Privacy Policy

This Privacy Policy explains how Adlift ("we," "our," "us"), collects, uses, and protects your personal data when you visit our website or use our services. We are committed to safeguarding your privacy in accordance with the General Data Protection Regulation (GDPR) and other applicable laws. Your use of our website and services is also governed by our Terms & Conditions.

Information We Collect

We collect the following categories of information when you interact with our website:

How We Use Your Information

We process your personal data to:

• Understand user behavior and website performance
• Improve content, functionality, and user experience
• Measure and optimize the effectiveness of advertising campaigns
• Generate analytics reports for internal use

Legal Basis for Processing

We process your personal data under the following legal bases:

• Consent — for analytics tracking and cookies (you can withdraw at any time)
• Legitimate Interests — for maintaining website security and preventing fraud
• Contractual Necessity — if processing is required to provide requested services

You can withdraw your consent at any time by disabling cookies in your browser settings or by using available opt-out tools.

Sharing of Information

We do not sell or rent your personal data. We may share data with trusted service providers (e.g., Google, Meta, PostHog) solely for analytics and service improvement purposes, in accordance with their respective privacy policies:

• Google Privacy Policy
• Meta Privacy Policy
• PostHog Privacy Policy

Connected Google Accounts (Google Search Console and Google Analytics)

If you connect Google Search Console or Google Analytics to Adlift, you grant us read-only access to the data of the properties you choose (scopes: webmasters.readonly for Search Console; analytics.readonly and userinfo.email for Google Analytics). Adlift never writes to, changes or deletes anything in your Google accounts. We use this data only to show it to you inside your workspace, next to your advertising results, and as one input to the analyses Adlift prepares for your own brand. Specifically:

• What we access in Search Console: the list of Search Console properties you can see, and for the property you pick, the search queries, clicks, impressions and positions of your own site.
• What we access in Google Analytics: the list of Google Analytics 4 accounts and properties you can see, and for the property you assign to a brand, daily aggregated reports: sessions, engaged sessions, key events, purchases and purchase revenue, broken down by date, traffic source, medium and campaign. These are totals; we do not access data about individual visitors. We also read the email address of the Google account you connect, so your workspace can show which account the data comes from.
• What we do with it: we display it in your workspace and use it as one input to the analyses, reports and automations of your brand, for example to compare your ad spend with the sessions and revenue it brought to your site. We do not use it to train machine-learning models, we do not build advertising profiles from it, we do not use it for advertising of any kind and we do not combine it with data from other customers.
• Who can see it: members of your workspace only. It is never shared with other customers, sold, or transferred to third parties, except to the infrastructure providers that host Adlift (see Sharing of Information). Adlift staff do not read it, except with your permission to help with a support request, for security purposes or where the law requires it.
• How it is stored: your Google refresh tokens are stored encrypted. Search Console query data is cached in your workspace for the period the report or analysis covers and is deleted when you disconnect the account or delete the workspace. Google Analytics daily reports are stored in your workspace so your history stays available; disconnecting Google Analytics deletes the token and stops all further syncing, removing a property from a brand deletes that brand's stored Analytics data, and deleting the workspace deletes all of it.
• Adlift's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

You can disconnect Google Search Console or Google Analytics at any time from Integrations in your workspace, which deletes the stored token, or revoke Adlift's access from your Google Account permissions page (myaccount.google.com/permissions).

Connected Shopify Stores

If you connect your Shopify store to Adlift, you grant us read-only access to your store's products and orders (scopes: read_products, read_orders). We use this only to show your store's performance next to your advertising inside your workspace. The connection is read-only — Adlift never writes to or changes your store. Specifically:

• What we access: your products and variants (titles, prices, inventory, cost, product pages); your orders (totals, discounts, taxes, shipping, refunds, line items, and the marketing attribution — the campaign and UTM parameters — that led to each order); and your shop details (currency, time zone, domain, plan).
• What we never access: any information that identifies a buyer. We do not read or store customer names, emails, addresses or phone numbers, and we request no customer-data permissions.
• What we do with it: we display it in your workspace and compute your store's daily revenue alongside your ad spend. We do not use it to train machine-learning models, build advertising profiles, or combine it with other customers' data.
• Who can see it: members of your workspace only. It is never sold or shared with third parties, except the infrastructure providers that host Adlift (see Sharing of Information).
• How it is stored: your Shopify access and refresh tokens are stored encrypted; order and product records are held in your workspace while your store is connected.
• How long we keep it: order records are retained for up to 25 months to allow year-on-year comparisons; the daily totals we derive (which identify no individual) are kept while your store is connected.

