Privacy Policy

Last updated: October 8, 2026

What changed on October 2, 2026. Westlorn now reads the performance figures (impressions, clicks, cost, conversions and conversion value) of the campaigns it created on your connected ad platforms, including Google Ads, so it can show them to you next to the ad plan each campaign came from. It still doesn't read your other campaigns. See sections 2, 3, 8 and 10.

1. Introduction

Westlorn is operated by Westlorn LLC ("Westlorn," "we," "our," "us"). This Privacy Policy describes how we collect, use, store, and protect information when you access Westlorn, including the Westlorn Companion+ app for Shopify (the "Service"), whether as a registered user, a Shopify merchant connecting a store, or a visitor to our website. We designed this policy to be transparent and specific. If anything is unclear, contact us at [email protected].

2. Information We Collect

We collect the following types of information:

• Account Information: Username, email address, and encrypted password
• Usage Data: Actions performed, features accessed, credits consumed
• Third-Party Credentials: Encrypted OAuth tokens for connected platforms (such as Google Ads, Microsoft Advertising, Meta, Pinterest, Snapchat, Reddit, LinkedIn, Vibe, and Shopify)
• Product Data: Product information you submit for analysis, including product pages you provide by public URL
• Campaign Data: For campaigns Westlorn created on your connected ad platforms: their IDs, settings, status and each ad's review status, and their performance figures (impressions, clicks, cost, conversions and conversion value). We read this only for campaigns Westlorn created, not for your other campaigns.
• AI Interaction Data: Prompts and responses from AI analysis sessions
• Shopify Merchant Store Data: When you connect a Shopify store to Westlorn, we access and retrieve the following data through Shopify's API with your explicit consent:
  • Product titles, descriptions, and tags
  • Product images and media assets
  • Pricing and variant information (including compare-at prices)
  • Inventory levels and availability metadata
  • Product categorization, vendor details, and collections
  • Store domain and general store configuration

This data is accessed solely to power advertising plans, ad creative generation, campaign deployment, pricing suggestions, competitive analysis, compliance auditing, and reporting features within the Service. Westlorn asks Shopify for two permissions only: to read and to write your products. We do not access customer, order, or financial data from your Shopify store unless a future feature requires it, at which point we will request separate, explicit consent.

3. How We Use Your Information

Your information is used to:

• Provide and improve our advertising and e-commerce services
• Generate AI-powered advertising plans, ad creatives, product analyses, and recommendations
• Create and manage advertising campaigns on connected platforms at your direction
• Show you the status and performance of the campaigns Westlorn created, and compare each one with the ad plan it came from
• Enforce license quotas and credit limits
• Communicate service updates and security alerts
• Generate aggregate analytics for service improvement

4. Data Storage & Security

All data is stored in encrypted PostgreSQL databases hosted on Google Cloud Platform. Platform credentials (OAuth tokens) are encrypted using industry-standard encryption. All data transmission is protected by TLS 1.3 encryption.

5. International Data Transfers

Westlorn is based in the United States. If you access the Service from outside the United States, your information may be transferred to, stored, and processed in the United States or other jurisdictions where our service providers operate.

For users in the European Economic Area (EEA), United Kingdom, or Switzerland, we rely on the following transfer mechanisms as appropriate: the EU-U.S. Data Privacy Framework (and UK and Swiss extensions, where applicable); Standard Contractual Clauses (SCCs) approved by the European Commission; and Data Processing Addendums with each sub-processor that include appropriate safeguards.

Our primary infrastructure is hosted on Google Cloud Platform's US regions, subject to Google's Data Processing Addendum and Standard Contractual Clauses.

6. Third-Party Services & Data Processors

We integrate with the following third-party services:

