Privacy Policy — Ads Direction

Effective: 12 May 2026 Last updated: 30 October 2026 Operated by: Omar Rashid (sole proprietor; entity registration in progress)

Drafted to comply with India's DPDP Act 2023 and the EU GDPR, and with the Google API Services User Data Policy.

What changed on 7 September 2026: added section 5 (Google user data and Limited Use), and made the cross-customer learning described in section 3 explicitly opt-in rather than automatic. If you signed up before this date, that learning is off for you until you turn it on in Settings — a change in the direction of less data use, not more, so there is nothing you need to do.

1. Who we are

Ads Direction helps independent Shopify businesses review their business information, connect their own reporting accounts, prepare advertising and content drafts, and review available results. Each signed-in user owns separate business information, connections and saved work. Daily collection is optional and separately controlled; connecting an account does not itself enable it. The supported customer workflow prepares work for review and manual handoff. Native ad creation and activation remain unavailable.

Contact: privacy@adsdirection.com | Founder: Omar Rashid

2. What data we collect

When you sign up and connect your accounts, we receive:

Account metadata

• Your email address
• Your Shopify store URL
• Self-reported monthly Google Ads + Meta Ads spend bands
• The 5-question founder questionnaire answers (stated competitors, differentiator, recent failed campaign, etc.)

Connected platform data (reporting use)

• Google Ads: campaign performance, asset groups, search terms, auction insights, conversion data. Up to 24 months of history on the first audit so we can detect seasonality and quarterly trends (clamped to 12 months for accounts under the heaviest-spend tier). Subsequent weekly runs read the last 30 days plus daily snapshots we've collected since.
• Shopify: orders, products, customers, inventory, abandoned carts. Same lookback policy.
• Merchant Center: product feed health, disapprovals, product metadata.
• Meta Ads: campaigns, ad sets, ad performance, primary text, when connected. The current Meta connection requests ads_read; it does not grant native ad management.
• Google reporting connection: the current consent request includes Google Ads, Merchant Center, GA4 and Search Console scopes together, plus identity scopes. Selecting a reporting property is separate from granting OAuth access. Google identity-only sign-in uses a separate client and does not connect reporting accounts.

Brand-asset uploads (optional onboarding step) If you provide them during onboarding or via Settings → Brand Assets, we store:

• Your logo (PNG/SVG)
• Brand guidelines PDF (parsed by Vision LLM to extract colors, typography, voice rules, banned phrases)
• Up to 5 product photos
• Brand color hex codes
• Brand voice notes + tone descriptors
• Banned phrases list

All assets are stored in Cloudflare R2. The brand guidelines PDF is sent to the Anthropic Vision LLM once for parsing; the extracted structured fields are stored, the PDF stays in R2 for re-parsing if you update it.

Daily metric snapshots When daily collection is enabled for your account, we pull small snapshots from connected platforms, such as campaign-level spend, conversions, CPA, ROAS and key Shopify metrics. Separately opted-in campaign checks may collect spend, results, selected-product availability or the saved landing page for the approved period. Connecting an account or saving a draft does not itself enable these checks. Snapshots are retained 24 months.

Operational data

• IP address and user agent at sign-up (fraud prevention)
• Timestamps of connections, weekly runs, deliveries, downloads, dashboard sessions

What we do NOT collect

• We do not store credit-card information. Razorpay handles all payment data.
• Enabled reporting workflows read platform data. Google’s adwords and content scopes allow broader access than these reporting uses; section 5 explains this distinction. The general Shopify OAuth request contains only read scopes. A separately authorised pilot connection may include page read/write permission, but creating a new standalone unpublished FAQ or guide also requires exact content review, a store-bound capability and enabled write controls. This does not permit publication or changes to existing pages, products, themes or checkout. Native ad creation and activation remain unavailable.
• We do not collect end-customer PII beyond what's necessary for aggregate analysis (e.g., AOV bands, repeat-purchase rates, cohort retention curves).

3. Why we collect it

Primary purpose: to provide your own business analysis, reviewed drafts, reporting and next steps. Connected data supports your saved work; scheduled collection requires the applicable account access and separate controls.

Secondary purpose (the data layer — opt-in, and fully disclosed): to improve Ads Direction by aggregating anonymized, cohort-level signals across customers. Specifically:

• We may combine anonymized findings across many brands ("Indian D2C skincare brands spending ₹1–5L/month most commonly have Merchant Center disapprovals on Y") to publish industry insights, license category playbooks to agencies, or train vertical-specific recommendation systems.
• Your brand is never named, identifiable, or attributable in any aggregated output.

Sharing stays off until you save your choice. New accounts created from 20 September 2026, 13:30 UTC receive a preselected, optional checkbox during onboarding. You can untick it before choosing Save and continue; opening the page or skipping onboarding does not enable sharing. Existing saved choices are preserved. You can change your choice at any time from Settings → Data options → Advanced → Cross-customer learning; Know more explains what is pooled. Withdrawal takes effect on the next aggregate refresh.

