Privacy Policy
Effective date: 2026-09-01 Last updated: 2026-10-18
This Privacy Policy explains how Stellad collects, uses, shares, and protects personal data when you install and use the Stellad app on your Shopify store. It is written to comply with the EU General Data Protection Regulation (GDPR), the French Loi Informatique et Libertés, and the Loi pour la Confiance dans l'Économie Numérique (LCEN).
If you are a shopper buying from a Shopify store that uses Stellad, please read Section 4, Shoppers (end customers of Stellad merchants), which describes the very limited and indirect way your data is involved.
What we receive from Meta (Facebook and Instagram), why, and for how long is set out in Section 3.5, Data we receive from Meta.
1. Who we are
Stellad is operated by:
- Achille Antoine DECOUTTERE, entrepreneur individuel (French sole trader)
- SIREN: 984 586 693
- SIRET: 984 586 693 00017
- Registered address: 941 Route de Lady Les Granges, 74120 Megève, France
- VAT: Franchise en base de TVA (no VAT charged)
Throughout this policy, "Stellad", "we", "us", and "our" refer to this entity.
Data Protection contact: privacy@stellad.app
The role of Data Protection Officer is performed directly by Achille Antoine DECOUTTERE. Under GDPR Article 37, no separate DPO designation is mandatory for our processing activities at this scale. You can reach the DPO at privacy@stellad.app.
2. What Stellad does (so you understand what we process)
Stellad is a Shopify app that creates and manages Meta (Facebook and Instagram) advertising campaigns automatically for Shopify merchants. To do this, we:
- read your Shopify store data (products, customers, orders, reviews, theme, content)
- store order-level records of your sales, without any customer identifier, so we can measure which campaigns actually produced revenue
- generate ad creatives (text, images, videos) using AI, which may quote your published customer reviews verbatim
- identify target audiences
- read the list of Facebook Pages you administer, so you can choose which one your ads run from. Every Meta ad must be attributed to a Page, so this choice is required before any ad can be created.
- read the profile fields of the Page you selected (see Section 3.5), so we can check the Page is ready to run ads. We never post to or edit your Facebook Page: we publish no posts, and we change no Page content.
- if you have no Meta ad account yet, create a Business portfolio and an ad account in your name, named after your store, so you can advertise
- launch and optimize campaigns through the Meta Marketing API, including automated actions we take on your behalf without asking you first (pausing an ad that is spending with no sales, adjusting budgets)
- where you ask us to, take protective action on Meta campaigns you created outside Stellad: pause them, or step a budget down. We never raise a budget on a campaign we did not create.
- use the Meta pixel on your ad account (or create one if the account has none), and install it on your storefront on your behalf as a web pixel, which sends shopper browsing and checkout events to Meta from the shopper's browser
- forward purchase and checkout events to Meta via the Conversions API (CAPI), with email, phone, name, and customer ID hashed via SHA-256 before transmission, and IP address, user-agent, and the Meta click identifier (
fbc, when present on the order) forwarded in plaintext per Meta's CAPI specification - upload hashed customer email lists to Meta to build Custom Audiences
We process two kinds of personal data:
- Merchant data: about you, the Shopify store owner. This is the main subject of this policy.
- Shopper data: about people who shop at your store. We process this on your behalf as a data processor / sub-processor; see Section 4.
