Privacy Policy

Etovi Pty Ltd (ACN 697 881 940, ABN 56 697 881 940) ( "Etovi", "we", "us", "our") operates an AI-assisted e-commerce business management platform. Our software brings together commerce analytics, inventory planning, creative tools, competitor and website research, and team collaboration for merchants who use Shopify.

This Privacy Policy describes how we collect, use, share, and protect personal data in connection with:

• The Etovi website at etovi.ai (the "Site")
• The Etovi dashboard application (the "Service")
• The Etovi Shopify app and its installed extensions

For most personal data we receive, our merchant clients are the data controller and Etovi acts as their data processor. For data we collect directly from visitors to etovi.ai or from merchants who sign up for our Service, Etovi is the data controller.

2.1 Data we collect from merchants (our direct users)

When a merchant signs up for Etovi, we collect:

• Name and email address, through Google sign-in, a verified email link, or your verified Shopify identity when creating an account from the Shopify app
• Workspace name and the merchant's industry / country
• Authentication tokens for connected platforms (Google Ads, Meta Ads, Shopify) — encrypted at rest using Fernet symmetric encryption

2.2 Data we process on behalf of merchants

When a merchant connects their Shopify store, we process the following on their behalf:

• Order data: order ID, totals, dates, line items, discount codes, refund amounts, shipping costs, taxes
• Customer fields linked to orders: first name, last name, Shopify customer ID, and email address. We use hashed email identifiers for analytics and matching. Available customer email addresses can also be retained in encrypted form for permission-controlled contact display, with access recorded in an audit log. Hashing and encryption do not make this data anonymous.
• Customer context: customer tags and notes supplied by the merchant, email-marketing consent state, and purchase and engagement history, for customer records, segmentation and consent-controlled marketing workflows.
• Geographic information: shipping postcode and country, or billing postcode and country when shipping information is unavailable, for geographic customer analysis.
• Shopify event deliveries: we retain copies of incoming event payloads to process updates, retry failed work and investigate delivery problems. These copies can contain additional customer contact or address fields supplied by Shopify, beyond the fields used in our analytics tables.
• Product and inventory data: SKUs, prices, costs, stock levels, product content, and operator-approved product SEO updates
• Marketing performance data: ad spend, clicks, conversions and campaign details from Google Ads and Meta Ads.
• Meta Ads (Facebook and Instagram advertising): when a merchant connects a Meta ad account, we request the permissions below and use each one only as described.
  • ads_read: to read the merchant's ad accounts (name, currency and time zone), campaigns, ad sets and ads, with their status, budgets and Meta's review status; each ad's creative content; daily performance metrics such as spend, impressions, clicks, reach and conversions; the reach Meta reports for the period the merchant is viewing; and the names and IDs of the ad account's Meta pixels, so the merchant can choose which one a new campaign tracks purchases with; and, only when a new campaign's ads will reach people in the European Economic Area (the EU, Iceland, Liechtenstein and Norway), the beneficiary and payer names Meta suggests for the ad account, so the merchant can confirm them.
  • ads_management: to make the changes a merchant approves, described below.
  • pages_show_list, pages_read_engagement and pages_manage_ads: only to let the merchant choose which Facebook Page, and optionally which linked Instagram account, a new ad runs as, and to create that ad for the Page. We read only the Page's name and picture and the Instagram account's username and profile picture. We do not post to the Page, read its posts or comments, or manage the Page.
  • Basic profile access, which Facebook includes with every login: we record only the app-scoped ID of the person who connected, so we can act on removal and deletion requests. We do not read their name, email address or photo.

  What we store. We store what we read: account, campaign, ad set and ad names, statuses, budgets and daily metrics, and each ad's creative content, meaning its primary text, headlines, descriptions, destination link, a link to its thumbnail image with a visual fingerprint of that image, and Meta's review feedback. We also keep the permissions the merchant granted, the access token (encrypted), a record of every change made through Etovi with its before and after values, and a record of the images and videos uploaded to the ad account for new ads. We do not read or store custom audiences or information about the people who see the merchant's ads.

