Privacy Policy

Last updated: September 23, 2026

1. Introduction

Westlorn is operated by Product Command Center Inc ("Westlorn," "we," "our," "us"). This Privacy Policy describes how we collect, use, store, and protect information when you access Westlorn, including the Westlorn app for Shopify (the "Service"), whether as a registered user, a Shopify merchant connecting a store, or a visitor to our website. We designed this policy to be transparent and specific. If anything is unclear, contact us at [email protected].

2. Information We Collect

We collect the following types of information:

• Account Information: Username, email address, and encrypted password
• Usage Data: Actions performed, features accessed, credits consumed
• Third-Party Credentials: Encrypted OAuth tokens for connected platforms (such as Google Ads, Microsoft Advertising, Pinterest, Snapchat, LinkedIn, and Shopify)
• Product Data: Product information you submit for analysis, including product pages you provide by public URL
• AI Interaction Data: Prompts and responses from AI analysis sessions
• Shopify Merchant Store Data: When you connect a Shopify store to Westlorn, we access and retrieve the following data through Shopify's API with your explicit consent:
  • Product titles, descriptions, and tags
  • Product images and media assets
  • Pricing and variant information (including compare-at prices)
  • Inventory levels and availability metadata
  • Product categorization, vendor details, and collections
  • Store domain and general store configuration

This data is accessed solely to power advertising plans, ad creative generation, campaign deployment, pricing suggestions, competitive analysis, compliance auditing, and reporting features within the Service. We do not access customer, order, or financial data from your Shopify store unless a future feature requires it, at which point we will request separate, explicit consent.

3. How We Use Your Information

Your information is used to:

• Provide and improve our advertising and e-commerce services
• Generate AI-powered advertising plans, ad creatives, product analyses, and recommendations
• Create and manage advertising campaigns on connected platforms at your direction
• Enforce license quotas and credit limits
• Communicate service updates and security alerts
• Generate aggregate analytics for service improvement

4. Data Storage & Security

All data is stored in encrypted PostgreSQL databases hosted on Google Cloud Platform. Platform credentials (OAuth tokens) are encrypted using industry-standard encryption. All data transmission is protected by TLS 1.3 encryption.

5. International Data Transfers

Westlorn is based in the United States. If you access the Service from outside the United States, your information may be transferred to, stored, and processed in the United States or other jurisdictions where our service providers operate.

For users in the European Economic Area (EEA), United Kingdom, or Switzerland, we rely on the following transfer mechanisms as appropriate: the EU-U.S. Data Privacy Framework (and UK and Swiss extensions, where applicable); Standard Contractual Clauses (SCCs) approved by the European Commission; and Data Processing Addendums with each sub-processor that include appropriate safeguards.

Our primary infrastructure is hosted on Google Cloud Platform's US regions, subject to Google's Data Processing Addendum and Standard Contractual Clauses.

6. Third-Party Services & Data Processors

We integrate with the following third-party services:

• Google Analytics: We use Google Analytics to collect anonymized usage data such as pages visited, session duration, and general location. This data helps us improve our Service. Google Analytics may use cookies to track interactions. You can opt out by installing the Google Analytics Opt-out Browser Add-on.
• Google Cloud Platform: Infrastructure and AI services (Gemini). Subject to the Google Cloud Data Processing Addendum.
• OpenAI: AI analysis services (GPT). Subject to the OpenAI Data Processing Addendum.
• Anthropic (Claude): AI analysis, content generation, and optimization services. Subject to Anthropic's Data Processing terms.
• Stripe: Payment processing. Subject to the Stripe Data Processing Agreement.
• Resend: Transactional email delivery. Subject to Resend's Data Processing Addendum.
• Twilio / SendGrid: Transactional email delivery. Subject to Twilio's Data Processing Addendum.
• Microsoft 365: Email infrastructure. Subject to Microsoft's Data Processing Addendum.
• Cloudflare: DNS management, website hosting, DDoS protection, and CDN services. Subject to Cloudflare's Data Processing Addendum.
• Google Ads, Meta Ads, TikTok Ads, Microsoft Advertising, Pinterest, Snapchat, Reddit, X, LinkedIn: Advertising platform integrations, each subject to their respective data processing terms. For LinkedIn specifically: we access only advertising campaign and performance data belonging to your own LinkedIn ad accounts. We do not export, transfer, or share LinkedIn member data (profile or identity data) with any third party. LinkedIn advertising data is used solely to display reporting back to you as the authorized account owner.
• Shopify: E-commerce platform integration.

Each third-party service has its own privacy policy and data processing agreement. We only share data necessary for the integration to function. We do not sell, rent, or trade your personal information to third parties.