3. Merchants (Shopify store owners)
3.1 Personal data we collect
When you install Stellad and connect your accounts, we collect:
| Category | Examples | Source |
|---|---|---|
| Account identity | First name, last name, email address, company name, job title, phone | You, during onboarding |
| Authentication | Supabase user ID, OAuth tokens for Shopify and Meta (encrypted at rest with AES-256-GCM), and the Meta token's expiry date | Shopify, Meta, Supabase |
| Shop information | Shop domain, shop name, shop owner name and email, shop phone, shop address, shop currency | Shopify API |
| Catalog and content | Product titles, descriptions, prices, images, inventory, blog posts, pages, theme metadata | Shopify API |
| Aggregated customer / order data | Counts, averages, top cities, states and countries (from customer and shipping addresses), an estimated gender split (from customers' first names), repeat rate, cohort buckets, payment gateway distribution. No individual customer rows are stored. See Section 4. | Computed in memory from Shopify API |
| Order-level sales records | One row per order: amount, currency, refunds, financial status, order date, Shopify order ID, and the ad-click keys found on the order (landing page URL, order note attributes, Meta campaign / ad set / ad IDs). No email, name, phone, address, or Shopify customer ID is stored on these rows. The landing page URL and note attributes can contain a Meta click identifier, which is a pseudonymous online identifier: see Section 4.4. | Shopify API and orders/create webhook |
| Published customer reviews | Review text and rating as published on your storefront, read from your reviews app's product metafields, used to understand your buyers and to quote in ad copy | Shopify API |
| Facebook Page data | The list of Pages you can advertise from (ID, name, category, profile picture, linked Instagram account) so you can pick one, and the selected Page's profile fields listed in Section 3.5, read so we can check the Page is ready to run ads. Only the selected Page's ID and its linked Instagram account ID are stored. We never post to or edit your Facebook Page. We read no post content, comments, messages, or follower data; the only post information we read is the date of the Page's most recent post. | Meta API |
| Campaign and performance data | Meta campaign IDs, ad creatives we generated for you, performance metrics (spend, ROAS, CTR), brand DNA we synthesized about your store | Stellad-generated, Meta API |
| Facebook User ID | The numeric identifier Meta assigns to your Facebook account (your Facebook (Meta) user ID), stored with your Meta connection to link it to your Stellad account. When you remove Stellad from your Facebook account, or ask Meta to have your data deleted, Meta sends us this ID and we delete that Meta connection (its access token and the ad account, Page, Instagram and Pixel IDs stored with it). We then keep a deletion confirmation record holding only this ID, a confirmation code and the date, so you or Meta can check that the deletion ran | Meta API |
| Ad account ID | The identifier of the Meta ad account you connect (ad_account_id), stored so Stellad can run and read ads on your behalf | Meta API |
| Campaign names and metadata | The titles, objectives, and status of the Meta campaigns Stellad creates on your account, stored so you can review and manage them in your dashboard | Stellad-generated, Meta API |
| Business portfolio | The names and identifiers of your Meta Business portfolios, read to find your Pages and ad accounts and to show you which portfolio your ads run in. Not stored. | Meta API |
| Instagram actor ID and Meta Pixel ID | The identifiers of the Instagram account tied to your Page and the Meta Pixel on your Shopify store, stored so Stellad can place ads on Instagram and attribute conversions | Meta API |
| Billing and subscription | Subscription plan (Principal / Scale), Shopify subscription state, billing history | Shopify Billing API |
| Communications | Emails you send us, in-app feedback, alert preferences | You |
| Technical | Browser type, IP address, log entries, error events | Your browser; Sentry |
In addition to the Shopify API, when Stellad builds the brand understanding it uses to generate your ads, it fetches your store's public storefront pages: the homepage, a small number of pages linked from it (such as about, story, shop or product pages), and your about or story page. This happens the first time ads are generated for your store, and again at the next generation after your store data changes. Only publicly accessible pages are read, without logging in, and no customer data is collected from them.
