Privacy policy
Last updated: 12 November 2026
Draft for review, not published. Highlighted passages are open questions or depend on work that has not shipped yet. See docs/website-legal-review.md.
This policy explains what data AdZoom handles, why, who sees it, how long we keep it, and how you can have it deleted. AdZoom is an app that runs inside your Shopify admin. It shows the profit of your Meta and Google Ads campaigns. This policy also covers the adzoom.app website.
1. Who we are
AdZoom is operated by AppCommerce LLC, 30 N Gould St, STE R, Sheridan, WY 82801, USA. [[QUESTION 9: confirm the entity name and address as they should appear]]
Contact: [[QUESTION 1: support and privacy email address]]
[[QUESTION 10: data protection officer or EU and UK representative, if any]]
For the data of your store, you are the merchant and AdZoom works on your behalf. For your customers' data, you decide why it is used and we process it only to provide AdZoom to you. See section 5.
2. In short
- AdZoom reads data from your Shopify store and from the ad accounts you connect. It never changes your store, your campaigns, your ads, or your budgets.
- From your customers, we store only the Shopify customer ID. We store no names, email addresses, phone numbers, or addresses.
- AdZoom has no password of its own. You sign in through Shopify.
- We do not sell your data and we do not use it for advertising.
- You can delete the data AdZoom holds about you. See section 10.
3. Data we handle
From Shopify
When you install AdZoom, Shopify asks you to approve these access scopes: read orders, read all orders, read products, read inventory, and read customers. The "read all orders" scope lets AdZoom import up to 24 months of orders. Without it, Shopify limits access to the last 60 days. [[DEPENDS: slice 4, read_all_orders approved for the production app]]
| Data | What we store |
|---|---|
| Your store | Store name, store domain, Shopify store ID, currency, time zone, and whether prices include tax. |
| Orders | Order name, dates, status, currency, subtotal, tax, shipping charged, discounts, total, and refunds. Each line item with its title, quantity, and price. |
| Customer visits behind an order | For each order, the visits that led to it: time, source, UTM parameters, the landing page path, and the referring website's host name. We keep the landing page path and only these query keys: utm_source, utm_medium, utm_campaign, utm_content, utm_term, gclid, gbraid, wbraid, fbclid, and ttclid. We drop all other query parameters. |
| Products | Product variant title, SKU, image link, and the unit cost you recorded in Shopify. |
| Your settings | A fixed shipping cost per order, if you enter one. [[DEPENDS: slice 4, shipping cost setting]] |
| Shopify users | The numeric Shopify user ID from the session token, and your display choices in AdZoom (date range, columns, sorting). We do not receive or store staff names or email addresses. |
| Access tokens | The access token Shopify issues to AdZoom for your store. We store it encrypted. |
From your customers
Shopify marks some customer data as protected. AdZoom stores one item of it: the Shopify customer ID on each order, and the number of that order in the customer's history (first order, second order, and so on). We use the ID to show which Shopify customer placed an order, so you can find that customer in your Shopify admin. We do not store customer names, email addresses, phone numbers, or postal addresses. We do not combine the customer ID with data from any other source.
From Meta (Facebook and Instagram)
If you connect Meta, you sign in with Facebook Login and approve the ads_read permission. We store:
- your Meta user ID and display name, so AdZoom can show who connected the account;
- the ad accounts you select, with their names, currencies, and time zones;
- campaigns, ad sets, and ads with their names, status, and tracking parameters; and
- daily spend, impressions, clicks, and conversions for each of them.
We store Meta's access token encrypted.
From Google Ads
[[DEPENDS: slice 3, Google Ads connection]] If you connect Google Ads, you sign in with Google and approve access to your Google Ads account. We store:
- the Google account that connected, so AdZoom can show who connected the account;
- the ad accounts you select, including accounts under a manager account, with their names, currencies, and time zones;
- campaigns, ad groups, asset groups, and ads with their names, status, and tracking templates; and
- daily spend, impressions, clicks, and conversions for each of them.
We store Google's tokens encrypted. AdZoom only reads reporting data and tracking settings. It never creates, edits, pauses, or deletes a campaign, an ad, or a budget. The Google Ads API grants access through a single permission that Google does not offer as read-only, so this limit comes from how AdZoom works, not from the permission.
Billing
[[DEPENDS: slice 4, billing]] AdZoom is billed through Shopify. We never see or store your payment card details. We store your plan, its price, status, and trial and billing dates.
Exchange rates
If your ad account uses a different currency from your store, AdZoom converts amounts at the day's exchange rate. We fetch daily rates from the exchangeratesapi.io service. We send it a date and our own access key. We send it no data about you or your store.
Install history
We keep a record that your store installed AdZoom: the numeric Shopify store ID, the install and uninstall dates, the trial dates, and whether you ever paid. This record stays after you uninstall. We use it so that a store that reinstalls does not receive a second free trial, and so that remaining trial days carry over if you reinstall within 30 days. We do this on the basis of our legitimate interest in preventing trial abuse. The record holds no personal data. [[QUESTION 12: how long the install record is kept]]
4. Why we use the data
- To show you revenue, costs, and profit per day and per campaign.
- To match your orders to your ads, using the UTM parameters recorded on each order.
- To keep the figures up to date, using Shopify webhooks and scheduled syncs.
- To convert currencies.
- To bill you through Shopify, and to run the free trial.
- To keep AdZoom secure and working, and to find and fix faults.
- To answer your support requests.
We use your data only for these purposes. We do not use it to show advertising, we do not sell it, and we do not use it to profile you or your customers. We never use data from Google Ads, Meta, or Shopify to train machine-learning models.
