Privacy Policy

Opteno is operated by Ksel Technology Limited, a company incorporated in Hong Kong. Its company registration number is 76991590 and its business registration number is 76991590-000. Its registered address is Unit B, 3/F., Kai Wan House, 146 Tung Choi Street, Mongkok, Kowloon, Hong Kong.

Ksel Technology Limited is the data controller for everything described in this policy: it decides what Opteno collects and why. Your own customers are a separate matter — the orders and customer records that sit in your Shopify store are yours, you are the controller of them, and Opteno reads them on your instructions and for your purposes only.

Write to privacy@opteno.app about anything in this policy, or about a request under any of the rights in section 9. It is an address on Opteno’s own mail server and it reaches the same mailbox a person reads every day. support@opteno.app reaches the same people about anything else, and post reaches us at the registered address above.

Opteno has not appointed a Data Protection Officer, and is not required to appoint one. The two facts that decide it are both true today: Opteno carries out no large-scale systematic monitoring of individuals, and it processes none of the special categories of personal data — health, beliefs, biometrics, politics, sex life. If either stops being true, an officer will be appointed and named here.

Opteno has no establishment in the European Union and has not appointed a representative there under Article 27 of the GDPR. Requests and complaints are handled directly by the company at the addresses above, answered within the time section 9 commits to, and your own national supervisory authority remains open to you whatever we do.

Account data you give us: your name, email address, password (stored only as a one-way hash), your language and timezone, your two-factor settings, and the workspaces and stores you belong to.

Business data we read from the providers you connect. From Shopify: products, variants, orders, order lines, refunds and refund lines, cost-per-item, markets, price lists and publications. From Google Ads: campaign and Performance Max asset-group structure, daily spend in the ad account’s currency, impressions, clicks and conversions, and the Merchant Center offer identifiers Google reports against that spend.

Operational records: an audit log of what was done in your workspace and by whom, and a security log of sign-ins, permission changes and failed attempts. The audit log records the action, the thing acted on, the time, the email address of whoever did it, and the before-and-after values of the change. The security log records the event, its severity and the time. Both also record an IP address and a browser user agent. A failed sign-in records why it failed — an unknown account, a wrong password — and not the address that was typed.

Competitor research you ask for: the publicly available catalogue and pricing information of storefronts you add, read from those stores’ own public product listings. Opteno reads only what a shopper could see without signing in.

Billing data, once you subscribe: your plan, the stores it covers, the invoices Stripe raises and, of the payment method, only its identifier, the card brand, the last four digits and the expiry date. A card number never reaches Opteno; it is entered on Stripe’s own pages.

Anything you write to us. Mail to our support and privacy addresses lands in a mailbox on our own server and stays there until it is deleted by hand.

Opteno does not use advertising trackers, session recording or behavioural profiling, it makes no automated decision that has a legal or similarly significant effect on you, and it does not buy data about you from anyone.

Opteno connects to Google Ads through Google’s own APIs, with your permission and under a single scope. This section says exactly what that permission covers, because it is the one part of this policy Google itself reviews.

Data we access from Google

One permission, the Google Ads scope, and nothing else. Through it Opteno reads your campaign and Performance Max asset-group structure, daily spend in the ad account’s currency, impressions, clicks and conversions, and the Merchant Center offer identifiers Google reports that spend against. Opteno does not read your Gmail, your Drive, your contacts or your Google profile, because it never asks for permission to.

How we use Google user data

To compute and show you the figures the product exists to provide — per-product ad spend, ROAS, POAS and net profit — and, where you approve it, to apply the product exclusions you choose in a Performance Max asset group. It is never used for anything else. Opteno never changes a budget or a bid and never pauses a campaign.

Opteno’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. In plain terms: that data is used only to provide and improve the features you can see in Opteno; it is not sold; it is not used for advertising of any kind; it is not transferred to anyone except where you direct it, where the law requires it, or to the infrastructure providers named in section 5 who process it on our behalf; and no human at Opteno reads it except where you ask us to for support, where it is necessary for security, or where the law requires it. It is not used to train any model.

How we store Google user data

The tokens that let Opteno reach Google Ads are encrypted before they are stored, with AES-256-GCM and a fresh 96-bit initialisation vector for every value. The figures read through them are stored in Opteno’s own database on the server described in section 6, and are visible only to the workspace the Google Ads account is connected to. Section 7 covers the rest of the security.