3.2 Why we process it (legal bases under GDPR Art. 6)
| Purpose | Legal basis |
|---|---|
| Provide the service you signed up for (running ads, generating creatives, billing) | Contract, Art. 6(1)(b) |
| Comply with French and EU law (tax, accounting, GDPR webhooks, Shopify obligations) | Legal obligation, Art. 6(1)(c) |
| Send service emails (incidents, billing, account, security) | Contract / legitimate interest, Art. 6(1)(b) and (f) |
| Send product updates and tips | Consent, Art. 6(1)(a). You can opt out at any time |
| Detect fraud, abuse, security incidents | Legitimate interest, Art. 6(1)(f) |
| Improve Stellad (aggregate analytics; we do not train AI models on your data) | Legitimate interest, Art. 6(1)(f) |
3.3 How long we keep merchant data
| Data | Retention |
|---|---|
| Active account data (while you have Stellad installed) | Kept for the duration of the contract |
| Order-level sales records | Kept for the duration of the contract; deleted with everything else on uninstall / shop redaction |
| All merchant data after uninstall / shop redaction | Deleted when Shopify's shop/redact webhook arrives, which Shopify sends 48 hours after uninstall, through the erasure described in Section 7 |
| Backups | Per Supabase's automated backup retention; deleted on the rolling backup schedule (typically up to 30 days) |
| Billing records required by French tax law | Retained up to 10 years (Code de commerce L123-22). Minimal data only (invoice, amount, date, identity) |
| Sentry error logs | 30 days default retention |
| Meta connection (access token, Facebook user ID, ad account, Page, Instagram, and pixel IDs) | Until you disconnect Meta, remove Stellad in Facebook, delete your account, or uninstall (see Section 7.4) |
| Campaigns and performance data received from Meta | Kept for the duration of the contract; deleted with everything else on account deletion or uninstall |
| Meta deletion confirmation record (Facebook user ID, confirmation code, date) | Kept so you or Meta can check that a deletion ran; it has no automatic expiry |
3.4 Your rights as a merchant
Under GDPR Articles 15–22 and the French Loi Informatique et Libertés, you have the right to:
- Access: get a copy of your data
- Rectify: correct inaccurate data
- Erase: request deletion ("right to be forgotten")
- Restrict: limit how we process your data
- Portability: receive your data in JSON (machine-readable, structured)
- Object: object to processing based on legitimate interest
- Withdraw consent: for any processing based on consent
- Lodge a complaint with the CNIL (the French data-protection authority) at https://www.cnil.fr or with your local supervisory authority
To exercise any right, email privacy@stellad.app. We respond within 30 days (extendable by 60 days for complex requests, per GDPR Art. 12).
You can also trigger account deletion by uninstalling the app from your Shopify admin (which fires the shop/redact webhook and cascades the deletion).
3.5 Data we receive from Meta
When you connect Facebook, Stellad asks Meta for exactly five permissions: ads_management, ads_read, business_management, pages_show_list and pages_read_engagement, plus the basic public_profile that Meta includes with every Facebook Login. We ask for no other permission.
| What | What we read or do | Why | What we keep |
|---|---|---|---|
| Facebook Login | Your Facebook user ID. We do not read your name, email address, or profile picture. | To link the connection to your Stellad account, and to act on a deletion request Meta sends us | Your Facebook user ID, your Meta access token (encrypted with AES-256-GCM), and the token's expiry date |
Pages (pages_show_list, pages_read_engagement) | The Pages you can advertise from: ID, name, category, profile picture, and the Instagram account linked to the Page. For the selected Page: name, category, profile picture, cover photo, About text, website, username, the contact emails listed on the Page, its call-to-action button, and the date of its most recent post | So you can choose the Page your ads run from (every Meta ad must run from a Page), and to check that Page is ready to run ads | The selected Page's ID and the linked Instagram account ID. Names and pictures are shown to you, not stored |
Business portfolios and ad accounts (business_management) | Names and IDs of your Business portfolios; your ad accounts' ID, name, currency, time zone, status, and payment setup. If you have no ad account, we create a Business portfolio and an ad account in your name, named after your store | To find the assets your ads use and show you where your ads run | The ad account ID. Business portfolio names and IDs are not stored |
Running your ads (ads_management) | We create campaigns, ad sets, ad creatives, uploaded images and videos, ads, and audiences in your ad account; we pause, resume, change budgets, and remove what we created; we use your ad account's Meta pixel, or create one if it has none | To launch and manage the ads you set up in Stellad | The IDs, names, status, and budgets of what we create, and a log of every change we make |
Your results (ads_read) | Performance of your campaigns, ad sets and ads (spend, impressions, clicks, click-through rate, cost per click, cost per thousand impressions, frequency, purchases, purchase value); ad delivery status and review issues; ad account status; pixel activity (when it last fired and event counts). If you ask Stellad to manage campaigns you created outside Stellad, we also read those campaigns and their ads (name, text, image) | To show you your results and to decide the automatic actions described in our Terms | Performance figures per campaign and per ad, and the campaigns and ads we read |
We never post to or edit your Facebook Page. We publish nothing on your Page or your Instagram account, and we change no Page content. Your ads name your Page and Instagram account as the identity they run under, as every Meta ad must.
