Do I need any ad experience to use Ephermal?

No experience required. Ephermal is built specifically for Shopify store owners who have never run a paid ad in their life. You connect your store, and the AI handles audience research, creative writing, campaign setup, and budget management. You review and approve. That's it.

My store is very new. Can I still use Ephermal?

Ephermal is designed for stores at the earliest stage. Whether you've made 10 sales or 10,000, the AI reads your catalog and builds a campaign strategy around what you actually have. The sooner you start running real ads, the sooner you find out what the market wants.

How much should I spend on ads to start?

You set your own ad budget. Ephermal never charges against your ad spend. A common approach is to start with a small daily budget on Meta, see what converts, and only then scale. Ephermal's job is to make that spend count: clearer audiences, better creatives and honest signals on what is worth scaling.

Do I need a Shopify store to use Ephermal?

Yes. Ephermal connects directly to Shopify via OAuth. After authorization, it can import products, pricing, inventory, orders, and revenue for the relevant dashboard tools. Refresh or sync before generating when your store data has changed.

Which ad platforms does Ephermal support?

All plans include Meta campaign creation via the official Meta Marketing API. Growth and Scale also unlock Google Search campaigns through the Google Ads API. Shopping, Performance Max, Display, and YouTube campaign creation are not currently supported.

How does the AI content engine work?

Ephermal reads your live product catalog and generates creator-style ad scripts, hooks, headlines, and copy tailored to your actual products. These are not templates. Every brief is written specifically for your store and audience. You review and approve before anything goes live.

Can I approve creatives before they launch?

Yes. Every creative generated by Ephermal goes through your approval queue first. You can approve, reject, or request a regeneration before anything is published to your ad accounts. You stay in full control at all times.

What is Competitor Radar?

Competitor Radar searches the Meta Ad Library for active ads in your niche. You enter a keyword or brand name and it surfaces what competitors are running right now. The AI then breaks down the hook type, target emotion, and CTA, then writes a counter-strategy so you can position against them before you spend a dollar.

AdLucid is Ephermal's campaign intelligence layer. It combines normalized Meta and Google delivery data with Shopify cost of goods, variable costs, contribution margin, and break-even ROAS. A deterministic engine scores each campaign, retrieves source-backed strategies that match its evidence, and asks AI to create a bounded improvement plan. AdLucid does not make live changes without your approval.

How does Auren use AdLucid?

Auren is Ephermal's conversational copilot. It uses available AdLucid scores, campaign evidence, economics, and measured learning history to explain performance and propose the next controlled test. It does not treat hypotheses as facts or authorize live-account changes.

How does profit-aware campaign optimisation work?

Enter product cost of goods and store variable costs so AdLucid can estimate contribution after ad spend and compare ROAS with your break-even ROAS. The estimate remains separate by ad provider because platform attribution is not deduplicated order truth. You review and approve every proposed live change.

How is billing handled?

Billing is handled directly through Ephermal via Stripe, separate from your Shopify billing. You subscribe monthly and can cancel any time from your dashboard. No agency fees, no hidden costs, no minimum contract.

Legal

Privacy Policy

Last updated: 25 October 2026 · Effective: 26 September 2026

This policy explains how Ephermal ("we", "our", "us") collects, uses and protects personal data of merchants and website visitors, as required by Articles 13 and 14 of the General Data Protection Regulation (GDPR). It also covers UK GDPR and, where they apply, the California Consumer Privacy Act and California Privacy Rights Act.

1. Who We Are

Ephermal is an AI-assisted advertising analysis and campaign-drafting platform for Shopify merchants. It connects to your Shopify store and, if you choose, your Meta Ads and Google Ads accounts to analyse store and advertising data, prepare campaign copy and creative briefs, and create paused campaign drafts at your request. A merchant must approve any provider action.

Controller: Hicham Settah, trading as Ephermal, Rapsweg 18, 47906 Kempen, Germany. Email: hello@ephermal.app. Full provider details are in our Impressum.

We have not appointed a data protection officer because we are not required to (Art. 37 GDPR, § 38 BDSG). Send any data protection question to the email above.