How we share Google user data

With nobody, beyond the infrastructure providers in section 5 that host and carry it. It is not sold, not licensed, not pooled into a benchmark and not shown to another customer. It leaves Opteno only where you send it — to a webhook you configured, or to a Slack workspace you connected.

Data retention

Google Ads data is kept while the store it belongs to is connected. Disconnecting Google Ads in Opteno destroys the stored credentials immediately — the token columns are emptied, not flagged — and deleting the store or the workspace removes the figures with it. You can also revoke Opteno’s access from your Google Account at any time, which ends it from Google’s side just as completely. Section 8 gives the retention periods in full.

To compute the metrics the product exists to provide — per-product ad spend, revenue, cost of goods, refunds, ROAS, POAS, gross margin and net profit — and to show you where a figure could not be computed and why. To carry out the changes you approve: drafting or archiving a product, excluding or including an offer in a Performance Max asset group, publishing a product to a market, changing a price. To run your account, send you the mail the service itself requires (verification, password reset, a security notice, an invitation you were sent) and to bill you. For people in the EU, EEA or UK this is processing necessary to perform our contract with you — GDPR Article 6(1)(b).

To keep the service secure and to be able to reconstruct what happened after an incident, which is what the audit and security logs are for, and to count page views with Cloudflare’s cookieless counter. That is our legitimate interest, and yours, in a service that can be defended and audited — Article 6(1)(f). That counter stores nothing on your device and needs no consent; everything that does is in the paragraph below, and you can object to processing on this basis at any time — section 9 says how.

To keep the records that tax and company law require of us. That is Article 6(1)(c), and section 8 names the periods and the statutes that set them.

To measure how Opteno is found and used, and whether our own advertising works. This is the one thing we do that rests on your consent — Article 6(1)(a) — and it does nothing until you give it. Declining the banner leaves it entirely off; you can withdraw at any time by clearing this site’s data, and withdrawing is as easy as consenting. Section 5 names the two companies involved and what each receives.

We do not sell personal data, and we have never sold it. We do not profile you to make decisions about you, and nothing here produces a legal or similarly significant effect on anyone.

As a Hong Kong company, Ksel Technology Limited is also subject to Hong Kong’s Personal Data (Privacy) Ordinance. Its collection principle asks that data be collected lawfully and fairly, for a purpose directly related to what we do, and that no more be collected than that purpose needs; its use principle asks that it then be used only for that purpose. Everything above is written to the same standard, so the two frameworks do not pull in different directions here.

Opteno has no advertising network, no data broker and no affiliate in it. The complete list of companies that touch your data, and what each of them touches, is this:

Contabo GmbH — the machine itself. It provides the hardware, the network and the datacentre in Lauterbourg, Grand Est; it does not use what is on the disks.

Cloudflare — the only way traffic reaches Opteno, and where the off-site backups are held. Every request to this site, the dashboard, the API and the webmail passes through a Cloudflare tunnel, so Cloudflare terminates TLS and sees request metadata including your IP address. Backups are stored in Cloudflare R2, encrypted before they leave our server to a key Cloudflare does not hold. Cloudflare also runs a cookieless page-view counter on this marketing site, injected at its edge rather than by us; it is blocked by the content security policy on the dashboard and the admin console.

Shopify — the source of your store data and the target of the writes you approve. Two smaller things follow from that: your product images are loaded in the dashboard straight from Shopify’s image CDN, so Shopify sees the address of the browser looking at your dashboard, and a product you publish is created in your own store under your own account.

Google (Google Ads API) — the source of your advertising spend and performance data and the target of the exclusions you approve. Section 3 sets out that relationship in full.

Google (Analytics and Ads measurement) — a separate relationship from the Google Ads API above, and one that only exists if you consent. Google Analytics 4 receives page views and a small number of product events (that a sign-up form was reached, that a store was connected, that a first sync finished) together with the identifiers its own cookies set. It never receives your name, your shop domain, your credentials or any figure from your store. Where you also consent to advertising data, two further things happen: a sign-up is reported to Google Ads as a conversion, and the same is reported for an account that becomes fully set up. Both can carry your email address as an irreversible SHA-256 hash — never the address itself — so that Google can tell whether the account came from one of our own ads. Declining advertising consent leaves the hash out and the conversion is still counted without it.

