Privacy policy

Who we are

Birds Eye Commerce is operated by Tearaway Media. This policy covers our website, Flight Deck, Shopify app, and connections to analytics and advertising platforms. We use the information described here to provide store reporting, identify improvements, and support the work you request. Connections are optional and only available when the relevant integration is enabled.

Your account and requests

We collect the email address you use to sign in or contact us, your store URL when you provide it, and account identifiers and sign-in records. We also process your support messages and, when you use those features, task selections, findings, work history, and billing references. We use this information to authenticate you, associate reports with your account, respond to requests, and provide the service.

Connecting a platform

You authorize access through the platform's own sign-in and permission screens; we do not ask for your platform password. We receive authorization tokens, granted permissions, and information identifying the accounts or properties available to you. We use that information to let you choose a resource and retrieve its reports. For saved Flight Deck connections, we store the selected resource ID and label, encrypted access and refresh tokens where supplied, token expiry, connection status, and connection dates.

Facebook and Instagram ads

With your authorization, the Meta connection reads accessible ad account IDs, names, status, currency, and time zone. Reporting uses spend, impressions, clicks, and, for analysis, reported purchases and purchase value, ad set names and performance, frequency, ad creation dates and status, ad copy and headlines, creative image or thumbnail references, video identifiers, creative formats and destination URLs. We use this information to display advertising performance and identify possible improvements. The connection requests ads_read. It does not request permission to change campaigns, budgets, or ads, or to read Facebook Page posts, messages, or customer lists.

Google Analytics and Google Ads

Google Analytics access includes account and property identifiers and names, reporting currency and time zone, and reports such as sessions, purchases, conversions, revenue, devices, traffic channels, and landing page paths, which can include query strings. Google Ads access includes advertiser and manager account details, campaign names, search terms, spend, clicks, impressions, and reported conversions and conversion value. We use these reports to show performance and identify store improvements. Analytics requests read-only access. Google's Ads authorization includes broader capabilities, but our connector only makes reporting requests and does not edit campaigns or spend. Our use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including its Limited Use requirements.

Shopify and your storefront

Connecting Shopify from Flight Deck asks you to approve read-only access to orders and products. We read store identity, currency and time zone, product titles and inventory, and order dates, subtotal values, discounts, refunds, fulfillment timing/status, product line items, cancellation and test status to display sales and stock reports. Store analysis can also read discount usage, customer identifiers and order counts for aggregate repeat-purchase cohorts, and abandoned-checkout totals to calculate store-level metrics. These queries do not request customers' names, email addresses, phone numbers, shipping addresses, or payment-card details. We may also inspect publicly available pages and product information at the store URL you provide. After you approve access, we save an encrypted offline access token, and an encrypted refresh token when Shopify issues an expiring token, with the store identity, for the Birds Eye account that started the connection. We do not link a Shopify user to a Birds Eye account by email address. A store stays linked to one Birds Eye account. The audit saves aggregate readings and findings. Customer identifiers used to calculate repeat-purchase cohorts are not retained in those snapshots. Stored order history, which is separate from those snapshots and is not enabled yet, is described under Stored order and ad history.

Stored order and ad history

This section is draft wording for history storage that is written and not merged. It is not enabled in the released app. Until that work is released, Birds Eye does not keep the order or ad history described here, and the deletion steps in this section do not run.

When it is released, we keep order-level commerce fields and ad metrics so a later read can show trends. A comparison uses the same dates a year earlier only when every one of those earlier days is already stored. If any of those days is missing, the comparison is the prior period. We do not promise that a year of history is on file. The amount we ask a platform for is capped, and a cap is not a guarantee that every day was saved.

For an order we keep the shop, order id, processed date, currency, subtotal, discounts, refunds, and line items with product id, title, handle, quantity, and line total. For a product we keep the id, title, handle, status, publish date, and inventory counts. We do not keep product description HTML. For ads we keep the platform, the ad entity, the day, spend, impressions, clicks, and reported purchases and purchase value. Meta purchase counts in that history use the pixel purchase action only. We also keep one storefront reading per day, with product id, title, and handle, and whether the product list was readable. We do not keep customer names, email addresses, phone numbers, or postal addresses in this history.

An order may include a one-way code derived from the Shopify customer id, so repeat purchase can be counted without storing the id. The raw id is not stored. The code is created only when a server secret is configured and the id is present. If the secret or the id is missing, the order is stored with no customer code.

Uninstalling the Shopify app, or a Shopify shop redact request, deletes that shop's stored orders, order lines, product rows, storefront readings, and shop history jobs. It does not delete stored ad metrics, analysis snapshots, or the Birds Eye account. A Shopify customer redact deletes the stored orders that match that customer's one-way code, and the line items on those orders. It does not delete other customers' orders, product rows, or ad metrics. If no customer code was stored, that redact does not delete order rows.

