Privacy Policy

Legal

Last updated: September 12, 2026

This Privacy Policy explains how Radius Ads Geofencing (the “App”, “we”, “us” or “our”) processes information when a Shopify merchant connects a Meta advertising account and applies geography defined in Radius Delivery to an existing Meta Ad Set.

1. Scope of this Policy

This Policy applies to information processed through the Radius Ads Geofencing Shopify application, the website at ads.radiusdelivery.app, Meta platform connections and merchant support. Shopify merchants remain responsible for their own privacy notices and for the lawful use of their Shopify and Meta business assets.

2. Information we process

We process only information needed to provide, secure and support the App:

• Shopify store identifiers, authenticated app sessions and Shopify access tokens;
• Radius Delivery geofence identifiers, names, revisions, geographic coordinates and supported radius or exclusion settings;
• Meta user ID, encrypted Meta access token, authorized ad-account IDs and account labels;
• selected Meta Ad Set IDs, names, status and geographic targeting;
• before-and-after geographic snapshots, validation and audit status, timestamps and technical errors;
• information voluntarily supplied in merchant support requests; and
• standard technical request data needed for security and reliable operation, such as timestamps, requested URLs, IP address and browser information.

3. Information we do not use

The App does not use Shopify customer profiles, orders or delivery-address records for Meta advertising. It does not create advertising profiles from customer data, sell Meta Platform data or use connected business data for our own advertising.

4. How and why we use information

We use information to authenticate the merchant; read merchant-owned Radius Delivery geography; list authorized Meta ad accounts and Ad Sets; preview, validate and apply a geography-only update explicitly approved by the merchant; verify the result; preserve a rollback snapshot; keep an audit trail; prevent abuse; maintain security; troubleshoot the service; and respond to valid legal or privacy requests.

5. Shopify and Meta permissions

The App connects to Shopify and Meta through their official APIs. For Meta, the merchant authorization flow requests ads_management so the App can read and update geographic targeting for authorized advertising assets. Access is limited to the connected merchant’s authorized assets and the functions described in this Policy.

Meta access tokens and Shopify credentials are confidential. Meta access tokens are encrypted at rest and are never displayed in the merchant interface or written to application logs.

6. Legal bases under the GDPR

Where the General Data Protection Regulation applies, processing is based on performance of the merchant contract or steps requested by the merchant, our legitimate interests in operating and securing the service, compliance with legal obligations, and consent where consent is required for a particular optional activity.

7. Service providers and disclosures

Shopify and Meta process information under their own terms and privacy policies. Hosting, database, monitoring, email and support providers, including Render infrastructure used to operate the App, may process limited data on our behalf under appropriate contractual and security safeguards. We may disclose information where required by law or necessary to protect the security and integrity of the service.

If personal data is transferred outside the European Economic Area, we use an applicable lawful transfer mechanism, such as an adequacy decision or Standard Contractual Clauses.

8. Retention and deletion

Connection and operational data is retained while the integration is active and as needed for security, support and legal obligations. Disconnecting Meta from the App deletes stored Meta credentials and associated mappings, geographic snapshots and audit records for that Shopify store. Removing the App through Meta triggers the signed deauthorization or data-deletion process. Uninstalling the App from Shopify deletes stored platform connections, and Shopify’s shop-redaction process removes remaining store-scoped session data.

Protected backups may retain limited copies until normal backup rotation. Backup copies are not used for ordinary business purposes.

Detailed instructions are available at ads.radiusdelivery.app/data-deletion/.

9. Security

We use reasonable technical and organizational safeguards, including encryption at rest for Meta tokens, access controls, least-privilege authorization, signed OAuth state, validation of Meta signed requests, controlled production writes, audit records and infrastructure monitoring.

10. Your privacy rights

Depending on applicable law, individuals may request access, correction, deletion, restriction, portability or objection. Where processing relies on consent, consent may be withdrawn without affecting earlier lawful processing. Requests can be sent to hello@radiusdelivery.app.

You may also complain to a competent supervisory authority. In Poland, this is the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych — UODO).

11. Children’s privacy

Radius Ads Geofencing is a business application intended for authorized Shopify merchants and business representatives. It is not directed to children.

12. Changes to this Policy

We may update this Policy when the App, platform requirements or data practices change. The current version and its latest-update date will remain available at ads.radiusdelivery.app/privacy-policy/.

13. Contact

For privacy questions or requests, contact hello@radiusdelivery.app.

14. Google Ads connection and data

For selected Shopify stores in our Google Ads pilot, Google OAuth authorization lets us list accessible advertising accounts, including access through manager accounts, and display campaign identifiers, names, status and advertising channel type for the account selected in the App. Merchants can preview, validate and synchronize delivery areas with selected Google Ads test campaigns, verify geographic criteria and location options, pause automatic updates, and restore saved geography. The current release permits writes only to Google Ads test accounts. It preserves budgets, bidding, ads and campaign status and does not use Shopify customer profiles, orders or delivery addresses.

We store the Shopify store association, account identifiers and labels, the manager account identifier where applicable, encrypted access and refresh tokens, and token expiry. We process delivery-area coordinates, radii, approved countries and regions, geographic criteria and location options. We store campaign mappings, source revisions, geography snapshots and synchronization history until the Google connection or Shopify installation is deleted. Polygons may be approximated by circles; unsupported radius or polygon exclusions are blocked. Google targeting does not guarantee delivery-boundary precision. Short-lived login records link authorization to a Shopify session and browser. They expire after ten minutes; expired records are cleaned up on another login, and pending records are removed on disconnect or uninstall.

We use this information to provide account and campaign views, synchronize approved delivery geography, maintain the authorized connection and protect the service. Tokens are encrypted before database storage and are not displayed in the merchant interface. An expiring token may be refreshed when you request data or an authorized synchronization runs. The running server checks source revisions every minute; Shopify delivery-profile webhooks and the Shopify Flow action also run synchronization. We do not request Gmail, Google Drive or Google Analytics access.

15. Google retention and controls

Google connection credentials and account metadata remain until disconnected or deleted with the Shopify installation. Disconnect Google Ads removes all stored Google connections and pending login attempts for that Shopify store, including associated mappings. Uninstalling the App also removes these records. Local disconnection does not revoke the entire Google authorization grant, which may be used by another connected store. You can separately revoke access in your Google Account. Revocation prevents subsequent API access but does not itself notify this App to delete local records; disconnect in the App or request deletion at hello@radiusdelivery.app. Protected backups may retain copies until normal rotation.

16. Google data use and disclosure

Google data is used for the visible features described here. We do not sell it, send it to Meta or TikTok, build advertising audiences from it, or use it to train generalized AI models. Service providers may process it only as needed to operate those features under applicable safeguards. Human access is limited to user-authorized support, necessary security investigation or legal obligations.

Radius Ads Geofencing’s use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including its Limited Use requirements.