What we use it for. Data we receive from Meta is used only to run your ads and to show you their results, in the dashboard, in alerts, and in summary emails. Performance figures are also combined in aggregate form to tune the thresholds behind Stellad's automatic decisions. We never sell data we receive from Meta.
Who receives it. Only the sub-processors listed in Section 6.1.
How long we keep it. While your Meta connection is active. When you disconnect Meta, we revoke Stellad's permissions at Meta and delete the connection: the access token, and the ad account, Page, Instagram, and pixel IDs stored with it. Your campaigns and their performance history stay in your Stellad account, so you keep your results, until you delete your account (see Section 7). If your Meta token expires or is revoked, we stop using it; it stays encrypted until you reconnect, disconnect, or delete your account.
Meta's terms. We process data received from Meta in line with the Meta Platform Terms and Meta's Developer Policies.
4. Shoppers (end customers of Stellad merchants)
This section is important and is written plainly because the data flow is unusual.
Stellad does not store shopper identity data. No row in our database is keyed on, or contains, a shopper's email, name, phone, address, or Shopify customer ID. We have audited this and re-audit before any change to our Shopify scopes or our Meta integration.
Two things follow that are less absolute than that sentence, and we state them plainly rather than leave them implied:
- We store order-level records. They carry no customer identifier, but they do carry the Meta click identifier attached to the order where one exists. See Section 4.4.
- We store published customer reviews as they appear on the merchant's storefront, our AI reads them, and it may quote them verbatim in an ad. See Section 4.5.
Everything else about shoppers is processed transiently: read in memory, forwarded, discarded. This includes the customer fields used only to build the store-level totals in Section 3.1: first names (to estimate a gender split) and city, state or province, and country (to rank top regions). Only the totals are stored. Throughout, the merchant is the data controller; Stellad is a sub-processor; Meta is a separate processor that the merchant has chosen to use.
4.1 Conversions API (CAPI) event forwarding
When a shopper places an order or starts a checkout on a Shopify store using Stellad, Shopify sends Stellad a webhook. Stellad:
- Verifies the webhook's HMAC signature
- Reads the shopper's email, phone (if present), first name, last name, and Shopify customer ID in memory only
- Hashes each field with SHA-256
- Sends the hashed values to Meta's Conversions API as event data so the merchant's pixel can attribute conversions to the right campaigns
- Discards the in-memory data
No raw or hashed shopper data is written to Stellad's database at any step.
In addition to the SHA-256-hashed identifiers above, each CAPI event includes the shopper's IP address and user-agent string in plaintext, as required by Meta's Conversions API specification for server-side attribution and iOS measurement. These values are read from the Shopify webhook payload, forwarded to Meta in the same network request, and never persisted in Stellad's database. The legal basis for this processing is the merchant's legitimate interest in measuring the performance of their own advertising campaigns (GDPR Art. 6(1)(f)).
Where the order or checkout carries a Meta click identifier (fbc, taken from a _fbc cookie value the store's theme copied into the order's note attributes, or built from the fbclid parameter on the order's landing page URL), Stellad includes it in the CAPI event in plaintext, because Meta requires it unhashed to attribute the conversion to the original ad click. The other identifiers (email, phone, first name, last name, and Shopify customer ID, sent as Meta's external ID) are always SHA-256 hashed before transmission.
Which events and which pixel. Stellad's server sends four events to Meta: Purchase (from the order webhook) and InitiateCheckout (from the checkout webhook), described above, and ViewContent and AddToCart (relayed from the storefront pixel, see Section 4.2), which carry only the IP address and user-agent, with no hashed identifier. Each event also carries the order or cart value, currency, product IDs, and item count. Every event goes to the merchant's own Meta pixel, the one stored with the merchant's Meta connection, and to no other pixel.
Consent. Purchase and InitiateCheckout are sent from Shopify's authenticated webhooks, which carry no shopper consent status, so these two server events are not gated on the storefront consent banner. The legal basis is the merchant's legitimate interest stated above. The browser events of Section 4.2, and the two events relayed from them, fire only with the shopper's marketing consent.
Data already sent to Meta. Conversions API events and Custom Audience entries (Section 4.3) are held by Meta once sent, under Meta's terms, as the merchant's processor. Stellad keeps no copy and cannot recall or delete them from Meta: uninstalling Stellad, deleting your account, or a shopper's redaction request does not remove them. The merchant can delete Stellad's Custom Audiences in Meta Ads Manager, and shoppers can manage their data through Meta's own tools, such as Off-Facebook Activity.
4.2 The storefront web pixel
When a merchant installs Stellad and connects Meta, Stellad installs a Shopify Web Pixel on the merchant's storefront on the merchant's behalf. This is the pixel the merchant would otherwise install by hand; Stellad only automates it.
The pixel runs inside Shopify's sandboxed customer-events worker and sends the merchant's own Meta pixel these events as the shopper browses: PageView, ViewContent, Search, AddToCart, InitiateCheckout, AddPaymentInfo, Purchase. Each event carries the page URL, referrer, product IDs, cart or order value, and currency, and for a Search event the search terms the shopper typed. The request goes from the shopper's browser to Meta directly. Meta may set or read its own cookies on that request under Meta's own terms. Stellad sets no cookie on the storefront.
Consent. The pixel is a marketing technology, and every send is gated on Shopify's Customer Privacy API: nothing fires unless the shopper's marketingAllowed status is true, and the pixel re-evaluates on every consent update. Where the merchant operates a consent banner, that banner governs.
The relay. Two of those events, ViewContent and AddToCart, are additionally POSTed to a Stellad endpoint, which forwards them to Meta server-side under the same event ID so Meta counts the pair once. That request reaches Stellad carrying the shopper's IP address and user-agent. Stellad forwards them to Meta and persists nothing from it beyond an internal counter recording that a send occurred. Purchase and InitiateCheckout never use this relay: they come from the authenticated Shopify webhook described in Section 4.1.
Before the merchant connects Meta, the pixel holds no pixel ID and does nothing. A merchant who does not want it can delete it from their Shopify admin.
4.3 Custom Audience uploads
For each connected merchant, Stellad:
- Pulls up to 2,000 customer email addresses from Shopify, once when Meta is connected and then refreshed weekly. Where Shopify's protected customer data rules close the customer channel, Stellad falls back to reading buyer emails from up to 2,000 recent orders. Shopify gives Stellad only the last 60 days of orders, because Stellad does not request access to older ones.
- Hashes each email with SHA-256 in memory
- Uploads the hashed list to Meta to create or update two Custom Audiences: all purchasers, used to exclude existing customers from cold ads, and top-spending purchasers, used as a lookalike seed
- Stores only the resulting Meta audience ID and a count
- Discards all email data
In addition, when a new order arrives, that buyer's email is hashed in memory, added to the same purchaser audience, and discarded.
The hashed emails are not written to Stellad's database. Counts and audience IDs are not reversible to individual shoppers.
4.4 Order-level records
Stellad stores one row per order so it can tell the merchant which campaign produced which revenue, and so refunds can be netted out of the numbers Meta reports.
What the row holds: Shopify order ID, order date, amount, currency, refunded amount, financial status, cancellation date, the order's landing page URL, the order's note attributes, and the Meta campaign / ad set / ad IDs the order was matched to.
What it does not hold: email, name, phone, address, or Shopify customer ID. Nothing on the row can be looked up by a shopper's identity.
The caveat we want stated: the landing page URL and the note attributes can contain a Meta click identifier (fbclid, or a _fbc cookie value that the store's theme copied there). Under GDPR that is a pseudonymous online identifier. It is stored because it is the only reliable way to attribute a sale to the ad that caused it. It is never used to identify a person, never joined to identity data, and deleted with the rest of the merchant's data. It is also removed from an order row on request: when Shopify's customers/redact webhook names the order, we blank the landing page URL and the note attributes on that row (see Section 7.2).
