Kuma Audiences privacy policy

Ursa Marketing ("we", "us", or "our") develops and operates Kuma Audiences (the "App"), a Shopify app that lets merchants build customer segments from their Shopify store and sync them as custom audiences to their own advertising accounts on Meta (Facebook and Instagram), Google Ads, TikTok and Pinterest.

This Privacy Policy explains how we access, use, disclose, and safeguard information when a merchant ("you") installs and uses the App, including the personal information of your store's customers that the App processes on your behalf.

We are committed to protecting your privacy and complying with applicable privacy laws, including Quebec's Act Respecting the Protection of Personal Information in the Private Sector, Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and, where it applies to you or your customers, the EU and UK General Data Protection Regulation (GDPR).

1. Who We Are and Our Role

• Merchant information: For the information about you and your store that we collect to provide the App, Ursa Marketing is the data controller.
• Your customers' information: For the personal information of your store's customers that the App processes, you (the merchant) are the data controller and Ursa Marketing acts as your processor (service provider), processing that information only on your instructions and only to provide the App.

2. Information We Access and Collect

2.1 Information About You and Your Store

When you install the App, Shopify gives us access to the following information:

• Store Information: Store name and domain, and the number of customers in your store
• User Information: Name, email address and language of the Shopify user who uses the App
• Subscription Information: The App plan you choose, managed through Shopify's billing system (we never see or store your payment card details)

2.2 Information You Provide

• Contact Details: Name, email address and, optionally, phone number entered in the App
• Communication Data: Messages you send to our support team

2.3 Your Customers' Data

With the access to customer data you grant when installing the App, the App:

• Reads your customer segments and the number of customers they contain
• Creates and manages the segments you build in the App. It does not modify your customer records.
• Reads the customers of a segment when you export or sync it: contact and location details such as email address, phone number, name, city and country

You decide which segments are exported, to which platforms, and which customers they include (for example, only customers who have accepted marketing).

What We Do Not Store:

We do not store your customers' personal information. It is only used while an export or sync runs, to update your audiences, and is not kept afterwards.

2.4 Advertising Platform Connections

When you connect an advertising account (Meta, Google Ads, TikTok or Pinterest), we store the authorization granted by the platform (encrypted), the ad account you select, and information about the audiences created by the App (such as their names and synchronization status).

2.5 Automatically Collected Information

• Usage Data: How you use the App, to operate, support and improve it
• Technical Data: Logs and error reports, and technical information collected by our in-app support chat (such as IP address and browser type)

3. How Your Customers' Data Is Sent to Advertising Platforms

Customer data is only sent when you export an audience or turn on its automatic sync, and only to the advertising account you connected. It is transmitted over encrypted connections, in the format each platform requires, including pseudonymization (hashing) where required. The platforms use it to match your customers with their own users and build your audiences, which belong to you and are governed by your agreement with each platform.

As the data controller for your customers' information, you are responsible for having an appropriate legal basis (such as consent) to use it for advertising, and for describing this use in your own store's privacy policy.

4. How We Use Your Information

We use the collected information for the following purposes:

• Service Provision: To build segments and create and update audiences on the platforms you connect
• Account Management: To set up and manage your store's access to the App
• Payment Processing: To manage your subscription through Shopify's billing system
• Support and Communication: To answer your questions and send service updates and important notices
• Improvement: To understand how the App is used and improve it
• Legal Compliance: To comply with legal obligations and protect our rights

Your customers' data is used only to create and update audiences in your own advertising accounts. We never use it for our own purposes and never combine it with data from other stores.

5. How We Share Your Information

We may share information with:

• Advertising Platforms You Connect: Meta, Google, TikTok and Pinterest, as described in section 3, only at your request
• Shopify: Which hosts your store and processes App subscription payments
• Service Providers: Vendors that help us operate the App, such as cloud hosting, customer support and customer relationship management tools
• Legal Requirements: When required by law or to protect our rights and safety
• Business Transfers: In connection with a merger, acquisition, or sale of assets

We do not sell your personal information or your customers' personal information to third parties.

6. Data Security

We implement industry-standard security measures to protect your information, including encryption, secure servers, and access controls. However, no method of transmission over the internet is 100% secure, and we cannot guarantee absolute security.

7. Data Retention and Deletion

• Your Customers' Data: Not retained beyond the export or sync that uses it.
• Disconnecting a Platform: We delete the audiences the App created in that advertising account and the authorization we stored.
• Uninstalling the App: We delete your store's data, including platform authorizations and audience settings, and attempt to delete the audiences the App created in your connected advertising accounts. Any audience that could not be removed can be deleted from the platform's ads manager.
• Contact and Support Records: Kept for as long as necessary for our legitimate business purposes or as required by law, and deleted on request.

We also respond to the data access and deletion requests Shopify sends us on behalf of merchants and their customers.

8. Your Privacy Rights

Under applicable privacy laws, you have the right to:

• Access: Request access to your personal information
• Correction: Request correction of inaccurate or incomplete information
• Deletion: Request deletion of your personal information
• Portability: Request a copy of your data in a portable format
• Objection: Object to certain processing of your data
• Withdrawal of Consent: Withdraw consent for data processing where consent is the legal basis

To exercise these rights, please contact us at confidentialite@ursa.marketing.

If you are a customer of a store that uses the App, the store is responsible for your information. Please contact the store directly to exercise your rights; we will help the merchant respond to your request. You can also manage how you see ads from each platform in your Meta, Google, TikTok or Pinterest ad settings.

9. Cookies and Tracking Technologies

The App runs inside your Shopify admin and does not use advertising or analytics cookies. Our in-app support chat (Intercom) uses cookies and similar technologies to keep your conversations and recognize you between visits. Cookies set by Shopify in your admin are governed by Shopify's own privacy policy.

10. Third-Party Services

The App integrates with third-party services (Shopify, Meta, Google Ads, TikTok and Pinterest). Once audiences are created in your advertising accounts, their use is governed by each platform's terms and privacy policy. We are not responsible for the privacy practices of these third parties. We encourage you to review their privacy policies.

11. Children's Privacy

The App is intended for businesses and is not intended for individuals under the age of 18. We do not knowingly collect personal information from children. If you believe we have collected information from a child, please contact us immediately.

12. International Data Transfers

Your information and your customers' information may be transferred to and processed in countries other than Canada, including the United States, by our service providers and by the advertising platforms you connect. We ensure that appropriate safeguards are in place to protect your information in accordance with this Privacy Policy and applicable laws.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time, for example when the App supports a new advertising platform. We will notify you of material changes by email or through the App. Your continued use of the App after such changes constitutes acceptance of the updated Privacy Policy.

14. Contact Us

If you have questions about this Privacy Policy or wish to exercise your privacy rights, please contact us: