shopAds Data Retention Schedule
Effective date: 11 September 2026
1. Purpose
This schedule records how long shopAds LLC (“shopAds”) keeps each category of personal data, and why. The governing principle is that shopAds keeps personal data only for as long as it is needed for the purpose it was collected for, and then deletes or anonymises it, except where the law requires it to be kept for longer. This schedule is consistent with the shopAds Privacy Policy and the merchant Data Processing Agreement.
2. Merchant customer and visitor data held as processor
For the customer and visitor data that shopAds processes on a merchant’s behalf, which includes customer name and email, order details, a one way hashed form of the customer’s phone number, the click identifier that links an advertisement to an order, product reviews left on the merchant’s store, and session and behavioural data collected on the merchant’s store, shopAds deletes or anonymises the data within 30 days of the merchant uninstalling the app or closing their account, unless the law requires part of it to be kept for longer. Consent signals collected for regulated regions are held as part of this data and are deleted on the same basis.
Where that data has been transferred into the advertising account and the analytics property that shopAds provisions and operates for the merchant, shopAds removes it on the same basis and within the same 30 days, by deleting the advertising audiences built from the merchant’s customer data and deleting that analytics property. The advertising account itself is deactivated within the same period, so that it can no longer serve or incur spend and holds no personal data, and is retired thereafter.
Two categories of short lived operational data are deleted on a rolling basis during the life of the relationship, rather than only at its end. Diagnostic records of app installation requests are kept for 30 days. Click records that cannot be matched to any order are kept for 10 days. In each case the deletion is automatic once the period passes.
3. Account connection credentials
The credentials that connect to the accounts a merchant grants shopAds access to, being the merchant’s store and the merchant’s product listing account, are held in encrypted form only for as long as the connection is active, and are deleted promptly when a merchant disconnects an account or uninstalls the app, and within 30 days at the latest.
4. Incomplete onboarding
Where a merchant begins onboarding and does not complete it, shopAds keeps what they have entered only while their setup remains open. shopAds reminds the merchant by email, naming the date on which their setup will be removed, and then removes it. That date is 30 days after the merchant’s last action in the setup, or 14 days after shopAds invites the merchant to the product listing account it has created for them where that invitation lapses first, since a lapsed invitation cannot be renewed. The merchant may ask for the setup to be removed immediately from any reminder. When the setup is removed, the advertising account and the analytics property provisioned for the merchant are deactivated and deleted on the basis set out in section 2, the connection credentials are deleted under section 3, and the authorisation evidence the merchant gave before stopping is kept under section 8.
5. Merchant account and contact data held as controller
The account and contact details used to register, identify, authenticate, and communicate with a merchant are kept while the merchant is an active customer, and are deleted or anonymised within 90 days of the account being closed, except for the records covered below that must be kept for legal reasons. The same applies to the details of any other person the merchant has given access to their account, which are also deleted or anonymised within 90 days of that person’s access being revoked.
6. Optimisation records held as controller
shopAds keeps records of the advertising settings it chose for each merchant and the results those settings produced, described in broad bands such as country, industry, catalogue size, and budget range. These records hold no personal data about any shopper. They refer to a merchant only by a one way code, and shopAds keeps no routine means of linking that code back to the merchant. They are retained after the merchant’s account is closed, as aggregated learning that improves the service for every merchant.
7. Billing and fee records
Records needed to account for the management fee, including payment method references, the fee ledger, and invoices, are kept for the period required by applicable tax and accounting law, which is generally up to seven years, after which they are deleted. shopAds’ own books of account, which record the company’s income and expenses and contain no data about any merchant’s customers or visitors, are kept permanently, as United States federal tax law requires of the company’s records; a merchant appears in them only as the party invoiced.
8. Authorisation and onboarding evidence
The records that evidence a merchant’s authorisation and acceptance, including the fee mandate authorisation, acceptance of the Data Processing Agreement, consent and authorisation records, and the onboarding and authentication logs, are kept for the duration of the relationship and for up to seven years afterwards, so that shopAds can evidence the authorisation it acted on and defend a dispute within the period one could be brought.
9. Security and audit logs
Logs of access to personal data and of system and security events are kept for 12 months to support security monitoring and investigation, and are then deleted.
10. Support communications
Communications with a merchant through support are kept for 24 months and are then deleted, except where a specific communication needs to be kept for longer as part of the billing or authorisation records above.
11. Backups
Backups are encrypted and are held on a rolling cycle. When personal data is deleted from the live systems, it is removed from backups as those backups are rotated, within 90 days.
12. Website data
Technical and analytics data collected from visitors to shopads.ai is kept for up to 14 months and is then deleted or aggregated.
13. Review
shopAds reviews this schedule as the service and its legal obligations change, and updates the periods where a change requires it.