Privacy Policy — retailadvantage.ai

Last updated: 13 May 2026 Effective date: 13 May 2026

1. Who we are (Controller)

This Privacy Policy describes how Orange IT Services SA ("Orange IT", "we", "us", "our") processes personal data when you use the SaaS platform available at https://www.retailadvantage.ai (the "Platform" or "Service").

For users in the EU/EEA, Orange IT acts as the controller for personal data processed about its account-holders, website visitors, and usage of the Platform. Where Orange IT processes personal data on behalf of a Customer (e.g., contacts contained in the Customer's Google Ads, Meta Ads, Shopify, Google Analytics or TikTok Ads accounts), Orange IT acts as a processor under Art. 28 GDPR and Art. 9 FADP, and a separate Data Processing Addendum (DPA) governs that processing.

2. Scope

This Policy applies to:

• The marketing website at retailadvantage.ai;
• The authenticated Platform (web app and APIs);
• Sales, support, and billing communications with prospects and Customers.

It does not apply to third-party websites or services we integrate with (Google, Meta, Shopify, TikTok, etc.) — their own privacy policies apply when you authenticate with them.

3. What personal data we process

We process the following categories of personal data:

3.1 Account & identification data

• Name, business email, password hash, company, role/title.
• Billing address, VAT number, payment method tokens (we do not store full card numbers).

Example: when Anna from "Acme Shoes Srl" signs up, we store anna@acmeshoes.it, "Anna Rossi", "Head of Performance", "Acme Shoes Srl", VAT IT12345678901.

3.2 Connected-platform data (via OAuth / API tokens)

When you connect your advertising or e-commerce account, we receive and process data from:

• Google Ads — campaign structure, ad creatives, keywords, bidding, conversion and performance metrics.
• Meta Ads (Facebook/Instagram) — campaigns, ad sets, catalogue product identifiers, performance metrics. No audience data and no person-level data — see Section 7.2.1 for the exact list.
• TikTok Ads — campaign and performance metrics.
• Shopify — product catalogue, orders, SKU-level sales, customer counts (aggregated where possible).
• Google Analytics — traffic, conversions, session metrics.

This data may incidentally contain personal data of end-customers of the Customer (e.g., aggregated audience cohorts, conversion events tied to hashed identifiers). For such data, Orange IT acts as processor.

Example: if you connect Shopify, we read the last 24 months of orders to detect bestsellers and seasonality — order records may contain pseudonymous customer IDs or emails, which we treat as personal data of the Customer's end-customers.

3.3 Usage and technical data

• IP address, user-agent, device and browser characteristics, log timestamps, pages viewed, features used, credits consumed, errors.

3.4 Communications data

• Support tickets, emails sent to support@retailadvantage.ai, in-app chat messages.

3.5 Cookies and similar technologies

See Section 11 below.

4. Purposes and legal bases

We do not use Customer Connected-Platform Data (3.2) to train general-purpose AI models. AI processing is performed per-Customer for the Customer's own optimization.

5. AI processing — what to know

The Platform uses third-party large-language and machine-learning models (see Section 8) to:

1. Analyse Connected-Platform Data;
2. Generate optimized product feeds, audience suggestions, bid adjustments, ad copy and campaign recommendations.

Key points:

• Inputs to the AI providers are scoped to the data necessary for the task and are sent without account credentials.
• We have agreements with our AI subprocessors prohibiting them from using Customer data to train their foundational models. Where a provider's standard terms do not give this protection, the integration is configured to disable training (e.g., zero-data-retention or no-training settings).
• AI outputs are suggestions, not deterministic guarantees. The Customer is responsible for reviewing and approving any changes before they are applied to its ad accounts.
• Aggregated, irreversibly de-identified usage statistics may be used to improve the Service. Google user data is never used for this purpose (see Section 7.1).

6. Where we store and process data

Primary hosting:

• Switzerland — application and database infrastructure on NetCup (Swiss region).
• European Union — backup and large-scale compute on AWS (Frankfurt, eu-central-1).

Sub-processors providing AI capabilities (OpenAI, Anthropic) process limited prompt data in the United States.

7. Third-party platform policies and "Limited Use" commitments

Because the Platform integrates with major advertising and e-commerce APIs, we make the following commitments on top of GDPR/FADP obligations:

7.1 Google user data — Google API Services User Data Policy

Where the Customer connects a Google service (Google Ads, Google Analytics, or any other Google API), our use of Google user data complies with the Google API Services User Data Policy, including the Limited Use requirements. Specifically:

• We access Google user data only with the Customer's explicit OAuth consent and only to the scopes required for the Platform's documented features (campaign analysis, AI-generated optimizations, performance reporting).
• We do not sell Google user data.
• We do not transfer Google user data except to sub-processors (Section 8) that are strictly necessary to provide or improve user-facing features, and only after due diligence and contractual protections.
• We do not use Google user data for advertising, retargeting, or to train, fine-tune, or evaluate generalized or third-party AI/ML models.
• Humans access Google user data only (a) with the Customer's explicit consent for a specific support case, (b) for security investigations, (c) when required by law, or (d) on data that has been irreversibly aggregated and anonymised for performance monitoring.
• The Customer (or any Authorised User) may revoke our access at any time via the Google Account permissions page; on revocation, the associated Google user data is deleted from our active systems within 30 days, except where retention is required by law.

