Privacy Policy

1. Who we are

CommerceLift is a product data and feed management platform operated by ZeroPointOne Ventures Ltd (t/a CommerceLift), Collingwood Buildings, 38 Collingwood Street, Newcastle upon Tyne, NE1 1JF, United Kingdom ("we", "us"). We are the data controller for personal data described in this policy. Contact: hello@commercelift.uk.

2. What we collect

We collect and process:

• Account data — name, email address, role and login credentials (via Google Sign-In) for each user on your account.
• Product catalogue data — the product information you import from Shopify or upload via file (titles, descriptions, prices, images, variants, inventory), processed solely to generate your channel feeds.
• Usage data — actions taken in the app (rule changes, syncs, overrides), retained as audit logs for your account.
• Billing data — subscription and payment details, handled by our payment providers (Stripe, or Shopify Billing for App Store installs). We do not store card numbers.

Shopify stores: our integration is strictly limited to product and inventory data. We do not access or store your store's customer data, order information, or any personal data of your customers.

3. How we use your data

We use your data to provide and operate the service: generating and syncing feeds, running AI enrichment on your catalogue, providing support, sending service communications, and improving the platform. We do not sell personal data, and we do not use your catalogue data to train AI models for other customers.

4. Legal bases

Under UK GDPR we rely on: performance of a contract (operating your account and feeds), legitimate interests (service improvement, security, fraud prevention), and consent where required (e.g. marketing emails and analytics cookies, which you can withdraw at any time).

5. Sharing & sub-processors

Your data is shared only with the services needed to run the platform: cloud hosting providers (Firebase/Google Cloud), payment processors (Stripe), email delivery (Mailgun), AI providers used for attribute enrichment, and the channels you explicitly connect (e.g. Google, Meta). Each sub-processor is bound by a data processing agreement. Feed outputs you publish to channels are governed by those channels' own policies.

6. Retention

Account and catalogue data is retained while your account is active. If you cancel, we delete your catalogue data within 90 days of account closure; audit logs and billing records are kept as required by law.

7. Your rights

You have the right to access, correct, export or erase your personal data, restrict or object to processing, withdraw consent, and lodge a complaint with the ICO. Email hello@commercelift.uk to exercise any of these rights.

8. Cookies

Essential cookies support authentication, session management, security and remembering your cookie preferences. They are always enabled. On the marketing site, analytics, support and advertising are separate optional categories, all off initially. We load these optional services only after you opt in to the relevant category. Rejecting optional cookies does not start cookieless analytics or advertising measurement.

• Tag management — Google Tag Manager: loads after you accept analytics or advertising and manages tags according to those separate choices. Accepting advertising alone does not enable Google Analytics.
• Analytics — Google Analytics 4: helps us understand site usage and which campaigns bring visitors and sign-ups. UTM campaign tags are stored only with analytics consent.
• Support — Intercom: enables the support Messenger for pre-sales questions and human replies. Intercom receives the page path, your messages and contact details you choose to provide; we do not send it URL query strings or signed-in account data from the marketing site.
• Advertising — Meta: enables the browser Meta Pixel to send PageView events and a Lead event after a successful Black Friday setup form submission. We do not intentionally send form personal data, such as your name, email address or store URL, to Meta. Google Ads click IDs (gclid) are stored only with advertising consent.

When enabled, these vendors may receive browser and device identifiers, cookie identifiers, IP addresses and information about your visit. Meta may use these identifiers to associate events with a Meta account and measure advertising. Optional services are not anonymous simply because we do not intentionally send form personal data.

With the relevant consent, campaign attribution is kept for 90 days in a first-party cookie (cl_attribution). UTM tags require analytics consent; Google Ads click IDs require advertising consent. If you then create an account or submit an enquiry, permitted attribution may be saved with it so we can understand which campaigns lead to sign-ups and enquiries. Declining a category prevents its attribution from being stored and removes its existing attribution.

Your choice is remembered for 12 months in a first-party cookie (cl_consent). You can withdraw or change your consent at any time using Cookie settings here or in the footer. Withdrawing consent stops the relevant optional service from loading on subsequent visits and may reload the page to stop a service already running. It does not undo data already sent to a vendor. For more about browser cookie controls, visit allaboutcookies.org.

9. Changes

We'll notify account owners by email of material changes to this policy before they take effect.