Privacy Policy

1. Introduction

This Privacy Policy describes how Shopedge collects, uses, stores, and shares information when you install or use the App.

2. Data Controller

AdsCode LLC 841 South Ocean Blvd, Pompano Beach, Florida 33062 company@shopedge.io

3. EXACT DATA WE ACCESS & STORE

Below is the Shopify-required explicit list.

3.1 Shopify Data

3.1.1 Data Accessed

(but NOT stored unless listed as “stored” below)

  • Orders (IDs, line items, totals)
  • Customers (names, emails, phone numbers, addresses, tags)
  • Products (titles, prices, variants)
  • Collections
  • Store currency & timezone
  • Analytics metrics
  • Store configuration

We only process customer-level API data transiently in memory to generate insights, and it is discarded immediately after execution. Any customer personal data that you manually type or paste into the Assistant (for example, quoting a customer’s name or email in a question) may appear in the chat history for up to 90 days as described in Section 3.7 and Section 7.

3.1.2 Data Stored

  • Shop domain
  • Shop contact email
  • OAuth access token
  • Admin user first/last name
  • Selected settings and connector configuration

3.1.3 Customer Data Handling

We DO NOT:

  • store Shopify customer personal data
  • sell or rent customer data
  • share customer data with third parties
  • use data for advertising purposes
  • build profiles or audiences from your customers’ data

We only process customer-level API data transiently in memory to generate insights, and it is discarded immediately after execution.

3.2 Google Analytics (GA4) Data

Accessed (NOT stored)

  • Sessions
  • Users
  • Conversions
  • Revenue
  • Event metrics

Stored

  • GA4 refresh token
  • GA4 property selection

3.3 Google Ads Data

Accessed (NOT stored)

  • Campaign spend
  • Clicks
  • Impressions
  • Conversions
  • ROAS
  • Keywords performance

Stored

  • Google Ads access & refresh tokens
  • Connected account ID

3.4 Meta Ads Data

Accessed (NOT stored)

  • Ad performance metrics
  • Spend
  • CTR, CPC
  • Purchases
  • Campaign structure

Stored

  • Meta access token
  • Ad account selection

3.5 Logs & Diagnostics

We collect:

  • Timestamps
  • Request IDs
  • Error logs
  • System events

We do not log payloads containing PII. Retention: see Section 7.

3.6 Public Website Data

Google Analytics 4 is used in aggregated, anonymized form. No pixels or behavioral advertising trackers are used.

3.7 Chat & Conversation Data

When you use the in-app Assistant, we process the text of your questions and the Assistant’s responses. Stored

  • Conversation messages (your questions and the Assistant’s answers)
  • Basic metadata such as timestamp, shop identifier, and which connectors (Shopify, GA4, Google Ads, Meta Ads) were used to answer
  • Aggregated store-level metrics and KPIs included in the responses (e.g. revenue, orders, traffic, ROAS, product performance)

Content of conversations may include commercially sensitive information about your store’s performance (sales, traffic, products, campaigns, etc.).

4. AI PROCESSING DISCLOSURE (OpenAI & Google Gemini)

Shopedge uses AI to generate explanations, comparisons, and analytics summaries. We use:

  • OpenAI API
  • Google Gemini API

Data sent to AI providers:

  • Metrics retrieved from Shopify, Meta, Google Ads, GA4
  • Your query text
  • Derived aggregated performance numbers

Data NOT sent:

  • Raw customer PII (names, emails, addresses)
  • Full order or customer datasets
  • Access tokens or secrets

AI Provider Rules:

  • Data is not stored by OpenAI or Gemini
  • Data is not used for training
  • Data is processed only in transient memory
  • No data is shared or reused by providers

This meets industry-standard AI compliance and Shopify’s AI guidance. In addition to the transient processing by AI providers, we store a copy of your queries and the Assistant’s responses as chat history in our own systems. This is done solely to:

  • show you past conversations,
  • provide context for follow-up questions, and
  • ensure security, abuse monitoring, and debugging.

This stored chat history is not used to train OpenAI or Google Gemini models.

