Privacy Policy

1. Who We Are

Ephermal is an AI-assisted advertising analysis and campaign-drafting platform for Shopify merchants. It connects to your Shopify store and, if you choose, your Meta Ads and Google Ads accounts to analyse store and advertising data, prepare campaign copy and creative briefs, and create paused campaign drafts at your request. A merchant must approve any provider action.

Controller: Hicham Settah, trading as Ephermal, Rapsweg 18, 47906 Kempen, Germany. Email: hello@ephermal.app. Full provider details are in our Impressum.

We have not appointed a data protection officer because we are not required to (Art. 37 GDPR, § 38 BDSG). Send any data protection question to the email above.

2. Data We Collect

• Account data: name, email address and sign-in data, handled by our authentication provider (Clerk).
• Shopify store data: shop name, shop email, domain and currency; products, prices and costs; and orders by order number, date, amount and status. We request read-only access and do not request access to your customer records, so no shopper names, emails or addresses are read.
• Advertising data: Meta Ads and Google Ads ad account IDs, campaign, ad set and ad settings, and performance metrics, plus the access tokens that let us read them.
• Meta Lead Ads data (only if you connect a Facebook Page and use Leads): the contact details people submit in your lead forms, such as name, email address, phone number and any other answers your form asks for.
• Content you create: campaign drafts, ad copy, uploaded images and videos, store analyses and messages you send to Auren.
• Billing data: payments are processed by Stripe. We store a Stripe customer ID and your subscription status, never card details.
• Communication data: what you send us through the contact form or by email.
• Technical data: IP address and request details in hosting logs, error reports when something fails in your browser or our functions, request counts for rate limiting, and aggregated, cookieless page-view statistics (Vercel Web Analytics).

3. Purposes and Legal Bases (Art. 6 GDPR)

• Providing the service (Art. 6(1)(b)): your account, the integrations you connect, analyses, AI-assisted drafts, campaign drafts you approve, data export and deletion, transactional emails and billing. Connecting Meta, Google or Shopify is part of the service you request; you can disconnect at any time in Settings.
• Legal obligations (Art. 6(1)(c)): keeping billing and accounting records as German commercial and tax law requires.
• Legitimate interests (Art. 6(1)(f)): keeping the service secure and reliable (error reports, rate limiting, hosting logs), understanding aggregate website traffic, answering enquiries, and sending account holders a short onboarding email sequence about using Ephermal. Every onboarding email has an unsubscribe link, and you can object to any processing based on legitimate interests at any time.

You need to give us your name and email address to create an account, and connect your Shopify store to use the core features; without them we cannot provide the Service. Connecting Meta or Google, using Leads and everything else is optional.

Where you use Ephermal to process data about your own customers or leads (Shopify orders, Meta Lead Ads submissions), you are the controller of that data and we process it for you as a processor under Section 6 of our Terms of Service (Art. 28 GDPR).

4. How We Use Your Data

• To deliver the service: analysing store and advertising data, generating campaign copy and creative briefs, and preparing paused campaign drafts for your review.
• To manage your subscription and payments through Stripe.
• To send transactional emails (for example when a campaign draft is ready) and the onboarding emails described above. We do not send other marketing emails.
• To keep the service secure, fix errors and understand aggregate website traffic.

We do not sell personal data, do not share it for cross-context behavioural advertising, and do not use your store, customer, lead or advertising data to train, fine-tune or improve any AI model. The exception is Higgsfield media generation: when you create a UGC video, the product image and motion prompt you choose may be used by Higgsfield to improve its models (see Section 5). Generating media is always your choice.

Image ad generation is coming soon. When enabled, Higgsfield processes your selected product reference, creative prompt and generated output and may use inputs and outputs to improve its models. Template Library is also coming soon; library sharing does not control provider training, and deleting a creative does not remove information already used to train a provider model.

5. Recipients

Service providers acting on our instructions (processors). Each receives only what its task needs, under a data processing agreement:

• Supabase, Inc. (US; data stored in the EU region): database and backend functions; all account and operational data. Safeguard: Standard Contractual Clauses. Supabase Privacy Policy
• Vercel Inc. (US): hosting of this website and the dashboard, private generated-image processing when enabled, and cookieless web analytics; generated creative bytes for validation and composition, and request metadata such as IP address and pages visited. Safeguard: Standard Contractual Clauses. Vercel Privacy Policy
• Clerk.com, Inc. (US): sign-in and account management; name, email and session data. Safeguard: Standard Contractual Clauses. Clerk Privacy Policy
• Stripe: payment processing; billing details. Safeguard: EU-US Data Privacy Framework. Stripe Privacy Policy
• Anthropic (Anthropic Ireland Limited for EU customers): AI processing for Auren, AdLucid and ad copy; store, product and campaign data and the messages you send to Auren. Safeguard: Standard Contractual Clauses for onward transfers. Anthropic Privacy Policy
• Plus Five Five, Inc. (Resend) (US): delivery of account, billing and onboarding emails; your name, email address and the email content. Safeguard: EU-US Data Privacy Framework and Standard Contractual Clauses. Resend Privacy Policy
• Functional Software, Inc. (Sentry) (US; EU data region): error monitoring; error reports with your user ID, browser details and the page or action that failed. Safeguard: EU-US Data Privacy Framework, with Standard Contractual Clauses as a fallback. Sentry Privacy Policy
• Upstash, Inc. (US): rate limiting that protects the service from abuse; a pseudonymous user identifier and request counts. Safeguard: Standard Contractual Clauses. Upstash Privacy Policy
• ImprovMX Incorporation (US; incoming email is held briefly in the EU and deleted once delivered): forwarding of emails sent to hello@ephermal.app; the content of your email and your address. Safeguard: Standard Contractual Clauses. ImprovMX Privacy Policy
• Higgsfield Inc. (US, with operations in Kazakhstan): video generation for UGC video ads on the Growth and Scale plans; only the product image you choose and a motion prompt, with no account or customer data. Safeguard: Standard Contractual Clauses. Higgsfield's own terms allow it to use these inputs and the generated video to improve its models. Higgsfield Privacy Policy