• Google Analytics: We use Google Analytics to collect anonymized usage data such as pages visited, session duration, and general location. This data helps us improve our Service. Google Analytics may use cookies to track interactions. You can opt out by installing the Google Analytics Opt-out Browser Add-on.
• Google Cloud Platform: Infrastructure and AI services (Gemini). Subject to the Google Cloud Data Processing Addendum.
• OpenAI: AI analysis services (GPT). Subject to the OpenAI Data Processing Addendum.
• Anthropic (Claude): AI analysis, content generation, and optimization services. Subject to Anthropic's Data Processing terms.
• Stripe: Payment processing. Subject to the Stripe Data Processing Agreement.
• Resend: Transactional email delivery. Subject to Resend's Data Processing Addendum.
• Twilio / SendGrid: Transactional email delivery. Subject to Twilio's Data Processing Addendum.
• Microsoft 365: Email infrastructure (SMTP relay). Subject to Microsoft's Data Processing Addendum.
• Cloudflare: DNS management, website hosting, DDoS protection, and CDN services. Subject to Cloudflare's Data Processing Addendum.
• Google Ads, Meta Ads, TikTok Ads, Microsoft Advertising, Pinterest, Snapchat, Reddit, X, LinkedIn: Advertising platform integrations, each subject to their respective data processing terms. For LinkedIn specifically: we access only advertising campaign and performance data belonging to your own LinkedIn ad accounts. We do not export, transfer, or share LinkedIn member data (profile or identity data) with any third party. LinkedIn advertising data is used solely to display reporting back to you as the authorized account owner.
• Meta (Facebook and Instagram): When you connect Meta, we access only the ad account you choose and the Facebook Pages it can promote, to create the campaigns you ask for and to read back the status and performance figures of campaigns Westlorn created. We do not receive or store your Facebook or Instagram profile, friends or messages, and we do not use data from Meta for anything other than showing it to you as the account owner. You can disconnect Meta at any time in Connections; we then delete your Meta access token and the figures and status we read from Meta within 10 days. To ask us to delete anything else we hold from Meta, email [email protected] and we will do so within 30 days.
• Reddit: When you connect Reddit, we access only the ad account you choose, the Reddit profile and Reddit Pixel on it, to create the campaigns you ask for (an image post, a campaign, an ad group and an ad) and to read back the status and performance figures of campaigns Westlorn created. We do not receive or store your Reddit account's posts, messages or browsing, we do not read or build profiles of Reddit users, and we do not use data from Reddit for anything other than showing it to you as the account owner. We do not sell Reddit data or share it with anyone else. You can disconnect Reddit at any time in Connections; we then delete your Reddit access token and the figures and status we read from Reddit within 10 days. To ask us to delete anything else we hold from Reddit, email [email protected] and we will do so within 30 days.
• Vibe (streaming TV advertising): When you connect Vibe, we access only the advertisers (brands) in your own Vibe account, to send Vibe a copy of your video, create the campaign you ask for, and read back the status and performance figures of campaigns Westlorn created (such as impressions, spend, site visits and purchases that Vibe measures). The video copy shows your website address, as Vibe requires. We do not receive Vibe's viewer, household or device data, and we use data from Vibe only to show it to you as the account owner. Vibe is your service provider and handles information about people who see ads under Vibe's Privacy Policy and Terms of Service. You can disconnect Vibe at any time in Connections; we then delete your Vibe access tokens, and the campaign records and figures we already read are kept and deleted as described under Data Retention.
• Shopify: E-commerce platform integration.

Each third-party service has its own privacy policy and data processing agreement. We only share data necessary for the integration to function. We do not sell, rent, or trade your personal information to third parties.

7. Shopify Merchant Data Handling

When you apply a change through the Westlorn Companion+ app, we record the fields written, their previous and new text, the staff member who applied it and when, so that you may restore the previous text. This record is deleted ninety (90) days after the change, or within 30 days of uninstallation, whichever is sooner.

If you approve a request in the Westlorn Companion+ app to link your store to a Westlorn account, that account may view your store's listings, the changes the app has written and the advertising campaigns it runs for your store. You may unlink the store at any time in the app's Settings, after which that account no longer has this access through the link.

When you uninstall the Westlorn Companion+ app from your Shopify admin:

• We immediately cease all API access to your Shopify store.
• Product data retrieved from your store is permanently deleted from our systems within 30 days of uninstallation.
• Anonymized, aggregated benchmark data (which cannot be used to identify your store or products) may be retained for platform-wide analytics.
• Any active subscription is cancelled in accordance with our Terms of Service.

You may also request immediate deletion of your merchant data at any time by contacting [email protected].

8. Google User Data

Westlorn uses Google APIs in two places. This section explains exactly what Google user data we access, how we use, store, and share it, and how you can remove it.