4.5 Published customer reviews
Where a merchant's reviews app, or Shopify's own review system, publishes review text to the store's product metafields under a standard text key (snippet, review_text, text, body or comment), Stellad reads that text through the Shopify Admin API and stores it alongside the merchant's store data. Stellad does not call any reviews app's own service and does not read review widgets on the storefront. A reviews app that publishes only a widget, a badge or a count to the product metafields is detected by its presence, but no review text is ingested from it.
That review text is sent to Anthropic, our AI sub-processor, to understand who the store's buyers actually are, and a review line may be quoted verbatim in a generated ad. Quoting a real line is the point: an automated check discards any quote that is not an exact substring of a real review.
Reviews are read as published, from the merchant's own product metafields. Stellad does not read reviewer names, email addresses, or any reviewer contact detail, and stores none. Where a shopper's review text itself contains a name or other personal detail, that content is carried as written; a shopper who wants such a review changed or removed should ask the merchant, who controls it in the reviews app.
4.6 What this means for shoppers
If you are a shopper, the merchant, not Stellad, is the data controller for your data. To exercise your GDPR rights against your shopping data:
- Contact the merchant directly. They have access to Shopify and to the Meta tools needed to honor erasure of Custom Audience entries and Off-Facebook activity.
- You may also contact us at privacy@stellad.app and we will forward the request to the merchant. We hold no record keyed on your name, email, phone or address. If you can identify the order to the merchant, they can point us at the corresponding order-level row to delete.
- Shopify provides a built-in shopper-data-request flow that we participate in via the
customers/data_requestandcustomers/redactwebhooks. On a data request we email the merchant the order-level records we hold for the orders Shopify names in the request (Section 4.4), so they can answer you; we hold nothing else about you. On a redaction request we strip the Meta click identifier (the landing page URL and note attributes) from every order row Shopify names in the request; the order's amount, date and status remain as the merchant's accounting record, with nothing on them that can be traced to you.
5. Cookies and similar technologies
On stellad.app and in the Stellad dashboard. Stellad sets only what the service needs to work: session cookies issued by Supabase Auth to keep you signed in, and the cookies Vercel sets to route and secure requests. These are strictly necessary and carry no advertising or analytics purpose. Stellad runs no advertising or analytics tracker of its own on its own site.
On the merchant's storefront. Stellad installs the merchant's Meta web pixel (see Section 4.2). Stellad sets no cookie there. The pixel's requests go to Meta, and Meta may set or read its own cookies on the shopper's browser under Meta's terms. Those sends fire only where the shopper's marketing consent is granted through Shopify's Customer Privacy API. Under the ePrivacy Directive and the CNIL's guidance, obtaining and honouring that consent on the storefront is the merchant's responsibility as the site operator; Stellad's role is to respect the answer, which it does on every event.
6. Sub-processors
Stellad uses the following sub-processors. All EU-bound data transferred outside the EU is covered by Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914) and, where applicable, additional safeguards required by the Schrems II ruling.