2. Data We Collect

Account data: name, email address and sign-in data, handled by our authentication provider (Clerk).
Shopify store data: shop name, shop email, domain and currency; products, prices and costs; and orders by order number, date, amount and status. We request read-only access and do not request access to your customer records, so no shopper names, emails or addresses are read.
Advertising data: Meta Ads and Google Ads ad account IDs, campaign, ad set and ad settings, and performance metrics, plus the access tokens that let us read them.
Google Merchant Center data (only if you connect Merchant Center): product identifiers, titles, prices, images, availability and eligibility status, as described in Section 11.
Meta Lead Ads data (only if you connect a Facebook Page and use Leads): the contact details people submit in your lead forms, such as name, email address, phone number and any other answers your form asks for.
Content you create: campaign drafts, ad copy, private, store-scoped idea notes and creative text you submit for AI preparation, uploaded images and videos, store analyses and messages you send to Auren.
Billing data: payments are processed by Stripe. We store a Stripe customer ID and your subscription status, never card details.
Communication data: what you send us through the contact form or by email.
Technical data: IP address and request details in hosting logs, error reports when something fails in your browser or our functions, request counts for rate limiting, and aggregated, cookieless page-view statistics (Vercel Web Analytics).

3. Purposes and Legal Bases (Art. 6 GDPR)

Providing the service (Art. 6(1)(b)): your account, the integrations you connect, analyses, AI-assisted drafts, campaign drafts you approve, data export and deletion, transactional emails and billing. Connecting Meta, Google or Shopify is part of the service you request; you can disconnect at any time in Settings.
Legal obligations (Art. 6(1)(c)): keeping billing and accounting records as German commercial and tax law requires.
Legitimate interests (Art. 6(1)(f)): keeping the service secure and reliable (error reports, rate limiting, hosting logs), understanding aggregate website traffic, answering enquiries, and sending account holders a short onboarding email sequence about using Ephermal. Every onboarding email has an unsubscribe link, and you can object to any processing based on legitimate interests at any time.

You need to give us your name and email address to create an account, and connect your Shopify store to use the core features; without them we cannot provide the Service. Connecting Meta or Google, using Leads and everything else is optional.

Where you use Ephermal to process data about your own customers or leads (Shopify orders, Meta Lead Ads submissions), you are the controller of that data and we process it for you as a processor under Section 6 of our Terms of Service (Art. 28 GDPR).

4. How We Use Your Data

To deliver the service: analysing store and advertising data, generating campaign copy and creative briefs, and preparing paused campaign drafts for your review.
To manage your subscription and payments through Stripe.
To send transactional emails (for example when a campaign draft is ready) and the onboarding emails described above. We do not send other marketing emails.
To keep the service secure, fix errors and understand aggregate website traffic.

We do not sell personal data, do not share it for cross-context behavioural advertising, and do not use your store, customer, lead or advertising data to train, fine-tune or improve any AI model. The exception is Higgsfield media generation: when you create a UGC video, the product image and motion prompt you choose may be used by Higgsfield to improve its models (see Section 5). Generating media is always your choice.

Image ad generation is coming soon. When enabled, Higgsfield processes your selected product reference, creative prompt and generated output and may use inputs and outputs to improve its models. Template Library is also coming soon; library sharing does not control provider training, and deleting a creative does not remove information already used to train a provider model.

When you explicitly request AI preparation of a creative brief, the text and selected product information needed for that request are sent to Anthropic for processing and a brief is saved for reuse. Unsubmitted studio text and dictation drafts remain in page memory and are not saved until you save an idea or request AI preparation. Where your browser supports verified on-device recognition for the selected language, raw audio is processed on your device and is not sent to Ephermal.

5. Recipients

Service providers acting on our instructions (processors). Each receives only what its task needs, under a data processing agreement:

Supabase, Inc. (US; data stored in the EU region): database and backend functions; all account and operational data. Safeguard: Standard Contractual Clauses. Supabase Privacy Policy
Vercel Inc. (US): hosting of this website and the dashboard, private generated-image processing when enabled, and cookieless web analytics; generated creative bytes for validation and composition, and request metadata such as IP address and pages visited. Safeguard: Standard Contractual Clauses. Vercel Privacy Policy
Clerk.com, Inc. (US): sign-in and account management; name, email and session data. Safeguard: Standard Contractual Clauses. Clerk Privacy Policy
Stripe: payment processing; billing details. Safeguard: EU-US Data Privacy Framework. Stripe Privacy Policy
Anthropic (Anthropic Ireland Limited for EU customers): AI processing for Auren, AdLucid, ad copy and creative briefs you explicitly ask us to prepare; store, product and campaign data, submitted creative text and the messages you send to Auren. Safeguard: Standard Contractual Clauses for onward transfers. Anthropic Privacy Policy
Plus Five Five, Inc. (Resend) (US): delivery of account, billing and onboarding emails; your name, email address and the email content. Safeguard: EU-US Data Privacy Framework and Standard Contractual Clauses. Resend Privacy Policy
Functional Software, Inc. (Sentry) (US; EU data region): error monitoring; error reports with your user ID, browser details and the page or action that failed. Safeguard: EU-US Data Privacy Framework, with Standard Contractual Clauses as a fallback. Sentry Privacy Policy
Upstash, Inc. (US): rate-limit counters and short-lived caching of selected responses from connected Shopify, Meta and Google APIs. Cached responses are limited to aggregate sales reports, Shopify product and shop details, and Meta and Google campaign and performance data, held for 30 to 600 seconds. Safeguard: Standard Contractual Clauses. Upstash Privacy Policy
ImprovMX Incorporation (US; incoming email is held briefly in the EU and deleted once delivered): forwarding of emails sent to hello@ephermal.app; the content of your email and your address. Safeguard: Standard Contractual Clauses. ImprovMX Privacy Policy
Higgsfield Inc. (US, with operations in Kazakhstan): video generation for UGC video ads on the Growth and Scale plans; only the product image you choose and a motion prompt, with no account or customer data. Safeguard: Standard Contractual Clauses. Higgsfield's own terms allow it to use these inputs and the generated video to improve its models. Higgsfield Privacy Policy

