Privacy Policy

This Privacy Policy describes how Nivarion Group LLC ("we", "us", "our") collects, uses, stores, shares, protects, retains and deletes information in Nivarion Labs (the "application"), available at app.nivarionlabs.com.

Nivarion Labs is a private, internal web application. It is used only by members of our own team, with accounts created by an administrator, to run our own online stores and to monitor the performance and cost of our own advertising accounts. There is no public sign-up and the application is not offered to the general public.

This policy applies to all information processed by the application, including information received from Google APIs ("Google user data"), which is described in detail in sections 3 to 8.

To let team members sign in and use the application, we process:

• Account information: name, work email address, role and the password set by the team member (stored only as a secure hash by our authentication provider).
• Session information: a session cookie that keeps the team member signed in. We do not use advertising or tracking cookies in the application.
• Technical logs: date and time of requests, pages accessed and error messages, used to keep the application secure and working.
• Notification settings: if a team member enables alerts on their phone, the device notification token.

An administrator can connect the company's Google Ads accounts to the application using Google sign-in (OAuth). When they do, the application requests only these permissions:

• Google Ads API (https://www.googleapis.com/auth/adwords). With it, the application reads reporting data from the connected Google Ads accounts and from client accounts under a connected manager account:
  • account ID, account name, status (enabled, suspended, cancelled or closed), currency, time zone and whether it is a manager account;
  • campaign, ad group and ad IDs, names and status, and each campaign's daily budget and start date;
  • performance metrics per day and per hour: cost, impressions, clicks, conversions and conversion value.
• Basic profile (openid and https://www.googleapis.com/auth/userinfo.email): the email address and Google account ID of the person who connected the account, used only to show which Google account is connected.

The application only reads data. It never creates, changes, pauses or deletes campaigns, ads, budgets, audiences, conversion settings or any other Google Ads resource. It does not access Gmail, Google Drive, Google Contacts, Google Calendar or any other Google service, and it does not access personal information of the people who see or click the ads.

Google returns an OAuth access token and a refresh token, which the application keeps (encrypted, see section 6) so it can keep reading the reports without asking the administrator to sign in again.

Google user data is used only to provide these features to our team:

• showing the daily and hourly spend and results of each of our advertising accounts, campaigns, ad groups and ads on internal dashboards;
• calculating the profit of each of our stores by combining ad spend with the store orders;
• alerting our team when an advertising account is suspended or when the Google connection needs to be renewed;
• answering questions a team member asks the built-in assistant about our own advertising results.

We do not:

• sell Google user data or any other data;
• use Google user data to serve, target or measure advertising to anyone, or for credit or lending decisions;
• use Google user data to develop, improve or train generalized artificial intelligence or machine learning models;
• allow humans to read Google user data, except our own team members using the application, or when we have explicit consent, it is necessary for security purposes, or it is required by law.

We do not share, transfer or disclose Google user data to anyone, except:

• Vercel Inc., which hosts and runs the application, and Supabase Inc., which hosts our database and authentication. They process the data only on our behalf, to run the application.
• Anthropic PBC, our AI provider, only when a team member uses the built-in assistant: the reports needed to answer that team member's question are sent to generate the answer, and are not used to train AI models.
• When required by law, regulation or valid legal process, or to protect the security of the application and its users.
• As part of a merger, acquisition or sale of assets, with notice and under the same protections described in this policy.

• All traffic to and from the application uses HTTPS (TLS).
• Google OAuth tokens are encrypted at rest with AES-256-GCM before being stored, and are never shown in the interface or sent to the browser.
• Reporting data is stored in a managed PostgreSQL database with row-level security, so each record can only be read by the team it belongs to.
• Only signed-in team members can access the application, and each area of the application is limited to the team members who were given access to it.
• Encryption keys and service credentials are kept as protected environment secrets on the hosting provider and are not stored in the source code.

• OAuth tokens: kept while the Google Ads connection is active, and deleted as soon as the connection is removed.
• Advertising reports: kept while they are needed to calculate and review the financial results of our stores, and deleted on request (see section 8).
• Team member accounts: kept while the person is part of the team, and deleted when the account is removed by an administrator.
• Technical logs: kept for a limited period by our hosting provider and then deleted automatically.

• Disconnect inside the application: disconnecting Google Ads revokes the token with Google and deletes it from our database immediately. The application stops reading any data from that moment.
• Revoke from your Google account: access can be removed at any time at myaccount.google.com/permissions.
• Delete stored reports: to ask for the deletion of the advertising reports or any other data we hold, write to googleads@nivariongroupllc.com. We delete the data from the application database and confirm by email.

Nivarion Labs' use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

The application is an internal business tool. It is not directed to children and we do not knowingly collect information from anyone under 18.

We update this page and its "Last updated" date whenever the data we access, how we use it or the providers we share it with change. If a change affects Google user data, we update this policy before the change takes effect.

Nivarion Group LLC
Email: googleads@nivariongroupllc.com