Privacy Notice

1. Scope of this Notice

This Privacy Notice explains how Affirmed Agency Ltd uses personal data when it acts as a controller, including information about website visitors, prospective clients, Client contacts, authorised app users, payers and people who communicate with us.

Where Affirmed processes Client Personal Data only on a Client's documented instructions, the Client determines the purpose of that processing and Affirmed acts as its processor. That activity is governed by Article IV of the Affirmed Legal Framework, and the Client is responsible for its own privacy information to the affected people. This Notice does not turn processor activity into controller activity.

This Notice provides information. It is not a contract and does not itself request consent.

2. Who is responsible

Affirmed Agency Ltd is a company registered in England and Wales under company number 16475050.

• Registered office: 124 City Road, London, England, EC1V 2NX
• Privacy contact: louis@affirmed.co

3. Personal data we use and why

The exact data depends on how you interact with us. We obtain it from you, the Client or organisation you represent, authorised colleagues, connected platforms, payment and service providers, devices and browsers, referrals, and public business sources.

Please do not send special-category, criminal-offence or other highly sensitive personal data unless it is genuinely necessary and an appropriate lawful arrangement is in place. If Client materials contain that data, Article IV of the Legal Framework governs Affirmed's processor role.

We do not use controller data to make decisions about people based solely on automated processing that produce legal or similarly significant effects.

Information you need to provide

Client legal identity, required contact and billing details, invoice and payment information, and the identity and access information marked as required in the app are needed to create or administer an account, form or administer the Agreement, issue a valid invoice, take payment, secure access or provide the relevant service. Some information is required by law or contract; other fields are optional and identified as such. If required information is not supplied, Affirmed may be unable to create the account, enter into or administer the Agreement, issue or collect an invoice, take payment or provide the relevant feature or service.

4. Cookies and similar technologies

We use strictly necessary technology to operate the website and remember privacy choices. With your consent, Google Tag Manager may enable analytics or advertising technologies, including Google Analytics and Google Ads, to measure visits and campaigns. Embedded media, including YouTube's privacy-enhanced player, may receive device or usage information when you choose to load or play it.

CookieHub provides the consent controls shown on the website. You can accept, reject or change non-essential categories through those controls. Withdrawing consent does not affect processing that occurred before withdrawal.

5. Google API data and app connections

When an authorised app user connects Google services, Affirmed requests only the scopes needed for the connection features selected. Depending on the service, this may include:

• Google Ads accessible customer account IDs, names, currency, advertiser or manager status, manager-link status and permissions;
• Google Analytics 4 account and property summaries, property IDs and names, access bindings and permissions;
• Google Tag Manager account and container identifiers, names, public container IDs, user permissions and access information;
• Google Merchant Center merchant account identifiers, names, user access and permissions; and
• Google OAuth refresh tokens, granted scopes, connection status, selected account metadata, connecting-user identifiers, timestamps and related status or error information.

We use this data only to display available accounts; create, accept, verify, manage or remove authorised access; maintain connection status; troubleshoot and secure the feature; and comply with applicable legal or abuse-prevention duties.

Affirmed acts as controller when it processes the connecting user's identity and related connection-administration, security and audit records for its own service administration. Where Affirmed accesses or changes Client-selected account or property data solely on the Client's instructions, Affirmed acts as processor and Article IV of the Legal Framework applies.

We do not sell Google user data or use it for retargeting, interest-based advertising, credit decisions, data brokerage, unrelated profiling or training general artificial-intelligence models. Website analytics and advertising described in section 4 concern website-visitor data and do not apply to data received through Google OAuth or Google APIs.

Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements.

Google connection data may be shared with Google to perform the requested action, Supabase to store connection records, and limited authorised personnel and service providers needed to operate and secure the app. We do not intentionally include OAuth tokens in error-monitoring data.

OAuth refresh tokens and connection metadata are kept while needed to provide the connected feature. When all Google services for a workspace are disconnected, we revoke the shared token where possible and delete the stored token record. Disconnecting a particular service removes its connection record and, where supported, Affirmed's access. Limited security, audit, legal or dispute records may be retained where necessary.

Users can disconnect Google services inside the app or email louis@affirmed.co for help removing access or connection data.

6. Meta advertising data

When a Client shares a Meta ad account with Affirmed's Meta business portfolio, Affirmed Agency (business portfolio ID 1698983778896339), as a partner, Affirmed reads that ad account's reporting data through Meta's Marketing API using read-only (ads_read) access held by Affirmed's own Meta system user. Clients do not log in to Affirmed with Facebook or Instagram, and Affirmed does not receive Facebook or Instagram login credentials or access to personal Facebook or Instagram accounts.