Platforms you connect (independent controllers). When you connect Shopify, Meta or Google, data is exchanged with them through their official APIs, and each processes it under its own terms and privacy policy (Shopify, Meta, Google). Campaigns you approve are created in your own ad accounts.

6. International Data Transfers

Our database is in the EU. Some service providers are based outside the EEA; each transfer is covered by the safeguard named in Section 5 (an EU adequacy decision, the EU-US Data Privacy Framework, or Standard Contractual Clauses). Email hello@ephermal.app for a copy of the relevant safeguard. For UK users, transfers rely on the UK adequacy regulations for the EU and the UK Addendum to the Standard Contractual Clauses where applicable.

7. Security and Retention

Uploaded campaign files continue directly to Meta. Generated images, their private originals and revisions are retained for 30 days, with the exact expiry shown in the workbench. Private preview links expire within ten minutes. Account export includes retained creatives; erasure revokes access and schedules deletion of images, prompts and revisions. Meta attachments have separate Meta retention.

Provider reference objects expire after one hour. Minimized pseudonymous financial records may remain while provider charges are unresolved; they do not retain raw prompts, images, URLs or store links. Settled or released reconciliation records remain until the later of 30 days after settlement or release and the end of that UTC accounting month, bounded to 31 days. Unresolved exposure has no automatic expiry. Legally required billing records follow their separate retention period.

Saved Idea Workspace notes are private to their store, included in your account export and handled by the existing account and store deletion flows. Prepared creative briefs have a 15-minute reuse period; that period is not a promise that every related database row is physically deleted at that time. Unsubmitted text and dictation drafts are held in page memory unless you save an idea or explicitly request AI preparation.

The primary database is hosted in Supabase's EU region. Selected connected-provider responses are also cached for short periods in Upstash Redis, separately from that database. Access tokens are kept in the Supabase database, which is encrypted at rest with AES-256, and are never sent to your browser. Ephermal never stores passwords: sign-in is handled by Clerk. All data in transit is encrypted with TLS 1.2 or higher.

Public store-scan results expire after 24 hours and are purged in hourly batches of up to 1,000 rows. Expired, unused, unclaimed invitation contact fields are scrubbed in bounded batches, while invitation records remain. A ready Shopify privacy-request report payload expires seven days after it becomes available. Final request records for completed or retained requests are eligible for cleanup 30 days after completion, under a shared limit of 1,000 affected rows per cleanup call; unresolved requests have no completion-based cleanup clock.

Account, store, advertising and content data: kept while your account exists and deleted within 30 days of account deletion. Disconnecting an integration deletes its access token immediately and stops further syncing.
Meta Lead Ads data: kept until you delete the leads in Ephermal or delete your account.
Enquiries: kept as long as needed to answer them and for any follow-up.
Error reports and logs: deleted automatically at the end of the provider's retention period.
Billing records: kept for the periods German commercial and tax law requires (up to 10 years).

8. Automated Processing and AI

Ephermal uses AI (Anthropic's models, and Higgsfield for video) to analyse your store and advertising data and to draft copy, briefs, recommendations and campaign drafts. These are proposals for your review: nothing reaches an ad platform without your approval, and campaigns are always created paused.

We make no decisions with legal or similarly significant effects about you based solely on automated processing (Article 22 GDPR). You can always ask a person for help at hello@ephermal.app.

9. Your Rights (GDPR & UK GDPR)

Access to the personal data we hold about you (Art. 15).
Rectification of inaccurate data (Art. 16).
Erasure (Art. 17): delete your account in Settings or see our Data Deletion Instructions.
Restriction of processing (Art. 18).
Portability (Art. 20): download an account export from Settings. The export is bounded and marks when eligible records are truncated; designated sensitive and private request-report fields are redacted. Shopify privacy-request reports use a separate authenticated flow for the verified merchant. Download and explicit receipt are separate, and unresolved report coverage does not complete a request.
Objection (Art. 21) to processing based on legitimate interests, including onboarding emails.

