Privacy Policy

Last updated: June 2026

Zone Artificial ("we", "us", "our") provides an AI-assisted advertising operations platform. This Privacy Policy explains what personal data we collect, how we use it, who we share it with, and the rights you have over your data. By using our services you agree to this policy. If you do not agree, please do not use the service.

1. Who we are

Zone Artificial operates the platform available at zoneartificial.com and dashboard.zoneartificial.com. For any privacy-related question or to exercise a data right described below, contact us at info@zoneartificial.com.

2. Information we collect

Account information

Name, business email address, workspace name, role, password (stored hashed), and authentication metadata when you register, accept an invitation, or log in.

Advertising platform data

When you connect Google Ads, Meta Ads, Google Analytics 4, Search Console, Merchant Center, or Shopify, we receive campaign metadata, performance metrics, creative assets, audience definitions, and aggregated revenue figures necessary to operate the service. We do not collect payment-card data from your ad accounts.

Usage data

Device, browser, IP address, pages viewed, features used, and timing data are collected through standard logging to keep the service reliable and secure.

Billing data

Billing identifiers and transaction metadata from our payment processors (Stripe, PayPal, PayTR). We do not store full credit-card numbers on our infrastructure.

3. How we use your information

• Operating, maintaining, and improving the platform.
• Generating AI recommendations, anomaly detections, and reports for your campaigns.
• Authenticating users, enforcing role-based permissions, and protecting against fraud or abuse.
• Sending operational notifications (sync failures, billing events, security alerts).
• Providing customer support and responding to your requests.
• Complying with legal obligations.

4. Legal bases for processing (GDPR)

• Contract: processing necessary to deliver the service to you under our Terms of Service.
• Legitimate interest: securing our platform, preventing abuse, improving features, and producing aggregated analytics.
• Consent: for optional cookies and certain marketing communications you can revoke at any time.
• Legal obligation: tax, accounting, anti-fraud, or other applicable law.

5. Your rights

Under GDPR and similar regulations you have the right to:

• Access the personal data we hold about you.
• Rectify inaccurate or incomplete data.
• Request erasure of your data (subject to legal retention obligations).
• Restrict or object to certain processing.
• Receive a copy of your data in a portable, machine-readable format.
• Withdraw consent at any time without affecting prior lawful processing.
• Lodge a complaint with your local supervisory authority.

To exercise any of these rights, email info@zoneartificial.com. We respond within 30 days.

6. How we share information

We do not sell personal data. We share data only with:

• Sub-processors that host or operate parts of the service (cloud infrastructure, payment processors, email delivery, error monitoring). All sub-processors are bound by data-processing agreements equivalent to those required by GDPR Article 28.
• AI providers (Anthropic, OpenAI, Google) for the narrow purpose of producing the AI features you use. Prompts and contextual data are sent under each provider's terms.
• Advertising platforms you have connected, when you authorize an action (such as updating a campaign).
• Authorities when required by law or to protect rights and safety.

7. International transfers

Some of our sub-processors operate outside the European Economic Area. Where data is transferred internationally, we rely on adequacy decisions or Standard Contractual Clauses (SCCs) approved by the European Commission, supplemented by technical safeguards such as encryption in transit and at rest.

8. Data retention

We keep personal data only as long as needed for the purposes described in this policy, to meet legal obligations, or to defend legal claims. Account data is deleted within 90 days after workspace deletion, subject to billing-record retention required by tax law.

9. Security

OAuth tokens and other credentials are encrypted at rest with AES-256-GCM. Access to production systems is limited to authorized engineers and is logged. We test our security posture regularly and respond to vulnerability reports sent to info@zoneartificial.com.

10. Cookies

We use a small number of cookies essential to authentication and session management. See our Cookie Policy for details.

11. Children

Zone Artificial is a B2B service not intended for children under 16. We do not knowingly collect personal data from children.

12. Changes to this policy

We may update this policy from time to time. Material changes will be communicated by email or via the dashboard at least 14 days before taking effect.

13. Google user data and Limited Use

When you connect a Google account (for example Google Ads, Google Analytics 4, Search Console, or Merchant Center), Zone Artificial requests access through Google's OAuth consent flow and may request the following scopes: adwords, analytics.readonly, webmasters.readonly, content, and userinfo.email. We use this access only to provide the features you have asked for — reading your advertising, analytics, search, and product data to build reports, insights, and recommendations, and creating or managing campaigns, bids, and budgets when you authorize those actions.

Zone Artificial's use and transfer of information received from Google APIs to any other app adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically:

• We use Google user data only to provide and improve the user-facing features described above.
• We do not sell Google user data, and we do not use it for advertising of our own.
• We do not transfer Google user data to third parties except as necessary to provide or improve these features, to comply with applicable law, or as part of a merger or acquisition, in each case with appropriate safeguards.
• We do not allow humans to read Google user data unless we have your affirmative consent for specific messages, it is necessary for security purposes (such as investigating abuse) or to comply with applicable law, the data is aggregated and anonymized for internal operations, or you have shared it with us for support.

OAuth refresh tokens are encrypted at rest, and you can disconnect any Google account at any time from the dashboard, which revokes our access and deletes the stored tokens.

14. Shopify store data

When you install the Zone Artificial app on your Shopify store, we access your store through Shopify's API using only read scopes: products, orders, inventory, analytics, reports, and customer records. We use this data to compute store-level economics (revenue, orders, margins, product performance), to build media plans and product-targeted campaign briefs, and to attribute advertising results to actual store outcomes. Order and revenue figures are stored as aggregates; we do not build marketing profiles of your customers.

• Customer personal data. If you enable the Meta Conversions API feature, customer identifiers from new orders (email, phone, address) are hashed (SHA-256) and sent to Meta solely to measure your own campaigns. Raw identifiers are not stored; transient hashed values held for delivery retries are deleted after delivery or terminal failure.
• Data subject requests. We honor Shopify's mandatory privacy webhooks: customer data requests, customer data erasure, and shop data erasure are processed automatically.
• Uninstall. Uninstalling the app revokes our API access. You can additionally request full deletion of your workspace data at any time (see Section 5), and deleting your account erases all stored store data.
• We do not sell Shopify store data and do not share it across customers.

15. Contact

Questions, requests, or complaints related to this policy: info@zoneartificial.com.