How Ephermal handles your accounts

1. Ephermal cannot spend your money on its own

This is the guarantee that matters most, so it is the one stated first. Ephermal drafts campaigns and changes; you approve them. There is no path in the product where money is committed without an explicit action from you.

• Campaigns are created paused in Meta or Google, every time, without exception.
• Enabling a paused campaign is your action, taken in your own ad account or through an explicit confirmation here.
• No budget or live-spend change is applied without you confirming that specific change.
• Rejecting a recommendation costs nothing. The draft is kept so you can revisit it.
• Cancelling your subscription stops the software. There is no background process that keeps campaigns running afterwards.

2. How the connections work

Every integration uses the provider's official OAuth flow and official API. Ephermal never asks for, sees, or stores your password for any of these platforms, and there is no scraping of any provider.

• Shopify via OAuth, using the Admin API. The permissions requested are read-only and limited to what the product actually reads: read_products, read_orders, read_reports and read_themes. Ephermal does not request access to your customer records.
• Meta via OAuth, using the official Meta Marketing API, for reading campaign performance and for creating paused campaigns you have approved.
• Google via OAuth, using the official Google Ads API, for Google Search campaigns. Shopping and Performance Max are not supported.

The Shopify permission set is checked by an automated test on every build, so the product cannot quietly start asking for more access than it uses.

3. Where your data lives

Uploaded campaign files continue directly to Meta. Generated images, private originals and revisions are retained for 30 days when image generation is enabled. Owned private preview links expire within ten minutes. Export includes retained creatives; erasure revokes access and schedules deletion. Minimized financial reconciliation records and attached Meta assets have separate retention, described in the privacy policy.

• The primary database for account and operational records is hosted in Supabase's EU region. Selected connected-provider responses are also cached for 30 to 600 seconds in Upstash Redis, separately from that database.
• Advertising account tokens are kept in a database encrypted at rest with AES-256 and are never sent to your browser, and all data in transit is encrypted with TLS 1.2 or higher.
• Some sub-processors are incorporated outside the EEA. Each is covered by an appropriate transfer safeguard, listed individually in the privacy policy along with what data it receives.

To be precise rather than flattering: the database is in the EU, but the web tier and the authentication provider are not, and the privacy policy names each one.

4. Artificial intelligence

Image ad generation and Template Library are coming soon. Higgsfield may use image-generation inputs and outputs to improve its models. Library sharing does not control provider training, and private storage does not require library consent.

• We do not use your store, customer, lead or advertising data to train AI. If you choose to make a UGC video, Higgsfield may use the product image and motion prompt you select, and the generated video, to improve its models. See our privacy policy.
• AI output is a draft. Recommendations carry the evidence behind them so you can check the reasoning rather than take it on faith.
• You can review, edit or reject any AI-generated output before it reaches an ad platform.
• Ephermal reads the data your store and ad accounts actually expose. It does not have information about your business that you have not connected.

5. Taking access back

• Disconnect any integration from Settings inside Ephermal. Advertising tokens are deleted immediately on disconnection.
• Revoke Ephermal independently at the provider: in Shopify under Apps, in Meta Business Suite under Business Integrations, and in your Google account under Third-party access. You do not need our cooperation to cut access off.
• Download an account export as a JSON file from Settings. Access tokens and other designated sensitive or private request-report fields are redacted. Row limits can truncate the export, and the file marks when that happens.
• Request deletion of your account and associated data at any time. Some records may remain for financial, security, recovery or unresolved privacy-request reasons, as described in the data deletion instructions and Privacy Policy. Deleting an account also removes the stored connection to your Shopify, Meta and Google accounts, including the access tokens themselves.
• Shopify privacy-request reports use a separate authenticated flow for the verified merchant. Downloading a report and explicitly acknowledging receipt are separate steps; unresolved coverage remains visible and is not treated as completion.

6. Reporting a vulnerability

If you believe you have found a security problem, email hello@ephermal.app with enough detail to reproduce it. Please report it to us before disclosing it publicly, and we will respond to you directly.

Ephermal is an independent product. It is not Shopify, Meta or Google, and it is not endorsed by them. Full terms are in the terms of service.