| Sub-processor | Role | Region | Data category |
|---|---|---|---|
| Supabase | Database, authentication, file storage | European Union | Merchant data, aggregates, encrypted tokens, and the data we keep from Meta (see Section 3.5) |
| Vercel | Application hosting, edge functions, cron jobs | Global edge; primary compute in EU and US | Merchant data in transit, including every request to and response from Meta; the storefront pixel relay request (shopper IP and user-agent, not persisted) |
| Anthropic | AI models (Claude) for ad copy generation, recommendations, evaluations | US | Merchant brand aggregates, product catalog, and the customer reviews published on the storefront (see Section 4.5); Meta performance figures for the merchant's campaigns and ads, with campaign and ad names; and, for campaigns created outside Stellad that the merchant asks Stellad to manage, the text of those ads. No shopper identity data: no email, name, phone, address, or customer ID. |
| fal-ai | AI image generation for ad creatives | US | Product images, generation prompts |
| Higgsfield | AI video / creative generation | US | Product images, generation prompts |
| Resend | Transactional email delivery | US | Merchant email address, message body (which can include campaign names and performance figures from Meta) |
| Sentry | Error monitoring, observability | EU / US | Stack traces, request metadata, merchant user ID; for errors in Meta calls, Meta ad and campaign IDs and Meta's error message |
| Shopify | Primary data source, OAuth provider, billing | Global | All merchant and shop data we read |
| Stripe | Payment processing for grandfathered subscriptions only; no new subscriptions billed via Stripe | US | Merchant billing data (no shopper PII) |
| Meta (Facebook) | Ad platform, OAuth provider, recipient of hashed shopper PII via CAPI and Custom Audiences | Global | Ad campaign data; hashed shopper PII forwarded on the merchant's behalf |
| Replicate | Image embedding model inference (CLIP) for AI creative diversity scoring | US | AI-generated product image URLs (no merchant or shopper PII) |
Legacy Stripe billing: Stellad bills all new merchant subscriptions exclusively through the Shopify Billing API. A legacy Stripe billing integration is retained solely to service grandfathered subscriptions created prior to Stellad's migration to Shopify Billing; no new subscriptions can be created via Stripe.
We require all sub-processors to provide protections at least equivalent to those we offer you (GDPR Art. 28(4)).
6.1 Who receives data we get from Meta
Data we receive from Meta (Section 3.5) reaches only these sub-processors, for the purposes in the table above: Supabase (storage), Vercel (hosting, every Meta request passes through it), Anthropic (performance figures and ad names, to decide and explain automatic actions), Resend (campaign names and results in the emails we send you), and Sentry (Meta IDs and error messages when a Meta call fails). We do not sell it or pass it to anyone else.
7. Data deletion
7.1 When you uninstall the app
Uninstalling takes effect at once for your connections: Stellad pauses your live Stellad campaigns at Meta, revokes Stellad's permissions on your Facebook account, and deletes your Meta connection, your Shopify connection and the cached product list. It keeps a note on your account of which store was uninstalled, so that the erasure below can still find your data.
Shopify then fires a shop/redact webhook 48 hours after uninstall. On receipt, Stellad runs the same erasure the in-app delete runs: we first clear, by name, the tables that hold per-ad performance rows and forwarded shopper event ids, then we delete the underlying Supabase auth user, which causes every remaining database row referencing that user (across all foreign-keyed tables that reference the merchant account) to be deleted automatically through ON DELETE CASCADE foreign keys. If any part of that erasure fails, Stellad answers the webhook with an error so Shopify re-delivers it, rather than reporting a deletion that did not happen.
This includes:
- merchant profile, preferences, billing records (kept only as required by French tax law in a separate, minimized record)
- Shopify connection, encrypted access token, raw catalog snapshot
- Meta connection, encrypted access token, audience IDs and counts
- all generated creatives, including their stored image and video files, campaigns, recommendations, performance metrics, brand dossiers, stored reviews
- all order-level sales records (Section 4.4)
Backups roll off according to Supabase's retention schedule. Data already sent to Meta stays with Meta (see Section 4.1).
7.2 Shopper redaction
If a shopper requests deletion via the Shopify customers/redact webhook, we hold no record keyed on that shopper, so there is no row to delete. The webhook does name the shopper's orders, and our order-level records (Section 4.4) can carry a Meta click identifier; we blank the landing page URL and the note attributes on each named row at the moment the webhook arrives, leaving only the order's amount, date and status. On a merchant's request naming a specific order we will delete the row outright. Stellad cannot delete what was already sent to Meta (see Section 4.1); the merchant remains responsible for any deletion required at Meta (via Custom Audience and Off-Facebook activity tools).
7.3 Manual deletion
You can delete your account and all of its data yourself, at any time, from inside the app: go to Account → Delete account, type DELETE to confirm, and the same full cascade described in Section 7.1 runs immediately, removing your Shopify and Meta connections, their encrypted access tokens, your campaigns, creatives and their stored files, order records, and your Stellad login itself. Before deleting, Stellad pauses your live Stellad campaigns at Meta and revokes Stellad's permissions on your Facebook account.