Microsoft (Clarity) — how pages are used: cursor movement, clicks, scrolling, and a replay of the visit. It runs on this site and on the dashboard, and only if you consent. You should know what that means on the dashboard: a replay of that screen contains the figures shown on it, including your ad spend, revenue and product names. We turned it on to find usability problems without having to ask people to describe them; if you would rather it did not, decline the banner and it never loads.

Stripe — payments. Checkout, the billing portal and every payment page are hosted by Stripe: card details are entered there and never reach Opteno, and we hold only the payment method identifier, the card brand, the last four digits and the expiry date.

Slack — only if you connect it, and only to deliver the automation notifications you ask for.

jsDelivr — one page only. The public API documentation page loads its documentation viewer from jsDelivr’s CDN, so opening that page tells jsDelivr your IP address. Nothing about your account or your store is sent to it, and nothing else on Opteno loads anything from another origin.

Email has no third party in it at all. Opteno runs its own mail server on the same machine in France and delivers straight to your mail provider — there is no sending service in between, and no company other than your own email provider sees a message we send you. We used to name one here; we no longer use one.

Two flows leave Opteno because you told them to, and the destination is your choice rather than ours: a webhook you configure receives the automation data you point it at, and competitor research fetches public pages from the storefronts you add, identifying itself as OptenoBot and sending nothing about you.

Opteno’s database and job queue are run by us, not by a third party. There is no error-reporting vendor and no AI service anywhere in the product — not as a dependency, not as an embedded script, not as a background call. Measurement is the exception, it is named in full above, and none of it runs until you consent.

Beyond that list, your data is disclosed in only three situations, and we will tell you when we can: where a law, a court or a regulator with jurisdiction over us compels it; where it is necessary to establish, exercise or defend a legal claim, or to protect the safety of a person; and where Opteno itself is sold, merged or reorganised, in which case the acquirer takes on this policy and you are told before anything changes.

Opteno’s servers — the application, the database, the job queue and the mail server — run on a single machine rented from Contabo GmbH and located in Lauterbourg, Grand Est, France. Your data is stored and processed in the European Union. Staging runs on the same machine.

Backups are in two places, and both matter to you. Local copies are taken daily on that same machine and kept for fourteen days; they are the fast way back from an ordinary accident. Off-site copies go to Cloudflare R2 with a Western Europe location hint, encrypted on our server before they are uploaded, to an OpenPGP key whose private half has never been on that machine — the server can write a backup it cannot read back. They are the only thing that survives losing the server altogether.

The consequence is worth stating plainly, because a backup policy that is good for durability is inconvenient for erasure: after you delete something, a copy of it remains inside the local backups for up to fourteen days, and inside the off-site copies for up to about a year — daily for thirty days, then one a month for a year, with the most recent archive always kept. Those archives are restored only to recover from a failure; they are never mined, never queried and never used to bring back something you deleted. Everything restored from one is put through the same erasure again.

The company that decides all of this is in Hong Kong, so the people who administer Opteno reach those servers from outside the European Economic Area. That access is Ksel Technology Limited reading data on a machine it rents, under its own control and its own access rules — named accounts, key-based access only, and an audit trail — rather than a disclosure to anyone new. Where a transfer outside the EEA does need a safeguard of its own, the safeguard is the European Commission’s standard contractual clauses, which form part of the standard data processing terms of each provider named in section 5. We name no instrument this company has not signed.

One category does leave the EEA by design, and only with your consent: the measurement described in section 5. Google and Microsoft are United States companies and process that data on their own infrastructure, which is not in the European Union. It is the narrowest category we hold — page views, a handful of product events, a session recording, and where you consent to advertising data an irreversible hash of your email address. None of your store’s figures, none of your credentials and none of your customers’ data is ever part of it. Decline the banner and none of it is collected or transferred at all.

The tokens that let Opteno reach Shopify, Google Ads and any other provider you connect are encrypted before they are stored, with AES-256-GCM and a fresh 96-bit initialisation vector for every value. The authentication tag is stored with the ciphertext, so a tampered value fails to decrypt rather than decrypting into something plausible. Your two-factor secret is held the same way.