You can disconnect your store at any time from Integrations in your workspace, which stops all reading and removes the app from your store. We also honour Shopify's data-request, customer-redaction and shop-redaction requests, deleting the relevant records within the time Shopify requires.

Connected WooCommerce Stores

If you connect your WooCommerce store to Adlift, you grant us read-only access to your store through a REST API key that you approve or create on your own site. We use this only to show your store's performance next to your advertising inside your workspace. The connection is read-only: Adlift never writes to or changes your store. Specifically:

• What we access: your orders (number, status, dates, totals, discounts, taxes, shipping and refunds), your published products (titles, descriptions, prices, SKUs, stock, categories and product images) and your store's name, currency and time zone.
• Your products in Adlift: we add your published products to your brand's product library and keep a copy of their main images in our storage, so you can use them to create photos and ads. Product data describes your goods, not your buyers.
• AI analysis of a product: the first time you use one of your store's products in Studio, its images and description are sent to the AI provider Adlift uses for product analysis (currently OpenAI), so Adlift can describe the product accurately. This happens only when you use the product, never for your whole catalogue.
• What we keep about a buyer: nothing that identifies them. We do not store names, emails, addresses or phone numbers. From each order we compute a keyed one-way hash of the billing email, on our servers, and keep only that hash. It lets us tell a buyer's first order from a later one and cannot be turned back into an email address.
• What we do with it: we display it in your workspace and compute your store's daily revenue alongside your ad spend. We do not use it to train machine-learning models, build advertising profiles, or combine it with other customers' data.
• Who can see it: members of your workspace only. It is never sold or shared with third parties, except the infrastructure providers that host Adlift (see Sharing of Information).
• How it is stored: your WooCommerce API key and secret are stored encrypted; order records are held in your workspace.
• How long we keep it: we import the last 12 months of orders and keep order records for up to 13 months; the daily totals we derive (which identify no individual) are kept until you delete them. Products added to your product library, with their images and analysis, stay there until you delete them from the Products page, also after you disconnect the store.

You can disconnect your store at any time from Integrations in your workspace, which deletes our copy of the key and stops all reading. You can then delete the orders, refunds and daily totals imported from the store with the Delete data action; products in your product library are kept until you delete them from the Products page. To close the access on your side as well, revoke the key in WordPress under WooCommerce > Settings > Advanced > REST API.

Data Retention

We retain analytics data for as long as necessary to fulfill the purposes described in this policy, or as required by law. Data that is no longer needed will be securely deleted or anonymized.

Your Rights (GDPR)

As an EU resident, you have the right to:

• Access — the personal data we hold about you
• Rectify — inaccurate or incomplete data
• Erase — your personal data ("right to be forgotten")
• Restrict or object — to the processing of your data
• Data portability — request a copy of your personal data in a structured format
• Withdraw consent — at any time without affecting prior processing
• Lodge a complaint — with the Latvian Data State Inspectorate or your local supervisory authority

Data Security

We implement reasonable technical and organizational measures to protect your personal data against unauthorized access, loss, misuse, or disclosure. However, no system can be guaranteed to be 100% secure.

International Data Transfers

Your data may be transferred to and processed in countries outside the European Economic Area (EEA) where our analytics providers operate. When such transfers occur, we ensure they are protected by appropriate safeguards (e.g., Standard Contractual Clauses).

Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal obligations. Updated versions will be posted on this page with the revised effective date. Continued use of our website after changes means you accept the updated policy.