Two commitments that make the opt-in real rather than decorative:

• Declining costs you nothing. Your audit is identical either way. No feature is withheld, no price changes, and you are not asked again. If that were not true this would be pressure, not consent.
• Nothing is pooled retroactively. Consent applies from the moment you give it. Data collected while you were opted out is not swept in later, and data already pooled is removed from every aggregate on the next refresh after you withdraw.

Google data specifically. Google Ads, Merchant Center, GA4 and Search Console data enters the aggregate only under this same explicit consent — that is what the Google API Services User Data Policy requires, and section 5 sets it out in full. Without your opt-in, your Google data is used for one thing only: producing your own audit.

What we will never do:

• Sell your raw account data to anyone.
• Reveal your specific brand's performance to any third party without your explicit written permission.
• Share your specific recommendations with agencies, acquirers, or competitors.
• Use your private data to advantage another named customer.

This stance is a hard architectural rule, not a marketing claim. We treat it as binding policy across the product.

4. How we share data

We use the following sub-processors, each governed by their own privacy policies:

Optional public market research: when enabled for your account, a manual demand check sends up to five keywords you enter to SearchAPI, with the selected country and time range. Competitor checks send the competitor names, domains or reviewed public advertiser IDs you save, and the selected country. SearchAPI returns public Google Trends and ad-library observations. We do not send your connected Google/Meta performance reports, customer records, OAuth tokens or account identifiers to this supplier. Leaving the keyword field blank skips its keyword lookup. Public ad samples and relative-interest indices do not disclose competitor conversions or establish profitability. The current pilot has a finite operator-set request allowance; it does not create a paid provider subscription.

We do not sell or rent your data to advertisers.

5. Google user data and Limited Use

This section covers data we receive from Google APIs specifically. It sits alongside the rest of this policy, and where it is stricter, it governs.

Ads Direction's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

What Google user data we access, and why each scope is needed

On reporting and native operations. The enabled Google reporting workflow reads your selected accounts and properties. The product also contains separately gated native campaign code, but native creation and activation remain unavailable in the customer workflow. OAuth consent alone does not authorise execution. Two of the scopes above — adwords and content — permit read/write access because Google publishes no read-only variant of either; that scope breadth does not mean the reporting connection will write to your accounts.

How we use it. To produce your audit and your weekly recommendations, and — only if you opt in, see below — to contribute anonymised patterns to the benchmarks other audits are judged against.

How we share it. We do not sell, rent or transfer Google user data to anyone for advertising, marketing or any purpose unrelated to delivering your audit. It reaches only the sub-processors in section 4, each strictly to run the service.

Human access. No human reads your Google user data as a matter of course. We access it individually only where you ask us to (a support request you raise), where required by law, or to investigate a specific security incident or abuse — the exceptions the Limited Use requirements permit.

AI and machine learning. Your Google user data is sent to Anthropic's API to write your audit; per Anthropic's API terms it is not used to train Anthropic's models. We do not use Google user data to develop, improve or train generalised AI or ML models.

We do run a cross-customer learning layer, described in section 3. Google user data enters it only after you save an enabled sharing preference, requested during onboarding and changeable at any time in Settings. The optional checkbox may be preselected for new accounts as described in section 3; opening the page or skipping onboarding does not save that choice. If you decline — or simply never save a choice — your Google data is used solely to produce your own audit, and your audit is in no way reduced.

Revoking access. Remove Ads Direction's Google access directly at myaccount.google.com/permissions. The app does not provide a separate Google-disconnect control in Settings. Revoking the platform grant is separate from deleting the token and previously collected data stored in Ads Direction. To delete that data, use Settings → Data controls → Delete my account permanently, or follow the email route in section 13.

6. Data residency

The primary Supabase database is configured in India (ap-south-1). This database location does not establish where every part of the service processes data.

File storage uses Cloudflare R2; inference uses Anthropic’s API; the audit engine runs on Railway. Authentication, hosting, email, monitoring and other providers listed in section 4 may process data in different regions, including outside India, under their service configurations and terms. An edge serving location is not a guarantee of storage or processing residency.

We do not promise that all storage, backups or processing remain in India, or that an alternative enterprise residency arrangement is available. If you have a residency requirement, contact us before subscribing to confirm whether the current service meets it.

7. How long we keep it

• Account data: until you delete your account, then 30 days for backup hygiene, then permanently deleted.
• Weekly run history: 24 months by default. Deletable on request.
• Raw API extracts: 30 days, then deleted.
• Daily metric snapshots: 24 months (to power year-over-year baselines).
• Brand-asset uploads: until you delete them or your account, whichever comes first.
• Aggregated/anonymized cohort signals: retained indefinitely (no PII, no brand-identifying data).
• OAuth tokens: deleted from our systems on account deletion. Cancelling a subscription does not delete the stored connections or tokens. Revoking access in a platform's settings is separate from deleting the records stored in Ads Direction. We do not call each platform's revocation endpoint on your behalf — remove the app-level grant directly in your Google, Meta or Shopify settings, and use account deletion to remove the data held here.

