner has a separate Google connection. Stored store keys are not displayed to teammates. Webhooks are checked using their signatures.
- Authentication and logging: sign-in uses OAuth state, nonce and PKCE protections. Session cookies use Secure, HttpOnly and SameSite controls. Operational error logging excludes credential values, and request query strings are configured for redaction.
With whom we share or transfer Google user data
We disclose the following information only as needed to provide the features you use:
| Recipient | Information and purpose |
|---|---|
| Cloudflare | Hosts the connector, database, queues and operational email. It processes Google identifiers, email/display name, encrypted Google and store credentials, configured flow/store data, usage and delivery/security records to operate and protect the service. Operational email uses the recipient address and the relevant connection or delivery notice. |
| Processes authentication and authorization requests. Google Workspace™ Studio receives registered trigger identifiers and the output fields sent to the flows you configure. Google operates the downstream native steps you choose under its own terms. | |
| Stripe | Receives the billing contact email, workspace/business name and customer/subscription references required for connector subscriptions. A workspace name can be based on the Google display name. Payment details are entered into Stripe-hosted checkout. We do not send Google OAuth tokens or store API credentials to Stripe. |
| Your connected WooCommerce store and its hosting provider | Receive the store API credentials and action fields needed for the requests you configure. This can include fields from Google Workspace™ that you explicitly map into a store action. Google OAuth credentials are not sent to the store. |
Other disclosures are limited to what you specifically direct or consent to, or what is necessary for security or legal obligations, subject to Google’s Limited Use requirements. Access by authorized personnel is limited to permitted support, security and legal purposes.
AI/ML services and Limited Use
This connector does not integrate with third-party AI/ML providers, model aggregators or gateways. It does not run self-hosted or offline AI models. There are no AI-provider plans, tiers, upstream models or inference endpoints used by this connector. Other Sitetrail software and website services are separate from this connector.
We do not use Google user data, including raw, aggregated, anonymized or derived data, to create, train, fine-tune or improve foundational or generalized machine-learning or AI models. We do not transfer or sell that data to third parties for those purposes. A user may independently configure other Google Workspace™ Studio steps; this connector itself makes no calls to AI inference services.
Use and transfer of Google information follows the Google API Services User Data Policy, including Limited Use, and the Google Workspace™ API User Data and Developer Policy.
Retention and deletion
Pending event payloads are retained for up to seven days. Retained action results/checkpoints and resource-comparison snapshots are cleared by routine cleanup after their applicable 30-day retention period. Minimal identifiers can remain to prevent duplicate processing, alongside necessary account, billing, usage and security records.
Disconnecting Google in app settings removes that user’s stored Google credentials and stops their starters. Disconnecting a store removes its stored API credentials and stops its starters. You can also revoke authorization through your Google Account. Billing cancellation is separate. Disconnecting the connector does not delete the original records held by Google, Stripe or your store.
To request deletion of connector account data, email [email protected]. We may retain records required for billing, legal obligations, security or duplicate prevention; please contact us about the applicable records.
Contact and policy updates
Contact Sitetrail LLC at [email protected] with privacy or access questions. Material changes will be reflected in this policy and its update date, with additional notice where required.
Connector information · App settings · Terms of service
WooCommerce® and its associated designs are trademarks of Automattic Inc. Google Workspace™, Google Sheets™, Google Chat™, Gmail™, Google Drive™ and Google Photos™ are trademarks of Google LLC. Independent software by Sitetrail; not affiliated with or endorsed by Automattic Inc. or Google LLC.