5. How We Use Data

  • To provide analytics and insight features
  • To connect your store to Google Ads, Meta Ads, and GA4
  • To display explanations and comparisons
  • To detect anomalies (spend spikes, ROAS changes)
  • To secure and maintain service quality

6. Legal Bases

Typical bases include:

  • Performance of contract
  • Legitimate interest
  • User consent (when required)

7. Data Retention

(Required by Shopify & regulators) We retain:

  • Shop configuration, tokens, settings → Deleted immediately upon uninstall
  • Logs → Retained for 90 days
  • Chat history (AI prompts and responses) → Retained for up to 90 days from the date of each message. When you uninstall, chat history linked to your shop is deleted as part of the uninstall process.
  • Metrics fetched from APIs → Not stored

Uninstall webhook triggers permanent deletion of all associated store records within 1 hour. Except logs, which expire in 90 days.

8. Data Deletion & Account Removal

Uninstall When you uninstall the App:

  1. Shopify sends us an uninstall webhook
  2. We immediately delete:
    • OAuth tokens
    • Store configuration
    • Integration settings
    • Chat history and conversation metadata linked to your shop
  3. Logs expire automatically based on retention schedule

Manual Deletion Request Email: company@shopedge.io We will delete all data stored about your store.

9. Sub-Processors

We use the following categories of sub-processors:

  • Cloud Hosting: AWS (eu-west-3)
  • AI Providers: OpenAI, Google Gemini
  • Email / Communication Providers: Klaviyo
  • Analytics: GA4
  • Logging & Monitoring: AWS Cloudwatch

10. Data Sharing

We do not:

  • sell data to third parties
  • share data for advertising purposes
  • share customer PII
  • share Shopify, Google, or Meta data externally

Data is only shared with sub-processors listed above, solely to operate the App.

11. International Transfers

No data transfers. Data is strictly AWS region boundary, it doesn’t leave eu-west-3 Paris.

12. Google API Services Compliance (Mandatory Statements)

We comply fully with the Google API Services User Data Policy, including Limited Use. We explicitly affirm:

  • We do not allow human access to GA4 or Google Ads data except:
    • when required for debugging
    • with user permission
    • for security or legal reasons
  • We do not combine Google API Services data with third-party data for advertising
  • We do not transfer Google data to third parties
  • We do not use Google data for profiling, targeting, or unrelated analytics

13. Meta Marketing API Compliance (Required Statements)

We explicitly confirm:

  • We do not use Meta data to create or enhance profiles outside the merchant’s own ad accounts
  • We do not share Meta data with third parties
  • We delete all Meta tokens upon uninstall or access revocation
  • We do not store campaign-level PII or audience identifiers

14. Children’s Data

The App is not intended for children under 13 years. We do not knowingly collect data from children. If you believe data was collected from a child, contact: company@shopedge.io

15. Business Transfers

In the event of a merger, acquisition, asset sale, restructuring, or bankruptcy, your data may be transferred to a successor entity only if:

  • the successor agrees to honor this Privacy Policy
  • the data continues to be used only for the same purposes
  • you are notified of material changes

16. User Rights

You may request:

  • access to data stored
  • correction
  • deletion
  • restriction of processing

Contact: company@shopedge.io

17. Updates to this Privacy Policy

We may update this Policy. If changes are significant, we will notify you via email or in-app.

18. Contact Information

All questions can be directed to: AdsCode LLC 841 South Ocean Blvd, Pompano Beach, Florida 33062 company@shopedge.iotom@damngood.ventures

19. Security & Data Protection

We treat all data obtained via third parties APIs as sensitive and implement technical and organizational measures to protect it. Security procedures are in place to protect the confidentiality, integrity, and availability of your data, including:

  • Encryption in transit: All communication between Shopedge, your browser, Shopify, and Google APIs is protected using industry-standard HTTPS/TLS.
  • Encryption at rest: OAuth tokens, integration settings, and other configuration data related to Google services are stored on AWS-managed services with encryption at rest enabled.
  • Access control and least privilege: Access to user data is restricted to backend services and a very limited number of authorized personnel, only when strictly necessary We use role-based access controls and audit logging on our infrastructure.

If we become aware of any unauthorized access or security incident affecting Google user data, we will investigate promptly, take appropriate remediation steps, and notify affected merchants where required by law.