  Changes we make, and only with approval. Etovi changes a Meta ad account only after the merchant turns on "Allow Etovi to apply changes" for that account, and only when a person on the merchant's team confirms each change. The changes available are:

  • adding UTM tracking tags to ads;
  • pausing and resuming campaigns, ad sets and ads;
  • changing campaign and ad set budgets;
  • changing an ad's copy, either as a new paused ad beside the original or in the ad itself;
  • creating new paused ads from images and videos approved in Etovi, which we upload to the ad account; and
  • creating a paused Sales campaign with one ad set and its paused ads from a Launch Studio plan.

  New ads, copy changes added as a new ad, and the ads in a Sales campaign carry Etovi's tracking tags (UTM parameters) so sales can be matched to the ad.

  New ads, ad sets and campaigns are created paused and do not spend until the merchant activates them as a separate step. Etovi's AI agents can suggest changes but never apply them. Where Meta allows, the merchant can undo a change: tracking tags, status, budget and copy are restored, and ads or campaigns we created are archived. Turning the switch off stops new changes but never removes the ability to undo one already made.

  Audiences and creative enhancements. We do not create, upload or change custom audiences, and we do not change the targeting of existing ad sets. A new ad set we create targets the countries of the workspace's configured market and uses Meta's Advantage+ audience. When those countries are in the European Economic Area, the ad set also names the beneficiary and payer the merchant confirms (who the ads are for and who pays for them). EU ad transparency rules require these for ads in the EU, and Meta shows them publicly in its Ad Library. Meta's optional Advantage+ creative enhancements and multi-advertiser ads, which let Meta automatically adjust an ad's creative or show it beside other advertisers' ads, are sent switched off with every new ad and copy change we make, unless the merchant turns them on.

  Disconnecting and deletion. Disconnecting in Etovi, or removing Etovi in Facebook's settings, stops all syncing. The data already synced is kept for 90 days after a disconnect in Etovi, or 30 days after Etovi is removed in Facebook's settings, so reconnecting within that time picks up where it left off. After that we delete it automatically, and we email the workspace owner at least 14 days beforehand. The merchant can delete it sooner at any time; disconnecting in Etovi offers that deletion at the same time. A data deletion request made through Facebook deletes the Meta data described above for every ad account connected with that Facebook login. Our Data Deletion page describes each route and exactly what each one removes.

• Storefront tracking data: if the merchant installs the Etovi pixel and theme app extension, we collect page views and basic interaction events from visitors to the merchant's storefront. This includes URL, referrer, UTM parameters, click IDs (gclid, fbclid), a first-party cookie ID issued by us, and a session ID. We do not collect IP addresses, precise geolocation, browsing fingerprints, mouse movements, or keystrokes.

Etovi does not need customer card numbers or card security codes to provide its analytics features. These disclosures cover retained event copies as well as the data displayed in the dashboard.

2.3 Content used in creative, research and collaboration features

• Creative and AI content: prompts, reference images, uploaded assets, design documents and generated outputs used to create or edit content. AI requests can include relevant workspace context and information you supply; these inputs can contain personal data.
• Research inputs: website and competitor URLs, search terms, selected markets and languages, and the public content returned for competitor, SEO and AI-search analysis.
• Voice features: audio you submit for transcription and recognition terms such as workspace or agent names. When you use read-aloud, the selected text and voice instructions are sent to a speech provider.
• Shared work: messages, attachments, task and board content, comments and visual canvas documents. This content is available to the people with access to the relevant shared space.

The data sent to a provider depends on the feature you use. For example, image generation can send a prompt and reference media, while a search query can send a domain and search terms. Using one feature does not mean every provider receives all your store data.

2.4 Data we collect about Site visitors

When you visit etovi.ai we collect basic technical data: browser type, device type, pages viewed, and referrer. We use cookies and similar technologies for essential site functionality only — see our cookie disclosure in section 7 below.