7.2 Meta platform data

For data obtained via the Meta (Facebook/Instagram) Marketing API, we comply with the Meta Platform Terms and Developer Policies. We do not use Meta data to build profiles unrelated to the Customer's own advertising, do not transfer Meta data outside the Service, and respect Meta's retention and deletion requirements.

7.2.1 Meta data and deletion requests

This is the section the Retail Advantage Meta app points to as its Data Deletion Instructions. It sets out exactly what we read from a connected Meta business, how we store it, and how to have it deleted.

What we read from Meta

Once a business grants access through Facebook Login for Business, we read, for each ad account it connects:

• Daily campaign and ad-set performance — spend, impressions, clicks, link clicks, purchases and purchase value, one row per ad set per day.
• Hourly spend — spend per campaign per hour for the current day, and the same for the previous seven days, in the ad account's own timezone. This is what the intraday pacing charts draw.
• Per-product performance for catalogue ads — spend, impressions, clicks and link clicks broken down by catalogue product id, one row per product per day. Meta returns no conversion or revenue figures at this breakdown and we request none.
• Catalogue item identifiers — for a sample of up to 200 items of the connected catalogue, the Meta item id and the merchant's own retailer id. Read so we can check that Meta's product ids line up with the store's own product ids.
• Ad account and business settings — the ad account's numeric id, name, currency, timezone and status; campaign and ad-set names, statuses, budgets and ROAS targets; and the id and name of the business portfolio that granted access.

What we do not read from Meta

We request no audience data (no Custom Audiences, no Lookalikes, no audience membership), no Page, Instagram, messaging, lead or Commerce order data, and no person-level data of any kind. Nothing in the list above identifies an individual: the smallest unit in every record we keep is a product, an ad set or a campaign. Meta data is used only for reporting and optimisation inside the connecting Customer's own workspace; it is never sold, and it is never transferred outside the sub-processors listed in Section 8. Aggregated Meta figures may be passed to the AI sub-processors in Section 8 when a Customer asks for an analysis — they contain no personal data, and the commitments in Section 5 apply to them.

Where a Customer has additionally granted management access, an owner in that workspace can change a campaign budget or ROAS target from within Retail Advantage. Those are instructions we send to Meta, not data we collect.

How it is stored

• The access token. Facebook Login for Business issues one Business Integration System User access token per connection. It is encrypted before it is written — a per-secret AES-256-GCM data key, itself wrapped with a key derived per workspace — and kept only in the connection record of our PostgreSQL database. It is decrypted in memory when a scheduled job or a page needs it, and it never leaves our infrastructure.
• The figures. The daily and hourly rows above are stored in dedicated tables of the same PostgreSQL database, each row scoped by database row-level security to the workspace and the store it belongs to.
• The raw archive. A gzipped copy of each day's rows, as Meta returned them, is written to our EU object storage (AWS — Section 6) under that store's prefix. Nothing in the Service reads it back; it exists so a reporting discrepancy can be investigated without re-querying Meta.

Hosting and international transfers are as described in Sections 6 and 9.

How long we keep it

The access token lives exactly as long as the connection: deleting the connection deletes the token. The performance figures are aggregate reporting history with no personal data in them:

• The hourly spend rows are kept for ten days and then deleted automatically — a daily job drops everything older than that window.
• The daily campaign, ad-set and per-product rows are kept until the store or the workspace they belong to is deleted, or until you ask us to remove them.

How to request deletion

An owner of the workspace can do the first two of these directly in the app, and both take effect immediately:

1. Delete the Meta connection — open Connections in the workspace and choose Delete connection on the Meta card. This permanently deletes the stored access token and unbinds every store that was bound to that business; the Meta screens disappear from those stores.
2. Delete a store — open the store's Settings tab and choose Delete store. This deletes every Meta record held for that store: the daily campaign and ad-set rows, the per-product rows, the hourly spend rows and the ad-account binding.
3. Delete the workspace — email us at the address below. Deleting a workspace deletes every store in it, and with them all Meta data.

You can also remove Retail Advantage from the connected apps in your own Meta business settings at any time. Our access stops immediately, but the stored token is erased only when the connection is deleted here or when you ask us to delete it.

To have Meta data deleted by us, or to have a deletion confirmed, email support@retailadvantage.ai with the subject "Request Data Deletion" and the Meta business id or ad account id concerned. We delete the data — including the raw archives described above — from active systems within 30 days and confirm by email. Backups age out on their own schedule (Section 13), and we do not restore deleted data from them.

7.3 TikTok platform data

For data obtained via the TikTok Marketing API, we comply with the TikTok for Business Commercial Terms of Service and Developer Terms. We use the data only for the Customer's campaign analysis and optimization purposes.

7.4 Shopify data

For data obtained via Shopify, we comply with the Shopify Partner Program Agreement and the Shopify API Terms of Use. We process order, product, and customer-cohort data solely to provide the Service to the Customer.

8. Sub-processors

We engage the following sub-processors. An up-to-date list is available on request from support@retailadvantage.ai.

We notify Customers of new or replacement sub-processors at least 30 days before they are engaged (via email or in-app notice), giving Customers the opportunity to object.

9. International transfers

Where personal data is transferred outside Switzerland or the EU/EEA — in particular to the United States for AI inference — we rely on:

• EU Standard Contractual Clauses (SCCs) Module 2 or 3 as applicable, supplemented for Switzerland by the Swiss FDPIC recognition of the SCCs;
• The EU-US Data Privacy Framework and Swiss-US Data Privacy Framework where the recipient is self-certified;
• Supplementary technical and organisational measures (encryption in transit and at rest, access controls, minimisation).

You may request a copy of the relevant transfer mechanism by writing to support@retailadvantage.ai.

10. Retention

After the relevant period, data is deleted or irreversibly anonymised, except where retention is required by law.

11. Cookies and similar technologies

We use:

• Strictly necessary cookies — for authentication, session security, and load-balancing. No consent required.
• Functional cookies — for remembering UI preferences (language, dashboard layout).
• Analytics cookies — to understand usage patterns via a privacy-friendly web-analytics tool. The current list of analytics providers is disclosed in the cookie banner.
• Marketing cookies — on the public website, to measure campaign performance. Only set after consent.

You can manage your preferences at any time via the cookie banner on the website or your browser settings. Withdrawing consent does not affect the lawfulness of processing carried out before withdrawal.

12. Your rights and how to exercise them

Depending on where you live, you have the following rights regarding your personal data:

Under the Swiss FADP and EU/UK GDPR

• Access — obtain confirmation that we process your data and a copy of it.
• Rectification — have inaccurate data corrected.
• Erasure ("right to be forgotten") — have your data deleted where conditions are met.
• Restriction — limit how we process your data.
• Portability — receive your data in a structured, machine-readable format.
• Objection — object to processing based on legitimate interests or direct marketing.
• Withdraw consent — at any time, without affecting prior lawful processing.
• Complaint to a supervisory authority — Swiss FDPIC (https://www.edoeb.admin.ch), or your local EU/UK data-protection authority.

Under California CCPA/CPRA (residents of California)

• Right to know, delete, correct, opt out of "sale"/"sharing" of personal information, limit use of sensitive personal information, and non-discrimination.
• We do not "sell" personal information for money. We do not knowingly process the personal information of minors under 16.
• To exercise rights, email support@retailadvantage.ai.

How to exercise your rights

Email support@retailadvantage.ai with subject line "Privacy request — [right]" (e.g., "Privacy request — Erasure"). We will respond within 30 days (extendable by 60 days for complex requests) and may need to verify your identity.

If you are an end-customer of one of our Customers (e.g., you bought from a Shopify store using our Platform), please contact that Customer directly — they are the controller of your data. We will assist them as their processor.

Data deletion — shortcut

To request deletion of all your personal data held by Orange IT as controller, email support@retailadvantage.ai with subject line "Request Data Deletion". We will delete data from active systems within 30 days, except for records we are legally required to retain (e.g., tax invoices). If you connected a Google account and then revoke our OAuth access via your Google Account Permissions, the associated Google user data is removed from active systems automatically.

13. Security

We implement appropriate technical and organisational measures, including:

• Encryption in transit (TLS 1.2+) and at rest (AES-256);
• Role-based access control and least-privilege for staff;
• Multi-factor authentication for admin access;
• Regular backups, with backups encrypted and stored separately;
• Logging and monitoring of access to production systems;
• Vendor risk assessments and contractual data-protection clauses (DPAs/SCCs) with all sub-processors;
• Annual review of security policies and incident-response plan.

No system is perfectly secure. We will notify the FDPIC, competent EU supervisory authorities, and/or affected individuals of personal-data breaches in line with applicable law (e.g., 72 hours for GDPR breach notifications where required).

14. Children

The Platform is a B2B service intended for businesses and their authorised users. It is not directed to individuals under 16, and we do not knowingly collect their personal data. If you believe a minor has provided us with personal data, please contact support@retailadvantage.ai and we will delete it.

15. Automated decision-making

The Platform makes algorithmic recommendations (e.g., bid adjustments, audience suggestions, feed enrichments). These recommendations are suggestions only and require Customer review/approval before they are applied. The Platform does not make decisions producing legal or similarly significant effects on individuals solely by automated means within the meaning of Art. 22 GDPR / Art. 21 FADP.

16. Changes to this Policy

We may update this Policy from time to time. The "Last updated" date at the top reflects the most recent version. Material changes will be notified by email to Customer admins and/or by an in-app notice at least 30 days before they take effect.

17. Contact

Questions, requests, or complaints:

Orange IT Services SA Corso San Gottardo 34 6830 Chiasso, Switzerland UID: CHE-274.020.172 Email: support@retailadvantage.ai

Swiss supervisory authority: Federal Data Protection and Information Commissioner (FDPIC) — https://www.edoeb.admin.ch