Disconnecting Meta or Google Ads does not delete stored ad metrics unless you check "Also delete stored ad history for this account." Checking it deletes the stored daily ad metrics for that platform on your Birds Eye account, and the job record for that ad sync. Disconnecting Shopify does not offer that option and does not delete stored ad metrics. Email us to delete the Birds Eye account, analysis snapshots, or anything these steps do not remove.

Business context

When supplied, we save your business category, goals, audience, positioning, cost assumptions, support themes, competitor URLs and sourced benchmark inputs to make recommendations more relevant. Please summarize support themes without customer names or contact details. We also store improvement implementation dates and metric baselines you choose to record. Source references and written notes from earlier audits can remain in your audit history.

Klaviyo

When enabled, the Klaviyo connection reads account identity and email-flow names and statuses. The authorization requests read-only account, campaign, flow, metric, list and segment access. The current audit reads flow inventory; it does not retrieve individual subscriber profiles or send or change messages. Disconnecting removes the encrypted credentials stored by Birds Eye. You may also revoke the application in Klaviyo settings.

How we use and share information

We use connected data to provide your reports, analysis, and requested services, troubleshoot problems, and protect the service. We do not sell or rent connected platform data, use it to build advertising audiences, or use it to train general-purpose AI models. We use Vercel to host the application and Supabase for account authentication and database storage. These providers process information to operate the service. When paid checkout is available and you choose to use it, Stripe processes payment information and receives the email address and purchase references needed for checkout; we do not store full payment-card numbers. We may disclose information when required by law or necessary to investigate abuse and protect the service. Human access is limited to service operation, security, legal obligations, and support or work you authorize; access to Google API data is also subject to Google's Limited Use restrictions.

Storage and security

We use HTTPS for our production website and platform API requests. Saved connection tokens are encrypted before being written to the database, and the encryption key is kept separately in the server environment. Reports and account information are subject to authenticated account access checks. Live connection previews are requested on demand and are not saved as report history by the preview feature. Analysis snapshots and task records, where created, can contain platform metrics and findings. Our hosting and authentication providers may process technical records such as IP addresses, request times, browser information, and errors. Information may be processed outside your country by our service providers. No method of storage or transmission can guarantee absolute security.

Cookies and browser storage

We use cookies to keep you signed in and protect connection authorization. The dashboard also uses local browser storage for preferences such as whether you have reviewed a daily brief. Our application does not currently install advertising pixels or third-party behavioral advertising trackers. The platforms you visit to authorize a connection have their own cookie and privacy policies.

How long information is kept

Account details, saved connection records, and any stored report or task history remain associated with your account until they are removed in response to a deletion request or are no longer needed for the service. Saved records do not currently have an automatic age-based deletion schedule. A token expiring, a trial ending, signing out, or revoking access does not automatically erase stored records. Stored order history is not enabled yet. When it is, the uninstall, Shopify redact, and optional ad-history purge described under Stored order and ad history are the exceptions, and they do not erase the rest of the account. We may retain limited records when necessary for legal obligations, accounting, security, or resolving disputes; if this affects a deletion request, we will explain what must be retained and why. Copies in service-provider backups follow those providers' retention processes rather than disappearing immediately from every backup.

Stop a connection

You can revoke Birds Eye Commerce's access in the connected platform's app or business-integration settings, or uninstall our Shopify app from your store. This prevents further access through the revoked authorization. On the released app, uninstalling or revoking access does not by itself delete reports or account records already saved in Birds Eye Commerce. Stored order history is not enabled yet. When it is, uninstalling the Shopify app or a Shopify shop redact deletes that shop's stored order history, and still does not delete stored ad metrics or the Birds Eye account. To remove the rest, send a deletion request using the instructions below.

Request a copy, correction, or deletion

Email hogan@tearawaymedia.com from your Birds Eye account email. For deletion, use the subject "Birds Eye data deletion" and include your store URL, the connected platform, and whether you want that connection's data or your entire Birds Eye account removed. If you cannot use your account email, contact us and we will help verify ownership. Do not send passwords, access tokens, or payment-card information. Our team verifies the request, removes the applicable saved connection credentials and associated platform data, and confirms completion or explains any records that must be retained. There is no button that deletes an entire Birds Eye account. Account records, analysis snapshots, and anything the stored-history steps do not cover are handled by our team. Those steps are not enabled yet. When they are, uninstall and a Shopify shop redact delete that shop's stored order history automatically, a Shopify customer redact deletes matching stored orders only when a one-way customer code was saved, and disconnecting Meta or Google Ads deletes that platform's stored ad metrics only if you check the option to delete them. You can use the same contact to request a copy or correction of your information or raise a privacy concern. Deleting data from Birds Eye does not delete the original records held by Shopify, Meta, Google, or another platform.

Changes to this policy

We will update this page and its date when our data practices change. Before using connected platform data for a new purpose or requesting additional access, we will explain the change and obtain additional authorization where required. Contact us with any questions about this policy or your information.