5. Your customers' data
As a merchant, you are the controller of your customers' data. AdZoom processes it on your behalf, only to provide the service described in this policy. Shopify sends AdZoom three kinds of privacy requests, and we act on them:
- Customer data request. We have to answer within 30 days. We hold only the customer ID and the orders linked to it, and we answer from that.
- Customer erasure. We remove the customer ID from every order of that customer, and we delete the visit history of those orders. Order amounts stay, because they are your sales figures and contain no personal data. The request's own details are cleared from our storage once we have handled it.
- Store erasure. Shopify sends this 48 hours after you uninstall AdZoom. We then delete everything we hold about your store. See section 10.
If a customer asks us about their data, we refer them to you.
6. Google user data
[[DEPENDS: slice 3, Google Ads connection]] AdZoom's use of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
In practice, this means:
- We use Google Ads data only to show you your own campaign reporting inside AdZoom.
- We do not transfer it to others, except as needed to provide AdZoom to you, to follow the law, or as part of a merger or sale of our business.
- We do not use it for advertising, and we do not sell it.
- People at AdZoom do not read it, unless you ask us to, it is needed to investigate abuse or a fault, or the law requires it. [[QUESTION 7: staff access to a shop's data]]
7. Meta platform data
We use data we receive from Meta only as described in section 3 and section 4. We keep it only as long as AdZoom needs it for your account, and we delete it when you ask or when you stop using AdZoom. See section 10. Meta's own handling of your data is covered by Meta's privacy policy.
8. Who else sees the data
| Who | What they do |
|---|---|
| Shopify | Hosts your store and sends us the data above. It also bills you for AdZoom. See Shopify's privacy policy. |
| Meta Platforms | Provides the ad data you connect. |
| Provides the ad data you connect. [[DEPENDS: slice 3]] See Google's privacy policy. | |
| Hosting provider | [[QUESTION 2: hosting provider and country]] Runs the servers and database that hold the data. |
| exchangeratesapi.io | Supplies exchange rates. It receives no data about you or your store. |
We share data with no one else, except where the law requires it.
9. Security
- Shopify, Meta, and Google access tokens are encrypted in our database with AES-256-GCM. A copy of the database alone does not give anyone a usable token.
- Every request to AdZoom is checked with a signed Shopify session token. Every Shopify webhook is checked against its signature.
- Data travels over encrypted HTTPS connections.
- [[QUESTION 6: whether the database and backups are encrypted at rest, and how long backups are kept]]
No system is perfectly secure. If we learn of a breach that affects your data, we will tell you as the law requires.
10. How long we keep data, and how to delete it
| Data | How long |
|---|---|
| Orders, their line items, and their visit history | Up to 24 months. We delete older orders daily. [[DEPENDS: slice 5, retention job]] |
| Daily ad figures | Up to 25 months. [[DEPENDS: slice 5, retention job]] |
| Webhook records and finished background jobs | 7 days. [[DEPENDS: slice 5, retention job]] |
| Privacy request details from Shopify | Cleared as soon as we have handled the request. |
| Everything else about your store | Until you uninstall AdZoom and Shopify's store erasure request arrives, 48 hours later. |
| Install record | [[QUESTION 12: period]] |
Ways to delete your data
- Disconnect Meta in AdZoom. Open Connect platforms and choose Disconnect. This deletes the Meta data AdZoom holds for your store: the token, ad accounts, campaigns, ads, and daily figures. It does not remove AdZoom from your Meta account. To do that, remove AdZoom from your Facebook business integrations in Meta's settings.
- Disconnect Google Ads in AdZoom. [[DEPENDS: slice 3]] The same, for Google Ads. To remove AdZoom's access in Google, use your Google account connections.
- Uninstall AdZoom from your Shopify admin. 48 hours later, Shopify tells us to erase your store, and we delete all its data. If you reinstall within those 48 hours, we keep the data and resume.
- Email us at [[QUESTION 1: support and privacy email address]] from an address you used with us, and name your store. We act on a deletion request promptly and no later than 30 days.
If the law requires us to keep some data, for example billing records, we keep only that data and only for as long as the law requires. [[QUESTION 12: any tax or accounting records AdZoom keeps itself]]
11. Your rights
Depending on where you live, you may have the right to know what data we hold about you, to have it corrected or deleted, to receive a copy in a common format, to restrict or object to its use, and to withdraw consent you gave. To use any of these rights, email us. If you are in the European Economic Area or the United Kingdom, you may also complain to your data protection authority.
Where the GDPR applies, we rely on these legal bases: performance of our contract with you (running AdZoom for you), our legitimate interests (security, fault finding, preventing trial abuse), and legal obligations (for example tax records).
12. Where data is processed
Our servers are in [[QUESTION 2: hosting provider and country]]. Shopify, Meta, and Google process data in the United States and other countries. If you are in the European Economic Area, the United Kingdom, or Switzerland, your data is transferred to and processed outside those regions. [[QUESTION 13: the transfer mechanism, for example standard contractual clauses, if one applies]]
13. This website
The adzoom.app website has no user accounts, no contact form, and no database. It sets no cookies. [[QUESTION 5: website analytics, server access logs, what they record, and how long they are kept]]
When you email us, we keep your message and address to answer you and to keep a record of the request. We do not share them.
The AdZoom app, which runs inside the Shopify admin, sets no cookies of its own. Our servers keep technical logs of requests, with the store domain and a request ID, so that we can find and fix faults.
14. Changes to this policy
We may change this policy. We post the new version on this page and update the date at the top. [[QUESTION 11: how and how far in advance merchants are told about material changes]]
15. Contact
AppCommerce LLC, 30 N Gould St, STE R, Sheridan, WY 82801, USA.
Email: [[QUESTION 1: support and privacy email address]]