Privacy Policy

AdLaps ("we", "us") is an analytics service that connects your Meta Ads, Google Ads and Shopify accounts and shows how your ads perform. This policy explains what we collect, why, and the choices you have. It applies to our website and the AdLaps app.

When you connect your business's ad and store accounts, you (or your company) decide what data we process, and we process it on your behalf. For your own account details, we decide how they are used.

Your account

• Your name, email address and password. We store only a secure hash of the password, never the password itself.
• If you sign in with Google, the name and email address Google shares with us.
• Your organization and workspace names, your team members' email addresses and roles, and the goals you set.
• Billing status. Payment card details are handled by our payment provider; we never see or store them.

Data from the platforms you connect

• Meta Ads and Google Ads: your ad accounts (name, currency, time zone), your campaigns, ad sets and ads, and their performance (for example spend, impressions, clicks and conversions).
• Shopify: your orders (amounts, dates, line items and a customer ID used only to tell new buyers from returning ones) and your products. We do not store your customers' names, email addresses or postal addresses.
• The access tokens the platforms issue so we can read this data.

Technical data

• IP addresses and request details in our security logs and in the audit log of account changes.
• The cookies described below.

• To provide the service: sync your data, calculate your reports, and show dashboards and insights.
• To run your account: sign-in, team invitations, password resets and service emails.
• To keep the service secure: prevent abuse, detect attacks and investigate problems.
• To bill you for your subscription.
• To meet our legal obligations.

• We never sell your data or share it for advertising.
• We never change your ads. We ask Meta and Shopify only for read-only access. Google offers one broader permission, and we use it only to read.
• We never use one customer's data in another customer's account.

We use data from these platforms only to provide AdLaps to you, and in line with each platform's terms. AdLaps's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

You can remove our access at any time: disconnect the account in AdLaps, or remove AdLaps in your Meta, Google or Shopify settings. When you remove the app in Facebook's settings, or ask Meta to delete your data, Meta tells us and we revoke the connection and delete its access token.

We share data only with service providers that help us run AdLaps, under contracts that limit their use of it:

• hosting and database providers that run our servers;
• an email delivery provider, for account emails;
• a payment provider, for billing;
• Vercel Web Analytics, which counts visits to our public pages (the home page, sign-up, login and these legal pages) without cookies and without the address or details of any page inside the app;
• Google Analytics, only if you accept analytics cookies, for the same public pages and nothing inside the app;
• a breached-password check: when you choose a password, we send only the first five characters of its hash, so the password itself never leaves our servers.

We may also disclose data if the law requires it, or to a buyer if our business is sold, in which case this policy continues to protect it.

• All traffic is encrypted in transit (HTTPS).
• Platform access tokens are encrypted, each with its own key, and kept apart from the rest of our data.
• Each customer's data is isolated in the database, so one account cannot read another's.
• Access tokens never appear in our logs.

• Your synced reports: while your subscription is active, plus 90 days.
• Platform access tokens: deleted as soon as you disconnect the account.
• Audit logs: 12 months. Security logs: 90 days. Backups: 30 days.

We use only cookies that the service needs to work: one that keeps you signed in, and short-lived ones that protect the steps where you connect an ad account or a Shopify store. We use no advertising cookies. We count visits to our public pages with Vercel Web Analytics, which sets no cookies. With your consent only, Google Analytics sets its cookies (_ga and _ga_*, kept up to 2 years) on those public pages to measure how visitors find and use the site; it never sees pages inside the app. You can change your choice at any time with Cookie settings at the foot of our home page.

Depending on where you live (for example under the EU and UK GDPR or India's Digital Personal Data Protection Act), you can ask to access, correct or delete your personal data, to receive a copy of it, or to object to or restrict how we use it. You can withdraw consent at any time, and you can complain to your local data protection authority.

To make a request, email support@adlaps.com. We complete deletion requests within 30 days. If your account belongs to a company, we may refer your request to that company.

Our servers may be in a different country from yours. Where we transfer personal data across borders, we use the safeguards the law requires.

AdLaps is a business tool and is not meant for anyone under 18. We do not knowingly collect children's data.

If we change this policy, we will update the effective date at the top, and for significant changes we will tell you by email or in the app before they take effect.

Questions about privacy, or a complaint (including to our grievance officer under India's DPDP Act): support@adlaps.com.