shopAds Data Retention Schedule
Effective date: 27 July 2026
1. Purpose
This schedule records how long shopAds LLC (“shopAds”) keeps each category of personal data, and why. The governing principle is that shopAds keeps personal data only for as long as it is needed for the purpose it was collected for, and then deletes or anonymises it, except where the law requires it to be kept for longer. This schedule is consistent with the shopAds Privacy Policy and the merchant Data Processing Agreement.
2. Merchant customer and visitor data held as processor
For the customer and visitor data that shopAds processes on a merchant’s behalf, which includes customer name and email, order details, the click identifier that links an advertisement to an order, and session and behavioural data collected on the merchant’s store, shopAds deletes or anonymises the data within 30 days of the merchant uninstalling the app or closing their account, unless the law requires part of it to be kept for longer. Consent signals collected for regulated regions are held as part of this data and are deleted on the same basis.
Where that data has been transferred into the advertising account and the analytics property that shopAds provisions and operates for the merchant, shopAds removes it on the same basis and within the same 30 days, by deleting the advertising audiences built from the merchant’s customer data and deleting that analytics property. The advertising account itself is deactivated within the same period, so that it can no longer serve or incur spend and holds no personal data, and is retired thereafter.
3. Account connection credentials
The credentials that connect to the accounts a merchant grants shopAds access to, being the merchant’s store and the merchant’s product listing account, are held in encrypted form only for as long as the connection is active, and are deleted promptly when a merchant disconnects an account or uninstalls the app, and within 30 days at the latest.
4. Merchant account and contact data held as controller
The account and contact details used to register, identify, authenticate, and communicate with a merchant are kept while the merchant is an active customer, and are deleted or anonymised within 90 days of the account being closed, except for the records covered below that must be kept for legal reasons.
5. Billing and fee records
Records needed to account for the management fee, including payment method references, the fee ledger, and invoices, are kept for the period required by applicable tax and accounting law, which is generally up to seven years, after which they are deleted.
6. Authorisation and onboarding evidence
The records that evidence a merchant’s authorisation and acceptance, including the fee mandate authorisation, acceptance of the Data Processing Agreement, consent and authorisation records, and the onboarding and authentication logs, are kept for the duration of the relationship and for up to seven years afterwards, so that shopAds can evidence the authorisation it acted on and defend a dispute within the period one could be brought.
7. Security and audit logs
Logs of access to personal data and of system and security events are kept for 12 months to support security monitoring and investigation, and are then deleted.
8. Support communications
Communications with a merchant through support are kept for 24 months and are then deleted, except where a specific communication needs to be kept for longer as part of the billing or authorisation records above.
9. Backups
Backups are encrypted and are held on a rolling cycle. When personal data is deleted from the live systems, it is removed from backups as those backups are rotated, within 90 days.
10. Website data
Technical and analytics data collected from visitors to shopads.ai is kept for up to 14 months and is then deleted or aggregated.
11. Review
shopAds reviews this schedule as the service and its legal obligations change, and updates the periods where a change requires it.