Privacy Policy

OwnerDash (“OwnerDash”, “we”, “us”) operates the OwnerDash web application at owner-dash-six.vercel.app. For privacy questions or requests, contact mon.yusuf01@gmail.com.

For your account and workspace information, OwnerDashdecides how the data is used. For data that comes from the services you connect, such as your store’s customers and orders, we process it on your behalf and under your instructions so we can show it to you.

Account and workspace.

• Your email address and password. Sign-in is handled by Supabase Auth, and passwords are stored only as salted hashes.
• Your name, if you provide one.
• Business details you enter, such as business name, currency, time zone, cost and margin settings, and report preferences.

Data from services you connect. You choose which services to connect. Each connection uses OAuth, and OwnerDash only reads data. We never create, edit, pause or delete anything in your connected accounts, and we never post on your behalf.

• Shopify:orders, line items, refunds, products, inventory levels and product costs. This includes your customers’ names, email addresses and order history, which we use to show customer and repeat-purchase reports. The access is read-only (for example read_orders, read_products, read_inventory and read_customers).
• Google Ads: the IDs, names, currencies and time zones of the ad accounts you can access, your campaign names and statuses, and daily performance metrics (spend, impressions, clicks, conversions and conversion value). Google provides this access through the adwords scope, and OwnerDash uses it only to read reports.
• Meta (Facebook and Instagram) Ads: the IDs, names, currencies and time zones of your ad accounts, your campaign names and statuses, and daily performance insights (spend, impressions, clicks, purchases and purchase value). This uses the ads_read permission. We do not request access to your profile, friends, Pages, posts or messages.
• Stripe: payouts, fees, charges, refunds and the balance on the account you connect. Stripe requires the Connect scope read_write for this platform. OwnerDash uses that connection only to read. It never creates charges, refunds, payouts or transfers, and it never moves money. Withdrawals and payouts stay in your own Stripe account. We store the connected account id, not a separate secret for that account.

Access tokens. The OAuth tokens that let OwnerDash read these services are encrypted with AES-256-GCM before they are stored. They are only decrypted on our servers to make API requests and are never sent to your browser. When you disconnect a service, we delete its tokens. For Google, we also revoke them with Google. For Stripe, disconnect calls Stripe to deauthorize the connection.

Website analytics. If you add the OwnerDash tracking snippet to your website, it records page views from your visitors without cookies and without storing personal data.

• What we record: the page path (without query strings), hostname, referring domain, UTM source, medium and campaign, an ad-click source label (for example “Google Ads” when a gclid is present), approximate location (country, region and city from our host’s network), device type, browser and operating system.
• Visitor counting: the visitor’s IP address and user agent are combined into a one-way SHA-256 hash. That hash is hashed again with a random salt that changes every day and is deleted within two days, so a visitor can’t be recognized across days or linked back to an IP address. We do not store raw IP addresses or user agents.
• No cookies, local storage identifiers or cross-site tracking are used. Known bots are discarded.
• Site owners can attach small custom event properties. They must not send personal data in them.
• Visitors can opt out by setting ownerdash_ignore to truein their browser’s local storage for that site.

If you install the snippet, you are responsible for telling visitors to your site that you use analytics, as your local law requires.

AI assistant. When you ask the assistant a question, we send your question, up to six recent messages from the conversation, and a summary of your workspace metrics to a large language model through Vercel AI Gateway. The summary covers totals, campaign names, product names and stock levels. It does not include your customers’ names or email addresses. We do not save assistant conversations in our database, and we do not use your data to train AI models.

Technical data.

• Strictly necessary session cookies, set by Supabase Auth to keep you signed in.
• Your light or dark theme preference, stored in your browser.
• Standard server and security logs kept by our hosting provider, which can include IP addresses, request paths and timestamps.

• To provide the service: dashboards, data syncs, alerts, daily reports, website analytics and the AI assistant.
• To keep the service secure, prevent abuse, and fix problems.
• To respond to you and give you support.
• To meet legal obligations.

We do not sell or rent personal information. We do not share it for cross-context behavioral advertising, and we do not use data from connected services for advertising, profiling or building audiences.

OwnerDash’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Specifically:

• We use Google Ads data only to show you your own advertising performance inside OwnerDash, including in the AI assistant you ask.
• We don’t transfer it to others except as needed to provide or improve those user-facing features, to comply with law, for security, or as part of a merger or acquisition with your notice.
• We don’t use it for advertising, including retargeting, personalized or interest-based ads, and we don’t sell it.
• No person at OwnerDash reads it unless you ask us to (for example for support), it is needed for security or to comply with law, or it is aggregated and anonymized for internal operations.
• We don’t use it to develop, improve or train generalized AI or machine-learning models.

You can remove OwnerDash’s access at any time from Integrations in OwnerDash or from your Google Account permissions.

When you connect Meta Ads, OwnerDash receives data from Meta’s Marketing API under the Meta Platform Terms and Developer Policies.

• We use Meta data only to show you the performance of ad accounts you have access to and chose to connect.
• We don’t sell, license or buy Meta platform data. We don’t use it for ad targeting, profiling, surveillance or to decide anyone’s eligibility for anything.
• We don’t share it with anyone except the processors listed below that help us run OwnerDash.
• We delete Meta tokens when you disconnect, and we delete the synced data when you ask us to or delete your account. See Data deletion.

These providers process data for us, only to run OwnerDash:

• Supabase: database and authentication.
• Vercel: application hosting, edge network, logs, and the AI Gateway that routes assistant requests.
• AI model providers through Vercel AI Gateway: they generate assistant answers from the content described above.

Shopify, Google, Meta and Stripe are the sources of data you choose to connect. Their own privacy policies cover how they handle your information. We may also disclose information if the law requires it, to protect the rights and safety of our users or the public, or as part of a merger or sale of the service (we would tell you first).

• Account, workspace and synced data are kept while your account is active.
• Integration tokens are deleted as soon as you disconnect that service. Data synced earlier stays visible until you ask us to delete it.
• Removing a website from OwnerDash deletes all of its analytics events.
• Daily analytics salts are deleted within two days.
• When you delete your account, we delete your workspace data within 30 days. Copies in encrypted backups may last for a short additional period until the backups expire.

Data travels over HTTPS. Tokens are encrypted at rest. Database row-level security keeps each workspace’s data separate, and only owners and admins can connect or disconnect services. No system is perfectly secure. If we learn of a breach that affects your data, we will notify you as the law requires.

Depending on where you live (for example under the GDPR in the EU and UK, or the CCPA in California), you may have the right to access, correct, export or delete your personal information, and to object to or restrict some processing. Email mon.yusuf01@gmail.com from the address on your account. We will verify the request and respond within 30 days. We will not discriminate against you for using these rights.

If you are a customer of a store that uses OwnerDash, please contact that store first. We will help the store owner with your request.

OwnerDashand its providers may process data in the United States and other countries. Where required, we rely on our providers’ standard contractual safeguards for those transfers.

OwnerDash is a business tool and is not intended for anyone under 18. We do not knowingly collect children’s data.

If we change this policy, we will update the date at the top of this page. If the changes are material, we will tell you in the app or by email before they take effect.