Affirmed processes:

• the ad account's identifier, name, currency, time zone and status;
• campaign identifiers, names and objectives; and
• daily performance totals for the ad account and each campaign: amount spent, impressions, clicks, and the purchases and purchase value that Meta attributes to the ads under the attribution settings chosen in the Client's ad sets.

These are totals per day and campaign. Affirmed does not request or receive information about the individual people who saw or clicked the ads. This integration does not send purchases, customer data or any other data to Meta.

Affirmed uses this data only to provide the Client's reporting in Affirmed: including Meta ad spend in the Client's cost and profit figures, assigning that spend to the Client's marketing channels, and showing Meta's own reported results next to Affirmed's measurements. Affirmed processes it on the Client's instructions as processor under Article IV of the Affirmed Legal Framework. It is stored in Supabase and processed on Vercel, as described in the Subprocessor Register.

We do not sell, license or share Meta data except as needed to provide the Client's reporting, and we do not use it for advertising, profiling, data brokerage or training artificial-intelligence models. Our use of Meta data follows the Meta Platform Terms and Developer Policies.

The Client can stop Affirmed's access at any time by removing Affirmed Agency as a partner on the ad account in Meta Business Settings, or by asking Affirmed to disconnect the ad account. Affirmed then stops reading the account.

Deleting Meta data

To have Affirmed delete the Meta data it has imported for an ad account, email louis@affirmed.co from an address associated with the Client and name the ad account or workspace. Affirmed will confirm the request and delete the imported Meta data within 30 days. Imported Meta data is also deleted when the Client's workspace is deleted, and is returned or deleted when the Services end under clause 32 of the Legal Framework. Limited records needed for security, legal or dispute purposes may be retained where necessary.

7. Shopify commerce data and managed conversion measurement

Affirmed processes the commerce and measurement data in this section on the Client's instructions as processor under Article IV of the Affirmed Legal Framework. When an authorised user connects a Shopify store, Affirmed receives an access token and the Shopify permissions approved for that store. Depending on the features the Client enables and the access Shopify grants, Affirmed may process:

• current product, variant, catalogue, inventory, price and cost-per-item facts;
• order and line-item snapshots and Shopify sale, edit, cancellation, transaction, refund, return and exchange facts;
• store, order, product, variant and pseudonymous customer identifiers; and
• connection, permission, synchronisation, webhook, error and audit metadata.

Affirmed uses those facts to keep the Client's commerce views current, reconcile Shopify and connected Google reporting, calculate clearly labelled factual or modelled metrics, and perform Shopify actions requested by an authorised user. Current catalogue costs are not represented as historical cost of goods sold.

Customer records and order attribution

When the Client grants the optional Shopify customer permission, Affirmed keeps a pseudonymous record for each customer of that store: Shopify's customer identifier, creation and update times, order count, amount spent and currency, import metadata, and links to imported orders. The record does not contain customer names, email addresses, telephone numbers, postal addresses or notes. With the same permission, Affirmed also keeps the Client's own customer tags on the customer's orders for grouping reports, dropping tags that contain an email-address marker. Affirmed uses these records for the Client's customer counts, repeat-purchase, lifetime-value and other reports, and to identify customer status for the consented conversion measurement described below. Guest orders may remain unlinked.

For ordinary commerce reporting, Affirmed does not request customer contact fields, payment-card details or customer notes. Orders retain the shipping country, not the shipping address. Orders also retain limited Shopify visit records for marketing attribution: first and last visit times, source and UTM labels, and referrer and landing hostnames. Full visit URLs are not retained in those records.

Store visitors and the Affirmed Pixel

When the Client enables the Affirmed Pixel, it records consented page and product views, cart and checkout steps and purchases under a pseudonymous browser identifier. Analytics consent is required. The approximate country derived from the request is retained in pixel activity records only as a two-letter country code. Request IP addresses are separately processed by Affirmed's infrastructure for security and rate limiting; they are not stored in those pixel activity records.

For shoppers who also permit marketing and have not opted out of data sharing, the pixel can retain advertising click identifiers, including gclid, gbraid and wbraid. It remembers the Google ad visit's click identifier, ad source and campaign from the link, visit start time and browser user-agent string. It supplies those details, together with the browser user-agent string at the event, with cart, checkout and purchase events so they can be matched to the Client's ads. Event records may also include consent choices, time, order references, first-order status where available, currency, value and relevant product, variant, quantity and price facts.

Raw pixel event records, advertising click identifiers and ad-visit details are configured to expire within 90 days and are periodically deleted. Pseudonymous visitor records are removed after 90 days of inactivity once their retained events and purchase links have expired. Minimal attribution results may remain with an order after identifying journey evidence is removed. Advertising click identifiers and stored ad-visit details are encrypted at rest. GA _ga client and selected-stream session cookie values used for GA4 delivery are also encrypted at rest and deleted after successful delivery or validation, when delivery is ruled out, or within 72 hours, whichever occurs first.

