Privacy Policy

Shift (“Shift”, “we”, “us”) makes software that helps small businesses understand and improve their Google Ads. This policy covers the Shift website and app (the “Service”). It explains what we collect, why, who helps us run the Service, and the choices you have.

Shift is built for businesses. The person who signs up is usually the owner or someone working for them, and they are responsible for having permission to connect the business's Google Ads account.

Account information. Your name, email address, and password when you create an account. Passwords are handled by our sign-in provider (Supabase) and stored only as a secure hash; we never see them. If you sign in with Google, we receive your name, email address, and profile picture from Google.

Business information you give us. Your business name, time zone, and currency, plus anything you add to Business details: what you sell, the work you want or don't want, service areas, locations and addresses, phone numbers, website pages, ad links and highlights, and notes. It also includes what you type to Ask Shift (our assistant) and the answers it gives, which we keep as your chat history.

Google Ads data (only with your permission). When you connect Google Ads, we receive the email address of the Google account you connect and a secure token that lets the Service read your ads data, and make changes you approve, without you signing in each time. We then copy from Google Ads: account names and IDs; campaigns, ad groups, ads, keywords, and their settings; performance numbers such as spend, clicks, impressions, and conversions; the search terms people typed before seeing your ads; results by city and by device; conversion settings; ad extras such as phone numbers and links; and the account's change history.

Search terms and location results are reports Google makes from many people's activity. Google does not tell us who the searchers are, and we don't try to find out.

Billing information. Payments are handled by Stripe. Your card details go directly to Stripe and never touch our servers. We keep your Stripe customer and subscription IDs, your plan, and whether your subscription is active.

Usage and technical information. Our providers record basic technical data when you use the Service, such as IP address, browser type, and times of requests, to run it securely. We record how the assistant performed on each request (for example how long it took and how much it cost) so we can keep quality up and costs down. Your browser also stores a few settings for the Service; see our Cookie Policy.

Messages to us. If you email or call us, we keep what you send so we can help you.

We use information to:

• Run the Service: keep your Google Ads data up to date, show reports, explain results, and draft suggested changes and campaigns.
• Make changes to your Google Ads account, but only the ones you approve in the Service.
• Answer your questions in Ask Shift and remember business details you share so later answers fit your business.
• Process payments and manage your subscription.
• Send service emails, such as confirming your sign-up. We don't send marketing emails without your consent.
• Keep the Service secure, prevent abuse, and fix problems.
• Improve the Service, for example by checking whether the assistant's answers are accurate and helpful.
• Meet legal obligations.

We don't sell your information, and we don't use it to show you or anyone else advertising.

Ask Shift and our written insights use AI models from OpenAI. To answer a question, we send OpenAI the parts of your account data, business details, and conversation needed for that answer. We use OpenAI's business API, set so that requests are not stored for later use. Under OpenAI's API terms, data sent through the API is not used to train their models.

We do not use your Google Ads data or your business information to train AI models, ours or anyone else's.

AI can make mistakes. Shift shows its work, and nothing changes in your Google Ads account unless you approve it.

Shift's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

We ask Google for these permissions:

• Google Ads (https://www.googleapis.com/auth/adwords): to read your ads account and make the changes you approve.
• Basic profile and email (openid, userinfo.email, userinfo.profile): to know which Google account is connected.

In particular, we:

• Use Google user data only to provide and improve the features you see in Shift.
• Don't transfer it to others except as needed to provide those features (for example to OpenAI to answer your question), for security, to comply with law, or as part of a merger or sale with notice to you.
• Don't use it for advertising, and don't sell it.
• Don't let people read it unless you ask us to (for example for support), it's needed for security or to comply with law, or it has been aggregated and made anonymous.
• Don't use it to train AI models.

You can disconnect Google at any time in Settings › Account (Shift revokes its access and deletes the sign-in), by emailing us, or by removing Shift's access at myaccount.google.com/permissions.

We share information only with service providers that help us run Shift, under contracts that limit how they can use it:

• Supabase: sign-in and our database.
• Google: Google sign-in and the Google Ads API.
• OpenAI: the AI behind Ask Shift and insights.
• Stripe: payments and subscriptions.
• Resend: service emails.
• Cloud hosting providers: to run our website and servers.

We may also share information if the law requires it, to protect the rights, safety, or security of our users or Shift, or as part of a merger, acquisition, or sale of assets, in which case we'll tell you before your information falls under a different policy.

We keep your information while your account is open. When you disconnect a Google Ads account (Settings › Businesses & Ads), we stop syncing it and delete the data we copied from it. When you disconnect Google, we revoke and delete the connection token. When you delete your account (Settings › Account) or ask us to, we delete your information, including the Google Ads data we copied, right away and in any case within 30 days. Backups roll over and are gone shortly after.

We keep billing records as long as tax and accounting laws require, and we may keep information longer if needed to resolve disputes or comply with law.

We protect information with encryption in transit (HTTPS), encryption of Google connection tokens at rest, access controls that keep each business's data separate, and limited staff access. No service can be perfectly secure, so we can't promise absolute security. If we learn of a breach that affects your information, we'll tell you as the law requires.

You can update your account and business details, disconnect Google Ads or Google, and delete your account yourself in Settings. You can also ask us to:

• Tell you what information we have about you and give you a copy.
• Correct information that's wrong.
• Delete your account and information.
• Disconnect Google Ads.

Email shiftteam404@gmail.com. We may need to confirm it's really you, and we'll answer within 30 days (45 days where the law allows).

California and other US states. Residents of California and other states with privacy laws have the rights to know, access, correct, and delete personal information, and to not be treated differently for using them. Shift does not sell personal information or share it for cross-context behavioral advertising, and does not use sensitive personal information to infer characteristics about you. You can use an authorized agent to make a request.

Outside the United States. Shift is run from the United States and your information is stored and processed there. If you're in the European Economic Area or the UK, we rely on our contract with you, our legitimate interest in running and improving the Service, and your consent where required; you have the right to object, to restrict processing, to data portability, and to complain to your local data protection authority.

Shift is a business tool for adults. It isn't meant for anyone under 18, and we don't knowingly collect information from children. If you think a child has given us information, contact us and we'll delete it.

We'll update this page when our practices change and change the date at the top. If a change is significant, we'll tell you by email or in the app before it takes effect.