Sign in with Google. If you choose to sign in with Google, we request the openid, email, and profile scopes and receive your name, email address, and profile picture. We use them only to create your Westlorn account, sign you in, and show who is signed in. You can unlink Google in your account settings once you have set a password.

Google Ads. If you connect a Google Ads account, we request the Google Ads scope (https://www.googleapis.com/auth/adwords) and use it only for the following:

• Listing the Google Ads accounts you have access to, with each one's name and status, so you can choose which one to use
• Listing the Merchant Center accounts linked to that Google Ads account and their products, so you can choose which products a Shopping or Performance Max campaign advertises
• Creating the campaigns you approve in that account: Search, Display, Shopping and Performance Max campaigns, with their budgets, ad groups or asset groups, ads, images, keywords, search themes and locations. Campaigns are always created paused, so nothing spends until you turn them on.
• Reading the status of campaigns Westlorn created, including each ad's review status, and pausing or resuming them when you ask
• Reading the performance figures of campaigns Westlorn created (impressions, clicks, cost, conversions and conversion value), so we can show them to you in Westlorn and compare each campaign with the ad plan it came from

We do not read your other campaigns or their performance, your billing information, or your audience data.

Storage. Google OAuth tokens are encrypted at rest in our database on Google Cloud Platform and sent only over TLS. We store the IDs and status of campaigns Westlorn created and their daily performance figures, so we can show them to you.

No sharing, no selling, no AI training. We do not sell Google user data or transfer it to anyone, and we do not use it for advertising, profiling, or credit decisions. We do not send Google user data to AI model providers (Google Gemini, OpenAI, or Anthropic), and we do not use it to train or improve AI models. Ad plans and ad creatives are generated from the product information you provide, not from your Google account or Google Ads account. Comparing a campaign's performance figures with its ad plan is plain arithmetic done by Westlorn, not by an AI model. People at Westlorn do not read Google user data unless you ask us to for support, it is needed for security or abuse investigations, or the law requires it.

Removal. Disconnecting Google Ads in Westlorn deletes the stored Google Ads tokens. Unlinking Google sign-in removes the link to your Google account. Deleting your Westlorn account deletes all of it. You can also revoke Westlorn's access at any time from your Google Account permissions page.

Limited Use. Westlorn's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

8. People Who Review Ads or Proposals Through a Review Link

A Westlorn customer can share ads, or a Proposal made from an advertising plan, with people outside their account through a review link. If you open one, you don't need a Westlorn account. This section explains what we keep about you and why.

• What we keep: the name and email address you enter, the comments you leave and which image they refer to, whether you asked for changes or approved, and when. When you approve, we email you a one-time code; we keep it only in scrambled (hashed) form, for 10 minutes. If the link has a password, your browser session remembers that you entered it.
• Why: to show your comments and approval to the customer who shared the link; to confirm that an approval came from the email address given; to email that customer when you ask for changes or approve; and to keep a dependable record of who approved what and when, for that customer's records, for audits, and to resolve disputes.
• Who sees it: the customer who shared the link. Other people reviewing through the same link see your name and comments, never your email address. We don't use these details for marketing, we don't add you to any mailing list, and we don't sell them. Emails to you about the review are sent through our email provider, listed in section 6.
• Lawful basis: the legitimate interest of the customer and of Westlorn in a reliable review and approval record (see section 9).
• How long: for as long as the ads, or the plan the Proposal belongs to, stay in the customer's account. They are deleted when the customer deletes them or closes their account; copies may remain in our backups for up to about a week after that.
• Your rights: you can ask to access, correct or delete your details as described in sections 12 and 13. Because an approval is part of the customer's own record, we may tell the customer about a deletion request that affects it.

9. Lawful Basis for Processing (GDPR)

We process your personal data under the following lawful bases as defined in GDPR Article 6:

• Contract (Art. 6(1)(b)): Account management, service provision, license enforcement, and payment processing are necessary to fulfil our contract with you.
• Consent (Art. 6(1)(a)): Analytics cookies (Google Analytics) and marketing email communications are processed based on your explicit consent, which you may withdraw at any time.
• Legitimate Interest (Art. 6(1)(f)): Security measures (rate limiting, audit logging, fraud prevention) and service improvement analytics are processed under our legitimate interest in maintaining a secure and functional platform.
• Legitimate Interest (Art. 6(1)(f)), review links: The name, email address, comments and approvals of people who review ads or proposals through a review link are processed for a reliable review and approval record, in the interest of the customer who shared the link and of Westlorn (see section 8).
• Legal Obligation (Art. 6(1)(c)): Tax records, billing data, and regulatory compliance data are retained as required by applicable law.