Google advertising and analytics measurement

When the Client connects and enables Google Ads or Google Analytics 4 measurement, Affirmed can send purchases and selected cart and checkout events to the Client's own Google accounts. GA4 measurement can also include product views. Shopify's authenticated order data, rather than the browser event alone, verifies purchases and their commerce facts.

Google Ads purchases may include the order identifier, time, revenue or profit value according to the Client's selected conversion actions, currency, known new, returning or long-lapsed customer status, consent choices, and available Google click and ad-visit details, including the landing and conversion browser user-agent strings. Products and discount codes are included where the required Merchant Center product mappings are complete. Google Ads delivery requires marketing consent and is not permitted where the shopper has opted out of data sharing. Affirmed sends value corrections or withdrawals to Google Ads when refunds or cancellations change a previously submitted conversion.

GA4 delivery requires analytics consent. Its purchase data may include the order identifier, time, revenue, currency, tax, shipping, products, discount codes, known new or returning customer status, consent choices, and client and session identifiers from the shopper's Google Analytics cookies. Affirmed's GA4 purchase payload does not include profit values or the Google Ads ad-visit details described above.

Enhanced Conversions

Enhanced Conversions is a separate, optional part of Google Ads measurement enabled on the Client's instructions. For a verified purchase, and only where the shopper has allowed both marketing and data sharing, Affirmed may read the buyer's email address, telephone numbers, first and last name, country and postcode from the Shopify order at the time of delivery, where available and authorised by Shopify. Email addresses, telephone numbers and first and last names are normalised and converted to one-way SHA-256 hashes in application memory. Those hashes are sent to the Client's Google Ads account with the country and postcode, which are sent unhashed, to help match the purchase to the Client's ads. Affirmed does not retain these contact values or their hashes in its database or application logs. For these contact identifiers, the delivery record keeps only operational status and the kinds of identifiers submitted. This flow does not read or send street addresses or cities, or create a device fingerprint.

Shopify's recorded costs

With the Client's permission, Affirmed imports the cost of goods sold recorded by Shopify for each sale using Shopify's reports API. Shopify requires protected customer data access for that API, but Affirmed's query does not select any customer field. The imported sales data comprise sale, order and line-item identifiers, line type, whether the line relates to a return, whether a cost was recorded, the shop-local date, and the cost amount and currency. Affirmed also keeps the metadata needed to synchronise these records.

Privacy requests and the Client's responsibilities

Affirmed receives and responds to Shopify's mandatory privacy webhooks for data access and erasure. A customer-erasure request deletes the customer's registry record and associated imported orders. Shopify's store-erasure request after uninstalling the app deletes the store's imported data. Limited administrative records needed to prevent deleted data being re-imported may remain. Clients and store owners may also contact louis@affirmed.co about a Shopify data request or removal.

The Client is responsible for selecting and configuring its Shopify and Google accounts, establishing an appropriate lawful basis, providing any privacy information required for its customers, and enabling managed measurement only where permitted. Shopify and Google may act as independent controllers or as providers appointed directly by the Client for parts of these operations; their own terms and privacy information also apply.

8. AI services used on Client instructions

This section provides operational transparency about disclosures made while Affirmed acts on a Client's instructions. It does not make those operations Affirmed's independent-controller processing or alter Article IV of the Legal Framework.

Affirmed may use both processor AI services and AI services whose providers independently determine some purposes and essential means.

Where a provider acts as Affirmed's subprocessor, it is identified in the Subprocessor Register and Article IV applies.

Where a provider acts as an independent controller, the Client instructs and authorises the disclosure under clause 26.4. The provider's own terms and privacy information govern its independent processing, which may include security, abuse prevention, legal compliance, service administration or service or model improvement. The Client remains responsible for ensuring that its lawful basis, privacy information and other controller obligations cover the instructed disclosure. Affirmed remains responsible for security and transfer obligations imposed directly on Affirmed by applicable law.

Affirmed currently uses ChatGPT Pro, supplied to UK users by OpenAI OpCo, LLC in the United States, and Claude Max, supplied to UK users by Anthropic Ireland, Limited in Ireland, as independent-controller AI services. They are not listed as subprocessors merely because they receive information under that arrangement. Inputs may include the data categories described in clause 25.4 of the Legal Framework, including identifiable, customer-level or bulk data where lawful and appropriate; sensitive data described in clause 25.5 is excluded unless separately agreed. The precise retention, training and other processing treatment depends on the provider's then-current terms, settings and privacy information.

Because ChatGPT Pro is a consumer service supplied from the United States, Affirmed does not treat the consumer subscription alone as a UK restricted-transfer safeguard. Affirmed submits Client Personal Data through ChatGPT Pro only where an applicable valid transfer mechanism or statutory exception covers the disclosure; otherwise it uses non-personal or effectively anonymised material, or routes the task through an authorised business or API service.

9. Who receives personal data

We disclose personal data only where reasonably needed for the purposes above, including to:

• personnel and contractors who need it for their role and are subject to confidentiality duties;
• infrastructure, database, storage, monitoring and AI providers, including those identified in the Subprocessor Register where they process Client Personal Data;
• Upstash, Inc. for request security and rate limiting for the app and Shopify pixel endpoint, using keyed hashes of request identifiers and short-lived counters, as described in the Subprocessor Register;
• Plus Five Five, Inc., trading as Resend, for transactional account, invitation, billing and service emails;
• Stripe for payment processing; Shopify and Google for connected commerce and selected measurement features; Google for website analytics or advertising; CookieHub for consent management; and YouTube when embedded media is loaded;
• the Client or organisation you represent and its authorised users;
• professional advisers, insurers, auditors, prospective purchasers or successors under appropriate confidentiality protections; and
• courts, regulators, law-enforcement bodies or other recipients where lawfully required or necessary to protect rights and safety.

Google and other connected platforms may act as independent controllers for some activity. Their own terms and privacy information then apply.

For Upstash rate limiting, Affirmed converts identifiers such as request IP addresses, user identifiers, shop domains and tokens into keyed HMAC-SHA256 hashes before sending them. The secret key remains with Affirmed. These hashes remain pseudonymous data. Rate-limit analytics is disabled. Counters automatically expire within about two minutes after last activity, or about two hours for the hourly limits. Historical rate-limit analytics containing unhashed request identifiers were deleted on 3 October 2026.

10. International transfers

Affirmed operates from the United Kingdom and uses providers whose personnel, infrastructure or subprocessors may be located in other countries. Where UK transfer restrictions apply, we use an available lawful mechanism appropriate to the transfer, such as UK adequacy regulations, the UK Extension to the EU-US Data Privacy Framework where the recipient's certification applies, the UK International Data Transfer Agreement, or the UK Addendum to approved EU Standard Contractual Clauses. We may also use supplementary technical or organisational measures where appropriate.

The Subprocessor Register describes the current locations and mechanisms for Client Personal Data processed by subprocessors under Article IV. The main transfers made for Affirmed's controller activities and the current processor-side disclosures to independent-controller AI services under clause 26.4 are summarised below. A provider may use additional locations through its published subprocessor list or privacy information.

You may ask for further information or a copy of a relevant safeguard, subject to necessary redactions, by emailing louis@affirmed.co.

11. How long we keep controller data

We keep personal data only for as long as reasonably needed for its purpose, taking account of legal, accounting, security and dispute requirements. Our usual criteria are:

• enquiry and prospect records: while discussions remain active and ordinarily no more than 24 months after the last meaningful contact;
• Client relationship, agreement, invoice, payment and acceptance-evidence records: throughout the relationship and ordinarily six years afterward, or longer where a live claim or legal requirement applies;
• app account data: while the account is active and for a limited period needed for closure, security, restoration or dispute handling;
• routine security and audit logs: according to the applicable system cycle, ordinarily no more than 24 months unless needed for an incident or claim;
• marketing contacts: until you opt out or the information is no longer useful, with a minimal suppression record retained to respect the opt-out; and
• Google connection data: as described in section 5.

Client Personal Data held in Affirmed's processor capacity is returned or deleted under Article IV of the Legal Framework rather than these controller-retention periods. Section 7 describes the shorter retention of raw Shopify pixel events, advertising click identifiers, ad-visit details and GA cookie values, the order-linked attribution results retained after raw evidence expires, and Shopify's customer and store erasure requests. Enhanced Conversion contact values and hashes are processed transiently and are not retained by Affirmed.

12. Your rights and choices

Depending on the law and circumstances, you may have rights to request access, correction, deletion, restriction or portability of your personal data, and to object to processing. Where processing relies on consent, you may withdraw it at any time. These rights are not absolute and exemptions may apply.

Your right to object: You may object at any time to the use of your personal data for direct marketing. You may also object to processing based on legitimate interests; whether Affirmed must stop depends on applicable law and the circumstances.

To exercise a right or ask a privacy question, email louis@affirmed.co. We may need proportionate information to verify your identity and authority. If Affirmed holds the data only as a processor for a Client, we will normally direct the request to that Client.

You may complain to the UK Information Commissioner's Office or another regulator with jurisdiction. We would appreciate the opportunity to address the issue first.

13. Children

Affirmed provides business services and does not knowingly offer the website or app to children. Please contact us if you believe a child has supplied personal data directly to Affirmed inappropriately.

14. Changes

We update this Notice when our controller processing or legal obligations change and publish the current text on this page with its updated date. Where a change materially affects how we use data already collected, we will take reasonable steps to bring it to the attention of affected people before the new use where required.