Starship
starship / search / adwords-conversion-pixel

Audit report

Adwords Tracking by AdNabu

Broad accessReach : moderateSensitive Access

by AdNabu, Inc · Marketing · Shopify App Store

Marketing
Risk level
Broad access
Executive summary

Automatically Install Google AdWords Conversion Tracking Code

Key insights

  • ◆Built for Shopify badge present; 4.8 rating across 461 reviews indicates established merchant trust.
  • ◆Publisher AdNabu Global, Inc. is a recognised Shopify partner with multiple Google Ads / Shopping apps.
  • ◆Privacy policy is detailed and GDPR-aware; data is US-hosted via Cloudflare-fronted infrastructure.
  • ◆TLS on adnabu.com is healthy (HTTP/2, valid cert, HSTS max-age=31536000); no CSP header observed.

Top findings

No critical or high findings detected.
Synthesis

Analysis summary

Automatically Install Google AdWords Conversion Tracking Code

Key insights
  • ◆Built for Shopify badge present; 4.8 rating across 461 reviews indicates established merchant trust.
  • ◆Publisher AdNabu Global, Inc. is a recognised Shopify partner with multiple Google Ads / Shopping apps.
  • ◆Privacy policy is detailed and GDPR-aware; data is US-hosted via Cloudflare-fronted infrastructure.
  • ◆TLS on adnabu.com is healthy (HTTP/2, valid cert, HSTS max-age=31536000); no CSP header observed.
  • ◆App handles sensitive customer PII + device data and writes web pixels; standard for Google Ads conversion tracking.
  • ◆No public CVEs, breaches, or security incidents found for AdNabu in web search.
  • ◆AI features ('AI Feed Optimization', 'AI Product Title Generator') exist in product line but no LLM vendor disclosed.

This section is available to signed-in users

Sign up free to unlock findings, data flow and theme code analysis for every Shopify app.

Get started
Permissions

OAuth scopes requested

These are the access permissions this app asks for during install. The sensitivity column reflects PII exposure and merchant impact.

read_customers
High

Sensitive customer PII (name, email, phone, address) used for Google Ads enhanced conversions.

read_customer_events
Medium

Device and activity data (geolocation, IP, browser, behavior, client ID) for conversion attribution.

read_orders
High

View orders (last 60 days) required for purchase/conversion event tracking.

write_pixels
Medium

Edit store analytics (web pixels) to inject Google tracking; core function but write scope.

read_themes
Low

View online store theme for pixel placement verification.

read_users
Medium

Store owner contact data (name, email, phone, address) for account communication.

This section is available to signed-in users

Sign up free to unlock findings, data flow and theme code analysis for every Shopify app.

Get started

This section is available to signed-in users

Sign up free to unlock findings, data flow and theme code analysis for every Shopify app.

Get started
Attack surface

Network surface

Primary domain
adnabu.com
TLS grade
A
HSTS
Enabled
CSP
Missing

HSTS enforced (max-age=31536000); no Content-Security-Policy header observed; Cloudflare-fronted.

Posture

Compliance & certifications

GDPR webhooks Pass
SOC 2 Type II Fail
ISO 27001 Fail
PCI DSS Pass

Detailed GDPR section, CCPA/CalOPPA referenced, PCI-DSS payment handling via Stripe. No SOC2 or ISO27001 claims.

Privacy policy
Track record

Publisher reputation

Publisher
AdNabu, Inc
Verified Shopify Partner
Yes
Years active
0
Other apps
0
Past incidents
No past incidents on record.
LLM exposure

AI / LLM usage

No LLM usage detected. This app does not appear to forward any customer or merchant data to large-language-model providers.