You can also request immediate deletion at any time by emailing privacy@stellad.app. We will execute the deletion within 30 days, sooner where feasible.
7.4 Deleting the data we receive from Meta
You can remove Stellad's access to your Meta data in any of these ways:
- Disconnect in Stellad. On the Account page, choose Disconnect Meta. We revoke Stellad's permissions at Meta and delete your Meta connection (access token, and the ad account, Page, Instagram, and pixel IDs stored with it). Your campaigns and their performance history stay in your Stellad account until you delete it.
- Delete your account. Account → Delete account removes everything, including all campaign and performance data received from Meta (Section 7.3).
- Remove Stellad in Facebook. In Facebook, go to Settings → Business Integrations, and remove Stellad. Meta then notifies us, and a data deletion request you make to Meta reaches us the same way. We delete your Meta connection, as in point 1, and return a confirmation code to Meta. You can check that the deletion ran on our status page:
https://www.stellad.app/privacy/deletion-status?code=followed by your code. Your campaigns and their performance history stay in your Stellad account until you delete it; to have those deleted too, delete your account or email us. - Email us at privacy@stellad.app, and we will delete the data you name within 30 days, sooner where feasible.
8. Security
We protect personal data with measures appropriate to the risk, in line with GDPR Art. 32:
- HTTPS everywhere, HTTP Strict Transport Security (HSTS) in production
- AES-256-GCM encryption at rest for sensitive tokens (Shopify and Meta access tokens)
- HMAC verification with constant-time comparison (
timingSafeEqual) on every webhook - Row-Level Security (RLS) enforced on every Supabase table holding merchant data
- Stellad does not store passwords in its own database. Merchant authentication is managed by Supabase Auth using Shopify sign-in and email links. The only password logins are the app-review test accounts we create for Shopify and Meta reviewers; Supabase Auth stores those passwords hashed.
- Principle of least privilege on all sub-processor accounts
- Continuous error monitoring via Sentry with alerting on anomalous patterns
Stellad is not itself SOC 2 certified. Several of our sub-processors are (Supabase, Vercel, Stripe), and we rely on their certifications for their respective parts of the stack.
For security-sensitive disclosures (vulnerabilities, suspected breaches), please email security@stellad.app.
In the event of a personal data breach affecting your data, we will notify you within 72 hours of becoming aware of the breach, in accordance with GDPR Art. 33–34. Where Stellad acts as data controller (for merchant data), we will also notify the CNIL within the same timeframe. Where Stellad acts as data processor on the Merchant's behalf (for shopper data), the Merchant remains responsible for notifying their competent supervisory authority, and Stellad will provide reasonable assistance.
9. International transfers
Some of our sub-processors are based outside the European Economic Area (notably in the United States). For those transfers we rely on:
- the European Commission's Standard Contractual Clauses (SCCs) where applicable
- the EU-US Data Privacy Framework where the sub-processor is certified
- supplementary technical measures (encryption in transit, hashing of shopper PII before any transfer to Meta, encryption at rest)
You can request a copy of the SCCs in force for any sub-processor at privacy@stellad.app.
10. Children
Stellad is a B2B service for Shopify merchants and is not directed at children. We do not knowingly process personal data of anyone under 16. If you believe we hold data about a child, contact privacy@stellad.app and we will delete it.
11. Changes to this policy
We may update this policy. Material changes will be notified by email to your account email and via in-app notification at least 30 days before they take effect. The "Last updated" date at the top is always current.
12. Contact
| Topic | |
|---|---|
| Privacy, GDPR, DSAR | privacy@stellad.app |
| Security disclosures | security@stellad.app |
| Legal notices | legal@stellad.app |
| Support | support@stellad.app |
Postal mail: Achille Antoine DECOUTTERE 941 Route de Lady Les Granges 74120 Megève France
You may also contact the CNIL (Commission Nationale de l'Informatique et des Libertés) at https://www.cnil.fr if you believe your rights have not been respected.