We process personal data for the following purposes:

• To provide the Service. Multi-touch attribution, lifetime value cohort analysis, demand forecasting, and ad performance reporting require analysing order and customer data. We also process content to provide AI assistance, creative generation and editing, website and competitor research, voice features, and shared messaging, boards and canvases, and to make the changes a merchant approves in a connected ad account.
• To authenticate and bill our merchants. Login, session management, billing, and account recovery.
• To improve and secure the Service. Performance monitoring, error tracking, fraud detection, and security auditing.
• To communicate with our merchants. Service notifications, security alerts, and (with consent) product updates.
• To comply with legal obligations. Including responding to law-enforcement requests and Shopify's privacy compliance webhooks.

We do not sell personal data or use it for behavioural advertising. We share data with the service providers and connected platforms described in section 8 to deliver the features you use, and where necessary for the legal obligations described above.

For users and visitors located in the European Economic Area, the United Kingdom, or other jurisdictions with similar laws, we rely on the following legal bases under Article 6 GDPR:

• Contract performance (Art. 6(1)(b)): processing merchant data necessary to deliver the Service the merchant signed up for.
• Legitimate interests (Art. 6(1)(f)): processing storefront analytics and customer-attached order data on behalf of merchants, where the merchant's interest in understanding their own business is balanced against the customer's privacy. We use pseudonymous identifiers and access restrictions to limit exposure of customer data.
• Consent (Art. 6(1)(a)): for any marketing communications to merchants. Merchants can withdraw consent at any time by emailing privacy@etovi.ai.
• Legal obligation (Art. 6(1)(c)): when required to comply with a court order, law, or regulatory request.

• Encryption in transit. All connections to etovi.ai, the Etovi dashboard, and the Etovi API use TLS 1.2 or higher.
• Encryption at rest. Our primary database (Neon Postgres in AWS Singapore) encrypts all stored data at rest. Authentication tokens for connected platforms are additionally encrypted at the application layer using Fernet symmetric encryption.
• Access controls. Only authorised Etovi personnel have access to production systems.
• Audit logging. Sensitive operations are recorded in an audit log.
• Database connections. Our production database uses public network endpoints. Connections require authentication and are encrypted in transit.
• Incident response. We maintain a documented security incident response policy. In the event of a personal data breach affecting merchant or customer data, we will notify affected merchants and applicable regulators in accordance with GDPR Article 33 (within 72 hours where required) and the Notifiable Data Breaches scheme under the Australian Privacy Act.

We retain personal data only as long as necessary for the purposes described above:

• Active merchant accounts: for the duration of the merchant's use of the Service plus a reasonable period for billing reconciliation and audit (typically up to 12 months after account closure).
• Shopify-uninstall purge: within 30 days of a Shopify shop being uninstalled or a shop/redact request being received, we delete merchant-owned data for that shop, except information we are legally required to retain. Any such retention must be limited to that obligation; our ordinary operational retention periods do not override a valid deletion request.
• Disconnected Meta ad accounts: 90 days after a disconnect in Etovi, or 30 days after Etovi is removed in Facebook's settings, then deleted automatically, with an email to the workspace owner at least 14 days before (see section 2.2).
• Customer redaction: upon receipt of a Shopify customers/redact webhook, we process the request against the customer-linked data we hold, including protected contact fields and matching event copies. Shopify determines delivery timing based on the customer's order history; its delivery delay is separate from our response deadline. Shopify requires completion within 30 days of receipt, subject to legal retention obligations.
• Operational records: our scheduled retention windows are 730 days from creation for operational audit logs and 180 days after the last occurrence for error records. These records can contain identifiers and are subject to access controls.
• Tracking and customer events: raw touchpoints and customer-event records have a scheduled retention window of 730 days from the event. This window does not apply to raw Shopify delivery payloads, which are a separate processing record, or to derived journeys and aggregates.
• Privacy administration: deletion-register and compliance entries are retained beyond the operational windows to record privacy requests and prevent erased information from being reintroduced. Derived journeys and aggregates currently have no scheduled expiry. Privacy deletion requests apply separately to retained personal data; aggregation does not by itself establish anonymity.
• Recovery history and database copies: our primary database keeps seven days of change history for point-in-time recovery. Separate database copies can remain outside this window. The recovery window does not determine when every copy of personal data is deleted.

