Merchant Data Processing Terms

1. Parties and contact

Esafqa (“we”, “us”) operates OpenAI Ads Feed & Pixel. You are the Shopify merchant who installs the app (“you”).

Questions about these terms or about data processing: mosa.alhelo@gmail.com. A phone number is not published. Do not send Shopify or OpenAI API secrets to this address.

2. What the app does

The app syncs your Shopify catalog, validates feed fields, and hosts an HTTPS CSV product feed that you can paste into OpenAI Ads Manager. You can create Feed Profiles for market, language, and currency where Shopify data supports them.

If you connect an OpenAI Ads API key, the app can configure the measurement Pixel and Conversions API setup it owns, enable browser measurement through a Theme App Embed, and send Product View, Add to Cart, Checkout Started, and Purchase events according to the current implementation.

The app does not run ad campaigns, audiences, bidding, or OpenAI Ads Manager performance analytics for you.

3. Roles (operational description only)

You operate the Shopify store and, if connected, the OpenAI Ads account. You choose whether to enable measurement, whether to turn on the Theme App Embed, and which Ads API key to provide.

Esafqa operates the app and processes the data listed below only to provide the feed, diagnostics, and measurement features you use.

This document does not assign legal labels such as controller, processor, or CCPA “service provider.” Those designations need owner or legal review if you require them in a signed contract.

4. Categories of data processed

Shop and catalog data: Shopify shop domain, shop name, market/locale/currency settings, product and variant fields needed to build the feed (including title, description, handle, URLs, vendor, product type, options, price, compare-at price, inventory/availability, images, SKU, barcode/GTIN when present, status, tags, translations where retrieved, feed configuration, and generation history).

Measurement data: checkout tokens, order IDs, currency, amounts, product variant IDs on those events, related storefront or checkout URLs, OpenAI Ads attribution values (oppref and obref) when present, event timestamps, Pixel diagnostic counts, and Conversions API delivery status. Conversion event payloads may include catalog line-item titles (product names), not customer names.

Credentials and sessions: your OpenAI Ads API key and any Conversions API key the app stores for your shop, encrypted as described below; Shopify Admin session records required to run the embedded app and authorized Admin API calls. If Shopify provides staff account fields on an online session, those fields may be stored on the session record. That is merchant/staff account data, not store customer contact data.

We do not request, collect, or store store-customer name, email, phone, or address. The app does not use those fields for ads matching.

5. Purposes

Product-feed generation, validation diagnostics, and hosting of the HTTPS CSV feed.

OpenAI Ads measurement: Pixel setup, Theme App Embed browser measurement, and Conversions API delivery of the supported events when you connect an Ads account.

Mandatory Shopify privacy webhooks (customers/data_request, customers/redact, shop/redact) and in-app notices so you can see how measurement data is handled.

We do not use this data to sell store-customer information, to profile people for legal or similarly significant automated decisions, or to run advertising campaigns on your behalf.

6. How data is stored and who receives it

The app runs on Railway. Shop, catalog, feed, and measurement records are stored in PostgreSQL provided with that Railway project.

When you connect OpenAI Ads, conversion events are sent over HTTPS to OpenAI Ads using the Pixel and API credentials associated with your Ads account. When you provide the hosted feed URL to OpenAI Ads Manager, OpenAI retrieves the catalog CSV from that URL.

When you connect OpenAI Ads or provide the hosted feed URL to OpenAI Ads Manager, relevant feed or measurement data is transmitted to OpenAI Ads as part of the functionality you enable.

Shopify is the platform you already use. We receive catalog, checkout, order, theme, and privacy-webhook data from Shopify through the Admin API and HMAC-verified webhooks. Shopify is not listed here as an Esafqa subprocessor.

The hosted feed URL is unguessable but publicly reachable with the token. Treat it as a secret. Anyone who has the URL can download the catalog CSV.

7. Merchant responsibilities we actually rely on

Configure Shopify Customer Privacy for the regions that apply to your storefront. Storefront measurement follows those settings: the Web Pixel loads only when its declared analytics, marketing, and sale-of-data purposes are allowed, and an explicit visitor opt-out blocks conversion sends. The app does not invent true consent flags.

Use the app, the hosted feed, and OpenAI Ads only as you are allowed to use them, including advertising and privacy rules in your markets.

Keep Ads API keys, Conversions API keys, and the hosted feed URL confidential. Do not send secrets to support.

8. Retention and deletion

Checkout attribution, Conversions API delivery records, Pixel event rows, and privacy-request logs are deleted 90 days after the retention cutoff used in the app (last update for attribution and delivery rows; created date for Pixel events and privacy-request logs).

When Shopify sends customers/redact, matching order measurement rows are deleted then. When Shopify sends customers/data_request, the app records that the request was handled and can export the measurement fields it stores for the listed orders. Those exports do not include customer name, email, phone, or address because the app does not store them.

Uninstall marks the shop as uninstalled and removes Shopify session records for that shop. It does not immediately wipe catalog or measurement data. Shopify’s later shop/redact webhook deletes the shop and cascaded tenant records after uninstall. If the shop was reinstalled before that redact, shop/redact deletes measurement rows rather than the whole shop.

9. Security

Network traffic for the public app origin and OpenAI Ads Conversions API uses HTTPS/TLS.

Ads API keys, Conversions API keys, checkout attribution payloads, and Conversions API delivery identifiers/errors are encrypted at rest with AES-256-GCM. Checkout token and order ID lookups use HMAC-SHA256 hashes, not plaintext indexes.

Other shop and catalog fields are stored in PostgreSQL without that field-level encryption.

Shopify webhook signatures are verified before those payloads are processed.

This section describes current engineering controls. It is not a SOC 2, ISO, or other security certification.

10. Changes

The effective date and last updated date of these terms is 19 October 2026. If the terms change, this page will show a new date. This document does not promise a separate notice period.

11. What these terms do not include

These terms do not set governing law, venue, liability caps, indemnities, service levels, Standard Contractual Clauses, or other international-transfer clauses. They are not a signed counterpart and have not been reviewed by counsel. If you need those clauses, contact mosa.alhelo@gmail.com; they are not invented here.