How Ephermal handles your accounts

1. Ephermal cannot spend your money on its own

This is the guarantee that matters most, so it is the one stated first. Ephermal drafts campaigns and changes; you approve them. There is no path in the product where money is committed without an explicit action from you.

• Campaigns are created paused in Meta or Google, every time, without exception.
• Enabling a paused campaign is your action, taken in your own ad account or through an explicit confirmation here.
• No budget or live-spend change is applied without you confirming that specific change.
• Rejecting a recommendation costs nothing. The draft is kept so you can revisit it.
• Cancelling your subscription stops the software. There is no background process that keeps campaigns running afterwards.

2. How the connections work

Every integration uses the provider's official OAuth flow and official API. Ephermal never asks for, sees, or stores your password for any of these platforms, and there is no scraping of any provider.

• Shopify via OAuth, using the Admin API. The permissions requested are read-only and limited to what the product actually reads: read_products, read_orders, read_reports and read_themes. Ephermal does not request access to your customer records.
• Meta via OAuth, using the official Meta Marketing API, for reading campaign performance and for creating paused campaigns you have approved.
• Google via OAuth, using the official Google Ads API, for Google Search campaigns. Shopping and Performance Max are not supported.

The Shopify permission set is checked by an automated test on every build, so the product cannot quietly start asking for more access than it uses.

3. Where your data lives

• Account and operational data is stored in the EU, in Supabase's EU region.
• Advertising account tokens are encrypted at rest using AES-256, and all data in transit is protected by TLS 1.3.
• Some sub-processors are incorporated outside the EEA. Each is covered by an appropriate transfer safeguard, listed individually in the privacy policy along with what data it receives.

To be precise rather than flattering: the database is in the EU, but the web tier and the authentication provider are not, and the privacy policy names each one.

4. Artificial intelligence

• Your data is never used to train or fine-tune third-party AI models. It is sent to a model to answer your request, and that is all it is used for.
• AI output is a draft. Recommendations carry the evidence behind them so you can check the reasoning rather than take it on faith.
• You can review, edit or reject any AI-generated output before it reaches an ad platform.
• Ephermal reads the data your store and ad accounts actually expose. It does not have information about your business that you have not connected.

5. Taking access back

• Disconnect any integration from Settings inside Ephermal. Advertising tokens are deleted immediately on disconnection.
• Revoke Ephermal independently at the provider: in Shopify under Apps, in Meta Business Suite under Business Integrations, and in your Google account under Third-party access. You do not need our cooperation to cut access off.
• Delete your account and its data at any time. See data deletion for what is removed and when.

6. Reporting a vulnerability

If you believe you have found a security problem, email hello@ephermal.app with enough detail to reproduce it. Please report it to us before disclosing it publicly, and we will respond to you directly.

Ephermal is an independent product. It is not Shopify, Meta or Google, and it is not endorsed by them. Full terms are in the terms of service.