8. Your rights (DPDP + GDPR aligned)

You have the right to:

• Access all data we hold about you (Settings → Data controls → Download my data, or email)
• Correct inaccurate data (the brand-profile confirm step at onboarding is the primary correction surface; email for other fields)
• Delete your account and all associated data (Settings → Data controls → Delete my account permanently, or email privacy@adsdirection.com)
• Withdraw consent to OAuth connections at any time (revokes our access; weekly runs pause)
• Portability — request your data in JSON
• Object to processing for the data layer (your weekly audit will still run, but your brand's data is excluded from aggregated cohort analysis)
• Stop processing — cancel your subscription to stop weekly runs without deleting history; you can subscribe again later. (There is no pause state; cancel-and-resubscribe is the supported path.)

To exercise any of these, email privacy@adsdirection.com. We respond within 7 days.

9. Cookies + tracking

The Ads Direction website uses minimal cookies:

• Authentication session (essential, first-party)
• No analytics cookies on the marketing site as of v1.

We do not use Google Analytics, Meta Pixel, or any retargeting cookies on our own site. We are an audit tool, not an ad platform.

10. Security

• All OAuth tokens encrypted at rest with AES-256 (key in Supabase Vault, rotated quarterly).
• HTTPS everywhere; HSTS preload on adsdirection.com.
• No PII in error logs (Sentry receives stack traces only, not request bodies).
• Service-role database access only from the audit-engine and the Next.js server; no client-side service role.
• 2FA available on customer accounts.

If you discover a security issue, email security@adsdirection.com. Public bounty program TBD.

11. Children

Ads Direction is a B2B tool for business operators. We do not knowingly collect data from anyone under 18.

12. Changes to this policy

If we change this policy in a material way (data-use stance, vendor changes, scope expansions), we email you at least 14 days before the change takes effect. Non-material changes (typos, vendor name updates) post here without notice.

13. Data deletion

You can delete your Ads Direction account and all data we hold for you at any time.

From the app (immediate): sign in to https://adsdirection.com → Settings → Data controls → Delete my account permanently. This:

• Permanently removes your user row, brand profile, audits, insights, recommendations, and uploaded brand assets
• Deletes the OAuth tokens we hold for Google Ads, Shopify, and Meta, ending our access immediately (your data on those platforms is untouched). We do not revoke the app grant on the platform's side — do that in your Google/Meta/Shopify settings.
• Deletes your files in object storage (audit documents, raw extracts, uploaded brand assets) on a best-effort basis; a storage failure is logged for manual cleanup and never blocks your account deletion
• Retains your billing records (subscription and payment history), de-linked from your identity, as required for GST reconciliation and chargeback defence.
• Cancels your subscription first. If you have a live payment mandate, we cancel it with Razorpay before deleting anything. If that cancellation fails we stop and delete nothing, and tell you why — leaving you billed with no account to cancel from would be worse than a delay. (Until 6 September 2026 this was not the case: deletion left the mandate live, and this page said so. It now does what a customer would reasonably assume.)
• Stops weekly audit emails on the next delivery cycle

By email (if you cannot sign in): email privacy@adsdirection.com with subject "Account deletion request" from the email associated with your account. We confirm within 2 business days and complete the deletion within 7 business days.

Meta-specific: to remove Ads Direction's access at Meta, remove the app under Settings → Business integrations. Revoking Meta access does not itself delete data already stored in Ads Direction. To delete that data, use Settings → Data controls → Delete my account permanently, or email us if you cannot sign in. Account deletion removes your stored Meta connection and token along with your account data. Stored files follow the best-effort deletion process described above; the stated billing-history and backup retention still applies.

Google-specific and Shopify-specific: account deletion removes the tokens stored in our systems and the associated account data. Stored files follow the best-effort deletion process described above. We do not call the platforms' token-revocation endpoints. Remove the app-level grant yourself at https://myaccount.google.com/permissions or in your Shopify admin.

If you have questions about your deletion request or want confirmation that it completed, email privacy@adsdirection.com.

14. Contact

• General privacy questions: privacy@adsdirection.com
• Security disclosures: security@adsdirection.com
• Operating entity: Omar Rashid, sole proprietor (entity registration in progress; this section updates when registered)

Reporting, collection, consent and native-operation disclosures updated against current product mechanics on 30 October 2026. Drafted to comply with India's DPDP Act 2023 and the EU GDPR. The data-use stance in §3 is locked architecturally — we treat it as a binding rule, not a marketing claim.