Right to object (Art. 21 GDPR): you can object at any time, on grounds relating to your particular situation, to processing based on our legitimate interests, and at any time without giving reasons to onboarding emails. Use the unsubscribe link in any email or write to hello@ephermal.app.

Email hello@ephermal.app to exercise any right. We reply within one month, extendable by two further months for complex requests with notice.

10. Additional Rights for California Residents (CCPA/CPRA)

Where the CCPA/CPRA applies, you can ask to know, delete and correct the personal information we hold about you, and we will not discriminate against you for doing so. We do not sell personal information or share it for cross-context behavioural advertising, and we do not use sensitive personal information beyond what the service needs. You may use an authorised agent. Email hello@ephermal.app; we reply within 45 days, extendable once by 45 days.

11. Google Merchant Center Data

Status. Google Shopping and Performance Max campaigns are not available yet. This section describes the Merchant Center access that will apply once that feature is released. Until then, Ephermal does not connect to, read from or store data from your Merchant Center account.

If you choose to connect Google Merchant Center, Ephermal requests the Google OAuth scope https://www.googleapis.com/auth/content, which gives access through the Merchant API. Google's consent screen describes this scope as read and write access. Ephermal uses it only to read: it lists and retrieves products and feed status for the Merchant Center account you select. Ephermal does not create, change or delete products, feeds or account settings in Merchant Center.

What we access. Product identifiers (merchant ID, feed label, language and item ID), product titles, prices, image links, availability and product links, and the feed and product eligibility status that shows whether products can advertise.

Why. To let you select products for a Shopping or Performance Max campaign draft, to show whether those products are eligible to advertise, and to match each selected Merchant Center item to its Shopify product and variant using verified evidence only.

When. We access Merchant Center data only after you connect your Merchant Center account and grant the scope in Ephermal. Declining it does not affect Search campaigns or Ads-only features.

What we store. Product titles, prices, images and availability are fetched when you open the product picker and are not saved by Ephermal. We store only a link record for each product you select: the Merchant Center item key, the matched Shopify product and variant, and the time the match was checked. A link record older than 15 minutes must be checked again before it is used to create a campaign. Expired link records that are not used are deleted after 30 days.

Revoking access and deletion. You can remove Ephermal's access at any time in your Google Account at myaccount.google.com/permissions, or by disconnecting Google in Ephermal's settings. Disconnecting deletes the stored Google access token immediately and stops further reads. Merchant Center consent uses the same Google token as Google Ads, so disconnecting Google also stops Google Ads syncing. Link records are deleted when you delete the store or your account.

Limited use. We do not sell Merchant Center data, do not use it to show advertising to anyone other than you in your own ad accounts, and do not use it to train or improve generalized AI models. We transfer it only to the service providers listed in Section 5, acting on our instructions and only as the feature requires.

Ephermal's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

12. Cookies and Browser Storage

We only store information on your device where it is strictly necessary for the service you request (§ 25(2) TDDDG, UK PECR): the sign-in session cookies set by Clerk, and browser storage the dashboard uses to remember your active store and settings. Unsubmitted creative text and dictation drafts stay in page memory; saving an idea stores its text in your account, while requesting AI preparation sends the text to Anthropic and stores a brief for reuse. Raw audio is processed on your device and is not sent to Ephermal. While an idea write is pending, the dashboard stores a content-free recovery record in browser storage, scoped to the account and store, with the action and request ID and, where applicable, the idea ID and status; it does not contain note text. Auren Memory and Persistent chats save a browser-side copy that is not stored in Ephermal's account data or included in Export My Data. A privacy change clears the affected Auren history from an active browser on the next authenticated store-state refresh or sign-in; this is not an instant push, and account deletion cannot remotely clear a copy on an offline device. When you use Auren, your current message is sent to Anthropic for processing; recent saved messages are included only when Memory is enabled. Our website statistics (Vercel Web Analytics) are cookieless and do not store anything on your device. We use no advertising or tracking cookies and no third-party pixels, so no consent banner is needed.

13. Children

Ephermal is a business service and is not directed at anyone under 18.

14. Changes to This Policy

We update this policy when our processing changes and tell account holders about material changes by email or in the platform at least 14 days before they take effect.

15. Contact and Complaints

Questions about this policy: hello@ephermal.app

You have the right to complain to a data protection authority. Ours is the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (ldi.nrw.de); you may also contact the authority where you live or work. UK users may contact the Information Commissioner's Office (ico.org.uk).