On etovi.ai (our marketing site) we use only essential cookies — for example, to remember whether you have dismissed a banner. We do not use advertising cookies, third-party tracking pixels, or behavioural analytics on the marketing site.

Inside the Etovi dashboard we use essential session cookies for authentication. Our error tracking provider (Sentry) may set cookies for session identification but is configured to omit personal information from collected error events.

On a merchant's storefront, if the merchant has installed the Etovi pixel, we set a first-party cookie on the merchant's domain to identify a returning visitor across their journey. We also use the browser's sessionStorage for a per-tab session ID. These are first-party identifiers used for attribution, subject to the storefront's consent settings. Although the identifiers are randomly generated, they can be linked to store activity and orders; we treat them as pseudonymous data rather than anonymous information.

The following providers support our service and its available features. The data each receives depends on the feature enabled and the content needed to perform it. Where a provider processes personal data on our behalf, its applicable data-processing terms govern that processing. Platforms you connect can also process information under their own account terms and privacy policies.

Processing locations can vary with the selected model, service and provider infrastructure. Provider disclosures include the Fal subprocessor list, DataForSEO provider information and OpenAI subprocessor list. A provider's registered office does not establish where every request is processed. We do not represent these features as processing data exclusively in Australia.

Team call links can open Google Meet or Jitsi Meet in a separate service. If you join a call, that service handles call participation and media under its own privacy policy; it is not an Etovi-hosted video service.

Some of these providers are located outside Australia and the European Economic Area. For transfers from the EEA / UK, we rely on Standard Contractual Clauses (where applicable) and on the sub-processor's own data-protection certifications. For transfers under the Australian Privacy Act, we take reasonable steps to ensure each overseas recipient does not breach the Australian Privacy Principles in relation to the data.

Subject to applicable law, you have the right to:

• Access the personal data we hold about you
• Correct inaccurate or incomplete personal data
• Delete your personal data (subject to legal retention requirements)
• Object to or restrict certain processing, including direct marketing
• Data portability — receive a copy of your data in a structured, commonly used format
• Withdraw consent where we rely on consent as the legal basis
• Lodge a complaint with your local data protection authority (in Australia: the Office of the Australian Information Commissioner, oaic.gov.au; in the EU: your national supervisory authority; in the UK: the Information Commissioner's Office, ico.org.uk)

If you are a customer of an Etovi merchant (i.e. you bought something from a Shopify store that uses Etovi) and wish to exercise these rights with respect to your personal data held by us as a processor, the most direct route is via the merchant. The merchant can use Shopify's built-in customer data request and customer redaction tools, which we receive as webhooks and process within the deadlines set by Shopify and by applicable law. You can also email us directly at privacy@etovi.ai and we will route the request to the appropriate merchant.

If you are an Etovi merchant, you can use the available account settings and export controls in your dashboard. To request account deletion or exercise a right that is not available there, email privacy@etovi.ai.

The Service is intended for business users. We do not knowingly collect personal data directly from anyone under the age of 16. If you believe we have collected personal data from a child, please contact us at privacy@etovi.ai and we will delete it.

For privacy questions, requests, or complaints:

• Legal entity: Etovi Pty Ltd
• Australian Company Number (ACN): 697 881 940
• Australian Business Number (ABN): 56 697 881 940
• Email: privacy@etovi.ai
• Support: support@etovi.ai

We aim to respond to privacy requests within 30 days. Where the request is complex or we receive a high volume of requests, we may extend this period by a further 60 days and will notify you of the extension.

We may update this policy from time to time. When we make material changes (for example, a new sub-processor or a significant change in how we use personal data), we will:

• Update the "Effective date" at the top of this page
• Notify merchants by email and via a banner inside the dashboard
• Where required by law, obtain fresh consent before applying the changes to existing data

For non-material changes (typo fixes, formatting, clarifying language) we will simply update this page.