10. Data Retention

Active account data is retained for the duration of your subscription. Analysis history (advertising plans, market analyses, bid analyses, ad strategies) is retained for 12 months and automatically purged thereafter. Ad creative files you make (images, videos and the files behind them) are kept for a year after their last use; making, changing, downloading or sending them, or using them in a campaign, restarts the year. We email you 30 days before deletion with a link to keep them for another year. The record of the order and its history stay after the files are deleted. Upon account deletion, personal data is removed within 30 days. Campaign performance figures read from your ad platforms are kept while your account is active and deleted within 30 days of account deletion. LinkedIn Marketing Data (advertising campaign data retrieved via the LinkedIn Marketing API) is deleted within 10 days of disconnecting your LinkedIn account or terminating your subscription, whichever occurs first, in accordance with LinkedIn Marketing API program requirements. Meta data (campaign status and performance figures read from your Meta ad account) is deleted within 10 days of disconnecting your Meta account or terminating your subscription, whichever occurs first. Anonymized aggregate data may be retained indefinitely. Billing records are retained for 7 years as required by tax law.

Guest inquiries submitted via our public contact form (no account required) are retained for up to 12 months from the date of submission, solely for the purpose of responding to your inquiry. Guest inquiry data includes your name (if provided), email address, and message content. You may request deletion of your guest inquiry data at any time by contacting [email protected].

11. Data Breach Notification

In the event of a data breach that affects your personal information:

• We will notify affected users via email within 72 hours of becoming aware of the breach, consistent with GDPR Article 33 requirements.
• Where required by applicable law (including CCPA), we will also notify the relevant supervisory or regulatory authorities.
• Notification will include the nature of the breach, the categories of data affected, and the measures taken or proposed to address the breach.

12. Your Rights (GDPR)

Under GDPR, you have the right to:

• Access your personal data (Art. 15)
• Rectification of inaccurate data (Art. 16)
• Erasure of your account and data (Art. 17), available in your account settings
• Data portability: export your data in JSON format (Art. 20), available in your account settings
• Withdraw consent for data processing at any time (Art. 7(3))
• Lodge a complaint with a data protection authority (Art. 77)

To exercise any of these rights, contact us at [email protected] or use the self-service options in your account settings.

13. California Privacy Rights (CCPA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA):

• Right to Know: You may request details about the categories and specific pieces of personal information we have collected about you.
• Right to Delete: You may request deletion of your personal information, subject to certain exceptions.
• Right to Non-Discrimination: We will not discriminate against you for exercising your CCPA rights.
• Do Not Sell: We do not sell your personal information to third parties. We do not share personal information for cross-context behavioral advertising.

To submit a CCPA request, email [email protected] with "CCPA Request" in the subject line. We will verify your identity and respond within 45 days.

14. Cookies

We use essential session cookies for authentication and security. We also use Google Analytics cookies to collect anonymized usage statistics. You may disable cookies in your browser settings or opt out of Google Analytics tracking using the Google Analytics Opt-out Add-on. Disabling essential cookies may affect Service functionality.

When you first visit westlorn.com or use the Westlorn app, you will be presented with a cookie consent banner that allows you to accept or decline non-essential cookies. Essential cookies (required for authentication and security, and a cookie that remembers your choice) cannot be disabled. Analytics cookies (Google Analytics) are only activated after you provide consent. Until then, Google Analytics runs in a mode that sets no cookies and sends Google only limited, cookieless measurement signals. You may change your choice at any time through the cookie settings link on this page or in the website and app footers.

15. Children's Privacy

Our Service is not intended for users under 18 years of age. We do not knowingly collect personal information from children.

16. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. When we make material changes, we will notify you via email at least 14 days before the changes take effect. For Shopify merchants, material changes affecting store data handling will also be communicated through in-app notification. The "Last updated" date at the top of this page indicates when this policy was most recently revised.

17. Contact

For privacy-related questions, contact our Data Protection Officer at [email protected].

Westlorn LLC
7901 4th Street North, Ste 300
St. Petersburg, FL 33702
United States