Privacy Policy

1. Introduction

Ad Agent ("we", "our", "us") is a Shopify application that analyzes a merchant's Meta (Facebook/Instagram) advertising performance against their real product costs and order data, and lets the merchant create or edit ads on their own connected ad account. This Privacy Policy describes what information we collect through the app and how we use, store, and disclose it.

2. Information We Collect

2.1 From Shopify

• Store information: shop domain, store currency and timezone, and the contact name/email the merchant provides during setup.
• Order and product data: order totals, discounts, shipping, tax, refunds, line items, and product/variant cost data, used to calculate true profit after costs rather than Meta's reported revenue alone. We do not collect customer payment details.
• Storefront activity: an anonymous per-visitor identifier, add-to-cart events, and checkout tokens, captured via a web pixel and theme app extension, used to connect a sale back to the ad that drove it and to identify cart abandoners for retargeting.
• Access tokens: encrypted OAuth session tokens that authorize the app to access your store data. These can be revoked at any time by uninstalling the app.

2.2 From Meta

• Business account information: Business ID/name, ad account ID/name/ currency/timezone, and pixel ID/name, used to connect your store to your own Meta assets.
• Access tokens: an encrypted long-lived Facebook user access token, used to read ad performance and make the changes you approve.
• Ad performance data: campaign, ad set, and ad-level spend, impressions, and clicks, synced daily to compute profit and ROAS.
• Click and browser identifiers: when present on an incoming visit (fbclid, fbc, fbp) and UTM parameters, used to attribute an order to a specific ad.

2.3 Meta Conversions API (optional)

If you connect Meta Conversions API, we send Meta a server-side purchase event containing the order value, currency, product IDs, and the fbc/fbp browser identifiers captured at checkout — tied to the same order ID your browser pixel already uses, so Meta can deduplicate rather than double-count the sale. We do not send hashed customer contact details (email, phone, name, address) to Meta; doing so requires Meta's separate Protected Customer Data approval, which this integration does not currently use.

2.4 Chat and AI features

Messages you send the in-app chat agent, along with the store and ad data needed to answer them, are sent to our AI providers to generate a response. When you approve an AI-drafted ad, the product's real title, description, and price are used to write ad copy, and a reference photo of the product is sent to an image-generation provider to produce the ad banner. We do not use this data to train any model.

2.5 Technical data

• Usage metering: the cost and token count of each AI call, recorded per store so usage can be shown back to you.
• Error logs: collected for debugging, not linked to any individual shopper.

3. How We Use Information

• To calculate true profit and ROAS per ad, after product cost, fees, and refunds.
• To attribute an order to the specific ad, campaign, or channel that drove it.
• To answer questions in the chat agent, and to draft, create, or edit ads and retargeting campaigns once you approve a proposed change.
• To identify cart abandoners for retargeting and build the audience Meta reaches.
• To run the daily automated scan that recommends which ads to scale or pause.
• To investigate technical issues and communicate important service updates.

4. Data Storage & Security

• Database: Supabase PostgreSQL, hosted in the Asia Pacific (Tokyo) region. Shopify and Meta access tokens are encrypted at rest with AES-256-GCM before they are stored.
• Hosting: Vercel's edge network, with TLS encryption for all data in transit.
• Access control: database access is restricted to the app's own backend; no third party has standing access to your data.

5. Third-Party Services

We rely on the following sub-processors to operate the app:

• Shopify Inc. — e-commerce platform and store data access.
• Meta Platforms, Inc. — Graph API, Marketing API, and Conversions API access to your own ad account and pixel.
• Vercel Inc. — application hosting.
• Supabase Inc. — database hosting.
• OpenRouter, Inc. — routes chat responses, ad copywriting, and ad banner image generation to the underlying AI model providers.

6. Data Retention

We retain store, order, and attribution data for as long as the app is installed, so that profit reporting and ad history stay accurate over time. Access tokens are deleted when you uninstall the app or disconnect an account. When Shopify sends us the mandatory shop-redaction webhook — issued on Shopify's own schedule after an uninstall — we permanently delete the shop's record and everything linked to it. To request earlier deletion, contact us directly using the details in Section 9.

7. Your Rights

Subject to applicable law, you may:

• Request a copy of the information we hold about your store.
• Request correction of inaccurate information.
• Request deletion of your information, ahead of the automatic redaction above.
• Object to processing based on our legitimate interests.

To exercise any of these rights, contact us at support@warewe.online.

8. Compliance

• GDPR: we act as a data processor on behalf of the merchant, who remains the data controller for their store and customers.
• CCPA: we do not sell personal information.
• Shopify's mandatory compliance webhooks (customer data request, customer redact, shop redact) are implemented and handled automatically.
• Meta Platform Terms: our use of Meta's APIs complies with Meta's Platform Terms and applicable advertising policies.

9. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be reflected on this page with an updated effective date above.

10. Contact

For privacy questions or data requests, contact us at support@warewe.online.