Privacy Policy

• Google Ads data (scope https://www.googleapis.com/auth/adwords). When you connect Google Ads we read the list of Google Ads accounts your Google login can access and their names, so you can pick the one to sync. For the account you pick we then read performance data on a schedule: campaign, ad group, ad, placement and search-term metrics (cost, impressions, clicks, conversions and conversion value), the names of your conversion actions, and each ad's tracking template and final URL. Google Ads has a single API scope with no read-only variant. Safwa uses it to read, and — only if you turn on Cancelled-order sync — to correct conversions you have already cancelled. It never creates, edits, pauses or deletes campaigns, ad groups, ads, budgets, bids or audiences in your Google Ads account.
• Cancelled-order sync (optional, and off unless you turn it on). Cash-on-delivery stores cancel a large share of orders before they ship, but Google Ads has already counted those orders as sales — so its automated bidding keeps buying more of the traffic that produced them. With your permission, Safwa sends Google a conversion adjustment (a “retraction”) for orders you cancelled in Shopify, so Google stops counting a sale that did not happen. We send only the order number, the conversion action it belongs to, and the time of the correction. We never send customer details. We send nothing for orders that were delivered or are still in transit. This changes reporting and bidding signals only — it never changes your campaigns, budgets or bids. Only an account owner can turn it on, we record who turned it on and when, and you can turn it off at any time in Safwa. Note that a retraction is permanent: Google does not let it be undone, so corrections already sent stay sent.
• Basic account information (scopes openid, email, profile). When you connect Google Ads we store the email address and Google user ID of the Google account you used, so the Ad Spend settings page can show which account is connected. If you sign in to Safwa with Google, we receive your email address, name and profile picture to create and identify your Safwa login. If you sign in before we have set up your store, we also use that email address and name to fill in the founding cohort form for you.

Only to calculate and show your own analytics inside Safwa: ad spend against cash, ROAS on delivered orders, and per-order, per-product and per-campaign profit; and, from Google sign-in, your email address and name, to identify your login and to fill in the founding cohort form for you as described above. What you then save in that form is handled as set out under Founding cohort form. Google data is never used for advertising, never sold, never used to train models, and never shared with any third party. Our hosting provider (Supabase, on AWS in Singapore) stores it on our behalf and has no other access to it. Humans at Safwa read it only to support you when you ask, or to investigate a security incident.

OAuth tokens and synced Google Ads data are stored in our Supabase database in Singapore, encrypted at rest and in transit. The tokens are readable only by our server-side sync jobs, never by the browser, and are not written to logs. Synced performance data is retained while your subscription is active so historical ROAS stays available, and is deleted within 30 days of account termination or on request.

• Inside Safwa: Ad Spend → Configuration → Disconnect. Safwa immediately revokes its token with Google and deletes the stored credentials.
• At Google: myaccount.google.com → Security → "Third-party apps & services" → Safwa → Remove access. Our next scheduled sync (within 12 hours) sees the revoked grant, stops, and deletes the stored credentials.
• Either way, the spend history already in your dashboard stays until you delete your Safwa account or ask us to remove it at [email protected].

• Ad performance (permission ads_read). We read the list of ad accounts your Meta login can access and their names, so you can pick which to sync, and each account's currency. For the accounts you pick we then read daily performance on a schedule, per ad and per placement: spend, impressions, reach, frequency, clicks, link clicks, CPM, CPC, and the aggregate action counts and values Meta reports against each ad. We also read your ads' tracking parameters and destination links so spend can be matched to the orders it produced.
• Your Facebook name and user ID (granted with login). Shown on the Ad Spend settings page so you can see which account is connected, and used to recognise your account if Meta later tells us you have removed Safwa or asked for your data to be deleted.
• Your Pages (permissions pages_show_list and pages_read_engagement). An ad boosted from an existing Page post carries no link of its own — the destination lives on the post. We list your Pages and read the destination of the posts your ads promote, so boosted-post spend can be attributed like any other ad. We do not read your Page's messages, comments, followers or audience.

We receive no personal data about your shoppers from Meta: no Meta Pixel event data, no customer-level conversion events, and no Custom Audience member lists. The action figures we store are the aggregate per-ad, per-day counts Meta returns — never individual people.

Only to calculate and show your own analytics inside Safwa: ad spend against cash, ROAS on delivered orders, and per-order, per-product and per-campaign profit. Meta data is never used for advertising, never sold, never used to train models, and never shared with any third party or with other Safwa customers. Our hosting provider (Supabase, on AWS in Singapore) stores it on our behalf and has no other access to it. Humans at Safwa read it only to support you when you ask, or to investigate a security incident.

Access tokens, Page tokens and synced Meta Ads data are stored in our Supabase database in Singapore, encrypted at rest and in transit, and scoped by row-level security so one merchant's data is unreachable from another's account. The tokens are readable only by our server-side sync jobs: the database withholds those columns from the browser entirely, so they cannot be read by your own logged-in session, and they are not written to logs. Synced performance data is retained while your subscription is active so historical ROAS stays available, and is deleted within 30 days of account termination or on request.

• Inside Safwa: Ad Spend → Configuration → Disconnect. Safwa revokes its access with Meta and deletes the stored credentials. Spend stops syncing immediately; the ad history already in your dashboard stays, and you can reconnect at any time.
• At Facebook: Settings & privacy → Settings → Apps and websites → Safwa → Remove. Meta notifies Safwa, and we delete the stored credentials and stop syncing without waiting for the next scheduled run.
• Deleting the data itself: removing the app also lets you send a data deletion request from the same Facebook screen. That deletes the advertising data we received from Meta on your behalf — your ad accounts, campaigns, ad sets, ads, their daily spend and results, and the tokens — and returns a confirmation code you can check at safwa.io/data-deletion. Your own store's orders and costs belong to you and are not affected. You can also email [email protected] and we will action it by hand.