Platforms you connect (independent controllers). When you connect Shopify, Meta or Google, data is exchanged with them through their official APIs, and each processes it under its own terms and privacy policy (Shopify, Meta, Google). Campaigns you approve are created in your own ad accounts.

6. International Data Transfers

Our database is in the EU. Some service providers are based outside the EEA; each transfer is covered by the safeguard named in Section 5 (an EU adequacy decision, the EU-US Data Privacy Framework, or Standard Contractual Clauses). Email hello@ephermal.app for a copy of the relevant safeguard. For UK users, transfers rely on the UK adequacy regulations for the EU and the UK Addendum to the Standard Contractual Clauses where applicable.

7. Security and Retention

Uploaded campaign files continue directly to Meta. Generated images, their private originals and revisions are retained for 30 days, with the exact expiry shown in the workbench. Private preview links expire within ten minutes. Account export includes retained creatives; erasure revokes access and schedules deletion of images, prompts and revisions. Meta attachments have separate Meta retention.

Provider reference objects expire after one hour. Minimized pseudonymous financial records may remain while provider charges are unresolved; they do not retain raw prompts, images, URLs or store links. Settled or released reconciliation records remain until the later of 30 days after settlement or release and the end of that UTC accounting month, bounded to 31 days. Unresolved exposure has no automatic expiry. Legally required billing records follow their separate retention period.

Data is stored in Supabase's EU region. Access tokens are kept in that database, which is encrypted at rest with AES-256, and are never sent to your browser. Ephermal never stores passwords: sign-in is handled by Clerk. All data in transit is encrypted with TLS 1.2 or higher.

• Account, store, advertising and content data: kept while your account exists and deleted within 30 days of account deletion. Disconnecting an integration deletes its access token immediately and stops further syncing.
• Meta Lead Ads data: kept until you delete the leads in Ephermal or delete your account.
• Enquiries: kept as long as needed to answer them and for any follow-up.
• Error reports and logs: deleted automatically at the end of the provider's retention period.
• Billing records: kept for the periods German commercial and tax law requires (up to 10 years).

8. Automated Processing and AI

Ephermal uses AI (Anthropic's models, and Higgsfield for video) to analyse your store and advertising data and to draft copy, briefs, recommendations and campaign drafts. These are proposals for your review: nothing reaches an ad platform without your approval, and campaigns are always created paused.

We make no decisions with legal or similarly significant effects about you based solely on automated processing (Article 22 GDPR). You can always ask a person for help at hello@ephermal.app.

9. Your Rights (GDPR & UK GDPR)

• Access to the personal data we hold about you (Art. 15).
• Rectification of inaccurate data (Art. 16).
• Erasure (Art. 17): delete your account in Settings or see our Data Deletion Instructions.
• Restriction of processing (Art. 18).
• Portability (Art. 20): export your data as a file from Settings at any time.
• Objection (Art. 21) to processing based on legitimate interests, including onboarding emails.

Right to object (Art. 21 GDPR): you can object at any time, on grounds relating to your particular situation, to processing based on our legitimate interests, and at any time without giving reasons to onboarding emails. Use the unsubscribe link in any email or write to hello@ephermal.app.

Email hello@ephermal.app to exercise any right. We reply within one month, extendable by two further months for complex requests with notice.

10. Additional Rights for California Residents (CCPA/CPRA)

Where the CCPA/CPRA applies, you can ask to know, delete and correct the personal information we hold about you, and we will not discriminate against you for doing so. We do not sell personal information or share it for cross-context behavioural advertising, and we do not use sensitive personal information beyond what the service needs. You may use an authorised agent. Email hello@ephermal.app; we reply within 45 days, extendable once by 45 days.

11. Cookies and Browser Storage

We only store information on your device where it is strictly necessary for the service you request (§ 25(2) TDDDG, UK PECR): the sign-in session cookies set by Clerk, and browser storage the dashboard uses to remember your active store and settings. Our website statistics (Vercel Web Analytics) are cookieless and do not store anything on your device. We use no advertising or tracking cookies and no third-party pixels, so no consent banner is needed.

12. Children

Ephermal is a business service and is not directed at anyone under 18.

13. Changes to This Policy

We update this policy when our processing changes and tell account holders about material changes by email or in the platform at least 14 days before they take effect.

14. Contact and Complaints

Questions about this policy: hello@ephermal.app

You have the right to complain to a data protection authority. Ours is the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (ldi.nrw.de); you may also contact the authority where you live or work. UK users may contact the Information Commissioner's Office (ico.org.uk).