Who we are
AI Ads Manager is operated by THAVIQ SOFTWARE VENTURES PVT LTD, India. This policy covers the Shopify app and this website. For privacy questions or requests, email contact@thaviq.com.
Information we process
When you install the app, Shopify provides your shop identity, the permissions you approved and authentication details. Depending on the session type, this can include a staff member's user ID, name, email address, locale and account-role flags.
The app reads your Shopify catalog to check products, variants, images, descriptions, prices, availability, inventory settings and brand information. It does not read Shopify order or customer records through the Admin API.
Shopify app-owned storage holds your preferences, a limited set of catalog findings, feed settings and compact reporting and tracking summaries. Our database holds login sessions, encrypted advertising credentials, short-lived authorization state and minimal operational and duplicate-prevention records. We do not keep a separate copy of your catalog, or store campaign or reporting responses beyond compact summaries.
If you contact support, we receive whatever you choose to send. Please do not send customer information, passwords or API keys. This website has no advertising pixels, analytics trackers or newsletter forms, although our hosting infrastructure processes the technical request information needed to serve and protect it.
Advertising accounts and campaigns
If you connect an OpenAI Ads account, we store your API key encrypted and use it only for actions in the app: reading account details and performance, and creating, editing, publishing or pausing campaigns when you ask. Campaign content you enter, such as ad text, links and images, is sent to OpenAI.
You remain responsible for your advertising account, its charges and its compliance with OpenAI's terms and policies. Disconnecting removes the saved key from our database. It does not change or delete campaigns in your OpenAI account, so pause anything you no longer want running first.
Storefront event tracking
If you turn on tracking, a Shopify web pixel can send selected page view, product view, add to cart, checkout started and purchase events to your connected advertising account, where the customer's consent signals permit it. Selected fields include event identity and time, storefront origin, product variant IDs, quantities, transaction amounts and currency, an order-derived event identity and an optional attribution reference. These can be personal or pseudonymous data even when names are absent. The event payload excludes customer names, email addresses, phone numbers, postal addresses and checkout tokens.
We process event payloads transiently and do not keep a raw event database. To prevent duplicates we keep hashed event identities, delivery status and timestamps for a limited period, and we keep aggregate tracking health summaries. Hashing does not mean these records are anonymous. Merchants must configure Shopify's privacy settings and give their customers any required notices. Withdrawing consent stops future delivery but cannot recall data already sent.
How we use information
We use this information to authenticate merchants, provide the features you use, keep each store's data separate, prevent duplicate events, respond to support and privacy requests, and meet legal obligations. Depending on applicable law, our legal bases include performing our agreement with you, our legitimate interests in security and support, compliance with legal obligations, and consent where required.
We do not sell your data, and we do not use your catalog, campaign or audit data to train AI models.
Service providers and international processing
We use Shopify for platform authentication and app-owned storage, Google Cloud for hosting and operational infrastructure, and Neon for our database. OpenAI receives the data described above when you connect an account. See the Service providers page for details.
We operate from India. The app is hosted in Belgium and our database is located in Ohio, United States, so information may be processed outside your country. Contact us for information about the transfer arrangements that apply. We may also disclose information where the law requires it or where necessary to investigate misuse and protect rights.
Retention and deletion
We keep sessions and credentials while the app is installed. When you uninstall the app, or when Shopify sends a shop-redaction request, we delete that shop's sessions, credentials, authorization state and operational records from our database. This does not delete campaigns, pixels, feeds or data already held in your OpenAI account.
Duplicate-prevention records are valid for eight days and are removed during later processing, so expiry is not a guaranteed deletion deadline. Summaries in app-owned Shopify storage may remain for a period under Shopify's lifecycle rules after you uninstall. Application logs are kept for seven days. Platform audit logs and infrastructure backups follow their own retention schedules, so deletion from those systems may not be immediate. We keep support correspondence as long as needed to resolve the matter or meet legal obligations.
We do not keep a customer event dataset to export for Shopify customer data requests. We authenticate those webhooks and do not retain their contents. A request may still need follow-up with the merchant or a connected advertising platform.
Security
We use HTTPS, Shopify authentication, per-store access checks and limited infrastructure permissions. Advertising API keys are encrypted with AES-256-GCM and are only used on our servers. Our database provider encrypts stored data. No system can promise absolute security.
Your rights
Depending on where you live, you may have rights to access, correct, delete, move, restrict or object to the processing of your personal information. Email contact@thaviq.com with your request and the relevant shop domain. We may need to verify your authority before acting. You can also complain to your local data protection authority.
Storefront customers should normally contact the store first, because the merchant controls that relationship.
Children and changes to this policy
The app is a business tool and is not directed at children. We update this policy when our processing changes, and the date at the top of this page shows the current version. We will tell merchants about material changes through an appropriate channel.