Those credentials are never written to logs and never shown back to you in full. Disconnecting a provider in Opteno destroys the stored credentials for it immediately — the token columns are emptied, not flagged. The data Opteno has already synced stays until you delete the store or the workspace, and the app stays installed on Shopify’s side until you remove it there; revoking Opteno’s access in Shopify or Google ends our access from their side just as completely.

Your password is stored only as a one-way hash and cannot be read back by anyone, including us. Every connection to Opteno is encrypted in transit. Sessions are opaque tokens of which only a hash is kept, so a copy of our database does not yield a working session. Two-factor authentication is available and a sensitive action — deleting an account, deleting a workspace — asks you to re-authenticate even when you are already signed in.

Access to the servers is limited to the people who administer Opteno, by named account and key, and what they do inside a workspace is written to the same audit log you can read. No security is perfect, and we will not tell you ours is: what we can tell you is that a breach affecting your personal data is reported to the supervisory authority within 72 hours where the law requires it, and to you directly where it is likely to be a high risk to you.

Account and workspace data is kept while the account exists. Deleting your account removes it, your workspace memberships, your API keys and any authorisation you have granted a third-party app — permanently, immediately, with no recovery window. A workspace you are the only member of is deleted with you, together with its stores, products, orders, ad spend, billing records and every metric derived from them. Deleting a store rather than a workspace is gentler: it stops syncing and hides the store, and its rows are kept until the workspace itself goes.

Two records outlive a deletion, and both are stripped of personal data when it happens. The audit log keeps that an action occurred — what was done, to what, and when — because a security trail that can be erased on request is not a security trail. The security log keeps sign-in and permission events on the same terms. At the moment you delete your account, the personal columns in those rows are emptied: the email addresses and names recorded as labels, the before-and-after values, the IP addresses, the browser user agents and the free-form details. What remains is the event itself, and an opaque identifier pointing at a row that no longer exists.

Independently of any deletion, an hourly job empties the IP address and the browser user agent from both logs once a row is more than 400 days old. The event record is not deleted — those columns in it are emptied. Four hundred days is a year plus a five-week margin: long enough for a year-on-year investigation and an annual security review, and no longer. Be clear about what this job does not do: it does not remove the email address of whoever performed an action, or the before-and-after values of what they changed. Age alone is not a reason to forget who did something. Erasing the account is what clears those.

Billing and tax records are the one case where the law, not us, sets the period, and it overrides a deletion request. Once money has actually moved, the invoice and the accounting record behind it are kept for seven years from the end of the financial year the transaction falls in, which is what section 51C of Hong Kong’s Inland Revenue Ordinance and section 373 of the Companies Ordinance require of a Hong Kong company. That record is the transaction — who was billed, for what, how much and when — and nothing else about you rides along with it. Where nothing has been charged, there is no invoice, and deleting a workspace destroys its billing rows with everything else; all that survives is a record that a payment provider sent us an event, carrying provider identifiers and a status and no personal data.

Correspondence you send us is kept in the mailbox until it is deleted by hand, and we clear resolved threads periodically rather than keeping them forever. Backups age out on the schedule in section 6.

Access and portability. Settings → Account → Your data gives you a JSON file, downloaded there and then in your browser rather than emailed or left on a server. It contains your account, the workspaces you belong to, the stores you can reach, your API key details without their secrets, and your saved preferences. It deliberately excludes credentials — they are stored one way and cannot be read back — and your workspace’s business data, which comes from Shopify and Google Ads and is exported at source, where it is complete and authoritative. A very large account (over 200 memberships, 1,000 stores or 500 API keys) is refused rather than truncated, and you have to write to us; there is no automated route for that case yet.

One limit on erasure, stated because you should not have to infer it: where a sign-up or an account setup has already been reported to Google Ads as a conversion, that report is in Google’s records and we cannot withdraw it. Deleting your account removes our copy — the campaign you arrived from, the hash we sent, the consent you gave — and nothing further is ever sent. You can also opt out of Google Analytics across every site with Google’s own browser add-on, which works whatever we do.

Erasure. The same page deletes your account. It asks for your password, a re-authentication within the last five minutes and your email address typed back, because there is no undo and no grace period — the deletion happens the moment you confirm it. If you are the only owner of a workspace other people still belong to, the request is refused and each such workspace is named: that workspace holds their data as well as yours, so you transfer ownership or remove the other members first. Deleting a workspace on its own is a separate action, asks for its name typed back and a recent re-authentication, and leaves everyone’s accounts intact.