7. Shopify Merchant Data Handling

When you uninstall the Westlorn app from your Shopify admin:

• We immediately cease all API access to your Shopify store.
• Product data retrieved from your store is permanently deleted from our systems within 30 days of uninstallation.
• Anonymized, aggregated benchmark data (which cannot be used to identify your store or products) may be retained for platform-wide analytics.
• Any active subscription is cancelled in accordance with our Terms of Service.

You may also request immediate deletion of your merchant data at any time by contacting [email protected].

8. Lawful Basis for Processing (GDPR)

We process your personal data under the following lawful bases as defined in GDPR Article 6:

• Contract (Art. 6(1)(b)): Account management, service provision, license enforcement, and payment processing are necessary to fulfil our contract with you.
• Consent (Art. 6(1)(a)): Analytics cookies (Google Analytics) and marketing email communications are processed based on your explicit consent, which you may withdraw at any time.
• Legitimate Interest (Art. 6(1)(f)): Security measures (rate limiting, audit logging, fraud prevention) and service improvement analytics are processed under our legitimate interest in maintaining a secure and functional platform.
• Legal Obligation (Art. 6(1)(c)): Tax records, billing data, and regulatory compliance data are retained as required by applicable law.

9. Data Retention

Active account data is retained for the duration of your subscription. Analysis history (advertising plans, market analyses, bid analyses, ad strategies) is retained for 12 months and automatically purged thereafter. Upon account deletion, personal data is removed within 30 days. LinkedIn Marketing Data (advertising campaign data retrieved via the LinkedIn Marketing API) is deleted within 10 days of disconnecting your LinkedIn account or terminating your subscription, whichever occurs first, in accordance with LinkedIn Marketing API program requirements. Anonymized aggregate data may be retained indefinitely. Billing records are retained for 7 years as required by tax law.

Guest inquiries submitted via our public contact form (no account required) are retained for up to 12 months from the date of submission, solely for the purpose of responding to your inquiry. Guest inquiry data includes your name (if provided), email address, and message content. You may request deletion of your guest inquiry data at any time by contacting [email protected].

10. Data Breach Notification

In the event of a data breach that affects your personal information:

• We will notify affected users via email within 72 hours of becoming aware of the breach, consistent with GDPR Article 33 requirements.
• Where required by applicable law (including CCPA), we will also notify the relevant supervisory or regulatory authorities.
• Notification will include the nature of the breach, the categories of data affected, and the measures taken or proposed to address the breach.

11. Your Rights (GDPR)

Under GDPR, you have the right to:

• Access your personal data (Art. 15)
• Rectification of inaccurate data (Art. 16)
• Erasure of your account and data (Art. 17), available in your account settings
• Data portability: export your data in JSON format (Art. 20), available in your account settings
• Withdraw consent for data processing at any time (Art. 7(3))
• Lodge a complaint with a data protection authority (Art. 77)

To exercise any of these rights, contact us at [email protected] or use the self-service options in your account settings.

12. California Privacy Rights (CCPA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA):

• Right to Know: You may request details about the categories and specific pieces of personal information we have collected about you.
• Right to Delete: You may request deletion of your personal information, subject to certain exceptions.
• Right to Non-Discrimination: We will not discriminate against you for exercising your CCPA rights.
• Do Not Sell: We do not sell your personal information to third parties. We do not share personal information for cross-context behavioral advertising.

To submit a CCPA request, email [email protected] with "CCPA Request" in the subject line. We will verify your identity and respond within 45 days.

13. Cookies

We use essential session cookies for authentication and security. We also use Google Analytics cookies to collect anonymized usage statistics. You may disable cookies in your browser settings or opt out of Google Analytics tracking using the Google Analytics Opt-out Add-on. Disabling essential cookies may affect Service functionality.

When you first use the Westlorn app, you will be presented with a cookie consent banner that allows you to accept or decline non-essential cookies. Essential cookies (required for authentication and security) cannot be disabled. Analytics cookies (Google Analytics) are only activated after you provide consent. You may update your cookie preferences at any time through the cookie settings link in the app footer.

14. Children's Privacy

Our Service is not intended for users under 18 years of age. We do not knowingly collect personal information from children.

15. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. When we make material changes, we will notify you via email at least 14 days before the changes take effect. For Shopify merchants, material changes affecting store data handling will also be communicated through in-app notification. The "Last updated" date at the top of this page indicates when this policy was most recently revised.

16. Contact

For privacy-related questions, contact our Data Protection Officer at [email protected].

Product Command Center Inc
7901 4th Street North, Ste 300
St. Petersburg, FL 33702
United States