Privacy Policy

Last updated: October 31, 2026

This policy explains how Xynra ("we", "us") handles information when you visit xynra.ai, sign up for the beta, or use the Xynra app at app.xynra.ai.

What we collect

Information you give us

• Account and contact details: your name, work email, company, the same details for teammates you invite, and anything you send us by email, the signup form or a scheduled call.
• Creative materials: images and logos you upload, brand guidelines, briefs, competitor ads you add, and your comments and approvals on ad drafts. Uploads are stored privately on AWS.

Information from accounts you connect

When you connect Meta Ads, Google Ads, Shopify or Judge.me, we access data through each platform's official API, with the permissions you approve:

• Meta Ads and Google Ads: account, campaign, ad set and ad details, settings and budgets, and performance data such as spend, impressions, clicks, conversions and platform-reported revenue.
• Shopify: store details, products, variants and stock, and order-level sales data such as order totals, products, dates and refunds. For each order we also keep the landing page and campaign (UTM) tags of the visits before the purchase, from Shopify's customer journey data, so we can match orders to the ads that brought them in. About your customers, we keep only what these features need. We never store their names, and never store their email addresses, phone numbers or street addresses in readable form. When Shopify shares them, we turn the email, phone, city, state, ZIP and country into one-way SHA-256 hashes as soon as an order is read, and discard the originals. For each order we also keep the shipping state and country (for lift tests), whether it was the customer's first order with you, any discount codes used, and whether the customer opted out of the sale or sharing of their data. We don't need or store payment details.
• Judge.me (optional): product reviews, including the rating, text, date and whether the reviewer is a verified buyer. We don't store reviewers' names, email addresses, phone numbers or IP addresses. We keep a one-way hash of the reviewer's email only so we can delete their reviews if a deletion request comes in.

Public ad data

If you track competitors, we collect their ads from the public Meta Ad Library through our data provider, SearchAPI: the ad text, format, dates and a link to the ad in the library. This is public information about businesses' advertising, not data about you or your customers.

Information collected automatically

Our website uses the Google Ads tag and the Meta Pixel to measure visits and signups from our own advertising. Both set cookies or similar technologies. The app keeps your login in your browser's local storage and records basic technical logs, such as request times and errors, to keep the service secure and working.

How we use it

• To provide Xynra: reporting, AI-assisted answers to your questions, monitoring and alerts, recommendations, preparing ad drafts, and creating the ones you approve in your ad account. Nothing spends until you approve.
• To make changes you explicitly approve. Xynra never changes a campaign, publishes an ad or changes a budget on its own. When you approve a specific change, we make only that change. Some changes run on a schedule you approve once, such as a lift test that leaves a few states out of your campaigns for a set number of weeks, or a sale-week budget plan. Xynra makes only the changes in the plan you approved, shows each one in your change log, and undoes them when the plan ends or you stop it. Safeguards you turn on, such as pausing ads for a product that sold out, act only within the settings you chose.
• To communicate with you about your account, the beta and product updates. You can opt out of updates at any time.
• To keep the service secure, prevent abuse and fix problems.

We don't sell your data or share it with third parties for their own advertising or marketing. We don't use data from your connected accounts to advertise Xynra.

Sending sales to your ad accounts

If you turn on the profit signal, Xynra sends each paid order's estimated profit to your own Meta pixel (through Meta's Conversions API) and your own Google Ads account (as an offline conversion), so those platforms can optimize for profit. To match an order to the ad click that led to it, each event includes the click ID from the visit and the hashed email, phone and location described above. Only your accounts receive this data. Orders from customers who opted out of the sale or sharing of their data are never sent. You can turn the profit signal off at any time.

Post-purchase survey

If you add Xynra's "How did you hear about us?" block to your Shopify thank-you page, we store each answer with its order number. Answers are shown only to you, and are deleted with the order when Shopify sends a customer or shop deletion request.

AI processing

Some features use AI models, including AI-assisted questions, recommendation summaries and creative drafts. To produce those results, the relevant data, such as performance figures, product details, customer reviews or the brief for an ad, is sent to the AI provider listed below. We use a provider whose terms do not allow it to train its models on the data we send. AI output can be wrong, so recommendations show the data they are based on, and nothing is published or changed without your approval.

If you connect your own AI tool, such as Claude, to Xynra, that tool can read your Xynra data on your behalf, and its own terms apply to what it does with it. It can't change anything in Xynra or your ad accounts. You can disconnect it at any time in Settings.

Service providers

We use these providers to run Xynra. They process data only on our instructions and only as needed to provide their service.

We may also disclose information if required by law, or as part of a merger or acquisition, in which case this policy continues to apply to your data.

Google and Meta data

Xynra's use and transfer of information received from Google APIs follows the Google API Services User Data Policy, including the Limited Use requirements. We use Google Ads data only to provide the features you see in Xynra. We don't use it for advertising, sell it, or let people read it except with your permission, for security, or as required by law. We handle data from Meta's platform according to Meta's Platform Terms.

Storage and security

Data is stored on AWS in the United States. OAuth credentials are kept in AWS Secrets Manager, never in plaintext. Our database has no public internet endpoint. Data is encrypted in transit and at rest. Access is limited to the people who need it to operate and support Xynra.

How long we keep it

• We keep your account data and synced ad and store data while your account is active.
• When you disconnect an account, we stop collecting new data from it immediately.
• When you ask us to delete your data or close your account, we delete synced data, creative materials and drafts within 30 days. Copies in backups are removed within a further 35 days.
• If you uninstall Xynra from Shopify, Shopify asks us to delete your store's data 48 hours later, and we delete it when we receive that request: orders, products, stock, survey answers, reviews and the store connection. When Shopify asks us to delete a particular customer's data, we delete that customer's orders and survey answers.
• We may keep limited records, such as a log of approved changes, where we need them for security or legal reasons.

Deleting your data

To delete everything Xynra holds for your business, email admin@xynra.ai from your account's email address with the subject "Delete my data". We confirm within 2 business days and delete within 30 days. To stop new data immediately, disconnect each account in Settings, or remove Xynra in Meta (Settings → Business integrations), Google (myaccount.google.com → Security → Third-party connections) or Shopify (Apps → Xynra → Uninstall).

Your choices and rights

• Disconnect: revoke access from Xynra's dashboard, or from Meta, Google or Shopify. After that, Xynra can no longer access those accounts.
• Access, correction and deletion: email admin@xynra.ai to get a copy of your data, correct it or delete it. We respond within 30 days.
• Email updates: unsubscribe at any time using the link in our emails, or by emailing us.
• Advertising cookies: you can block cookies in your browser, and adjust ad personalization in your Google and Meta account settings.

Depending on where you live, you may have additional rights under laws such as the CCPA or GDPR. Contact us and we'll help you exercise them.

Children

Xynra is a business tool and is not intended for anyone under 18. We don't knowingly collect data from children.

Changes to this policy

If we make material changes, we'll update the date above and tell active users by email before the changes take effect.

Contact

Questions or requests? Email admin@xynra.ai.