Rectification. Your name is editable on the same page, and your role and store access are changed by you or by a workspace administrator in Settings. Your email address is not editable, by you or by anyone else — there is no mechanism anywhere in Opteno that changes the address on an account, so putting a different address on the same account means writing to us or starting a new one. We would rather tell you that than leave you hunting for a button.

Objection and restriction. You can object to the processing we do on the legitimate-interest basis, and ask us to restrict processing while a dispute about accuracy or grounds is worked out. Neither is a button in the product — there is no self-service flow for them — so both are handled by writing to us, and we will tell you what we can and cannot do about the security logs in particular, since a trail that can be switched off on request stops being a trail.

How to make a request, and how we check it is you. Write to privacy@opteno.app. A request made from inside your account is already authenticated, which is why erasure asks you to prove it again rather than asking who you are. A request by email is answered to the address on the account and not to another one; if we genuinely cannot tell that a request comes from the account holder, we will ask for one more thing that proves it and no more than that.

How long we take. We answer within one month of receiving the request, which is the period GDPR Article 12(3) sets. Where a request is genuinely complex, or where you have made several, that can be extended by up to two further months — and if we extend it we will tell you inside the first month, and why. There is no charge for a request unless it is manifestly unfounded or excessive, and we will say so rather than quietly not answering.

If you cannot complete a request yourself — you have lost access to the account, or you own a workspace others are in — our support team can carry out an erasure for you. Every staff erasure requires a written reason, which is recorded on the audit trail with it, and staff hit exactly the same refusal you would if the workspace still has other members in it.

Complaints. If you are in the EU or EEA you can complain to the data protection authority of the country you live or work in; if you are in the UK, to the Information Commissioner’s Office. In Hong Kong, where Ksel Technology Limited is registered, the regulator is the Office of the Privacy Commissioner for Personal Data. Because Opteno has no establishment in the EU, there is no single lead authority for it, and your own country’s authority is the right place to start. We would rather you wrote to us first, but nothing here requires you to.

Children. Opteno is a tool for businesses. It is not directed at children, we do not knowingly collect data from anyone under 16, and if we learn that we have, the account is deleted.

Signing in sets two cookies on the dashboard and nothing else does. One is the session cookie: opaque, readable only by the server, never by a script in your browser, and valid for twelve hours. The other carries a token that protects against a request being forged from another site; it is readable by the page, as it has to be, and on its own it grants nothing. Both are cleared when you sign out and when you delete your account.

The dashboard also remembers a few things in your own browser’s storage and nowhere else: whether the sidebar is collapsed, which columns you chose on a table and at what image size, and which store you last had selected. None of it leaves your machine, and none of it is used to track you across sites.

Everything else waits for your answer to the banner. Until you give one, nothing is written to your device beyond the two sign-in cookies above: no analytics cookie, no session-replay cookie, and no record of the campaign or advertisement you arrived from. Accepting sets cookies for Google Analytics and Microsoft Clarity, and stores the campaign you arrived from for ninety days so that a sign-up can be matched to the advertising that produced it. Declining sets none of them, and the only thing stored is your answer itself.

The cookie policy lists every cookie and every stored value by name, with its flags and its lifetime, and sets out exactly what each choice on the banner turns on.

The current version is the one on this page, and the date at the top is when it last changed. This page is part of the site’s source code and changes with it, so it cannot drift away from the product without somebody changing it on purpose.

Where a change materially reduces your rights, or materially widens what we do with your data, we email the address on your account at least thirty days before it takes effect, and it does not apply to you before then. A correction, a clarification or a change that only narrows what we do takes effect when it is published here. If you do not want to be bound by a material change, you can delete your account before it takes effect — section 9 says how, and it takes one screen.

Privacy, data protection and any request under section 9: privacy@opteno.app.

Anything else: support@opteno.app. Both reach a mailbox on Opteno’s own mail server that a person reads; there is no ticketing robot in front of either.

By post: Ksel Technology Limited, Unit B, 3/F., Kai Wan House, 146 Tung Choi Street, Mongkok, Kowloon, Hong Kong. Company registration number 76991590, business registration number 76991590-000.