← Back to home

Privacy Policy

Last updated: 4 October 2026

Pareto Hub (“we”, “our”, or “us”), operated by Ratking Labs Pty Ltd, runs the paretohub.com website and the Pareto Hub application (the “Service”). This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our Service, including when you install our Shopify application, when you connect Google Ads or Google Analytics using your Google account (Google OAuth), and when you connect your Facebook ad account, Facebook Page or Instagram account using Facebook Login.

1. Information We Collect

1.1 Account Information

When you create an account we collect your first name, last name, business name, email address, and an encrypted password. If you sign up via a third-party provider we receive only the data that provider shares (typically name and email).

1.2 Store & Commerce Data

When you connect your Shopify store we access data permitted by the scopes you approve during installation. This typically includes:

  • Product catalogue (titles, descriptions, prices, images, inventory levels)
  • Order data (order totals, line items, dates, fulfilment status)
  • Store analytics and reports

We access this data via the Shopify Admin API using an OAuth access token that you explicitly authorise. We do not access data outside the scopes you approve. Pareto Hub does not request the read_customers scope, so we do not read or store individual customer names, email addresses, or order histories from your Shopify store.

1.3 Advertising Platform Data

If you connect advertising accounts (Facebook Ads, Google Ads, TikTok Ads) we access campaign performance metrics such as spend, impressions, clicks, conversions, and ROAS. We do not access or store your ad account billing information. If the platform is Google Ads, the categories of Google user data we receive through OAuth and Google’s APIs are listed in section 1.6 above.

1.3a Facebook & Instagram (Meta) Data

You can connect Meta accounts in two places, and we receive only what you approve on Meta’s consent screen:

  • Facebook Ads: for the ad accounts you select, we read campaigns, ad sets, ads, ad creatives and performance insights (spend, impressions, clicks, results) to show your reporting and recommendations. When you approve a recommendation, we change that ad set’s targeting on your behalf. We do not read billing details.
  • Social publishing (Facebook Pages & Instagram): for the Page you select, we receive its id, name and a Page access token, and the id and username of the Instagram professional account linked to it. We use them only to publish the posts you write and schedule in Pareto Hub, at the time you choose. We do not read your Page’s or Instagram account’s followers, messages, comments or other people’s data.

Meta access tokens are stored as confidential credentials and used only by our servers. Disconnecting a Page, Instagram account or ad account in Pareto Hub deletes its stored token immediately. You can also remove Pareto Hub’s access at any time in your Facebook settings, or ask us to delete your Meta data as described on our data deletion page.

1.4 Uploaded Content

You may upload brand guidelines (PDF), reference images, and ad screenshots. These are stored securely and used solely to generate creative content on your behalf.

1.5 Automatically Collected Data

We collect standard log data including IP address, browser type, operating system, referring URL, pages visited, and timestamps. We use cookies and similar technologies for authentication and analytics.

1.6 Google account connections (Google user data)

If you connect Google Ads or Google Analytics 4, you sign in with Google OAuth and approve the scopes shown on Google’s consent screen (currently the Google Ads API scope for Ads, and read-only Analytics scope for GA4). That process is the way we access Google user data for those features.

Google user data we collect through that connection includes:

  • OAuth credentials issued by Google (access tokens and refresh tokens) stored securely on our servers so we can call Google’s APIs on your behalf until you disconnect or we delete them as described below
  • Identifiers and labels for the resources you select, such as Google Ads customer IDs and human-readable account names, and Google Analytics property identifiers
  • Data returned by Google’s APIs for those resources only—for example advertising structure (campaigns, ad groups, keywords where applicable), performance metrics (such as spend, impressions, clicks, conversions), and Google’s own optimisation recommendation metadata where we retrieve it; and for Analytics, usage and conversion reporting you authorise for the connected property

We do not request access to your Gmail, Google Drive, Contacts, Photos, or other Google products beyond what Google exposes for the connected Ads and Analytics API resources. We do not use Google Sign-In for logging you into Pareto Hub; Google OAuth here is only for optional Ads and Analytics integrations.

2. How We Use Your Information

  • To provide, operate, and maintain the Service
  • To analyse your store and advertising data and generate optimisation suggestions
  • To generate AI-powered ad creatives, copy, and reports
  • To send transactional emails (welcome, password reset, scan summaries)
  • To improve the Service and develop new features
  • To detect, prevent, and address fraud, abuse, or technical issues
  • To comply with legal obligations

2.1 Use of Google user data

We use Google user data obtained through Google OAuth and Google APIs only to provide and improve the user-facing features you ask us to run (for example dashboards, scans, recommendations, and reporting for the Google Ads / Analytics accounts you connect). This complies with the obligation to limit use of Google user data to providing or improving your experience of the application.

We do not use that Google user data to:

  • Run targeted, personalised, interest-based, or retargeted advertising for us or for unrelated third parties
  • Sell Google user data, license it to data brokers, or transfer it for others’ independent marketing or ad targeting
  • Determine credit-worthiness or for lending decisions
  • Build standalone user profiles unrelated to operating the Service
  • Train, fine-tune, or improve general-purpose machine learning or AI models using Google account identifiers or other Google user data from these OAuth integrations. When you use AI creative features, third-party model providers process prompts and content you supply to return outputs; they are not given your Google OAuth tokens, and we do not use those tokens for model training.

3. Third-Party Services & Sub-processors

We share data with the following categories of third-party providers only as necessary to operate the Service:

  • Infrastructure: Railway (hosting), PostgreSQL (database), Tigris (object storage for images and videos, via Railway)
  • Network & security: Cloudflare (content delivery and protection for paretohub.com)
  • Authentication: NextAuth (session management)
  • Google (OAuth & APIs): Google hosts the sign-in and consent screens and processes API requests when you connect Google Ads or Google Analytics. Google’s use of data from those services is described in Google’s Privacy Policy. We call Google’s APIs only to deliver the integrations you enable.
  • AI providers: OpenRouter (text generation and image tagging), OpenAI (image generation), apiyi.com (video generation) — prompts, generated content, and images from your asset library that you choose to tag or edit (which can include ad creatives imported from your ad accounts) are sent to these providers; they do not receive your OAuth tokens, your raw store data, or private Google API payloads beyond what you intentionally include in a prompt
  • Email: Resend (transactional email delivery)
  • Payments (Shopify install): Shopify Managed Pricing — your subscription is billed by Shopify on your Shopify invoice and we never receive your card details
  • Payments (direct sign-up at paretohub.com only): Stripe (subscription billing) — only used for non-Shopify accounts; we do not store your credit card details

We do not sell, rent, or trade your personal information or store data to third parties for their marketing purposes. We do not sell Google user data to third parties.

Disclosure of Google user data: We share Google user data (including OAuth tokens and synced Google Ads / Analytics reporting) only with the sub-processors listed above who help us host, secure, backup, and operate the Service, and only in line with this Policy. We do not disclose Google user data to third parties for their own advertising, for resale, or for purposes other than providing or improving the Service’s functionality for you.

Requests from public authorities

If a public authority asks us for personal data, we disclose only the minimum information necessary to respond to a valid, legally binding request, and nothing beyond what the request requires.

4. Data Retention

We retain your account and store data for as long as your account is active. When you disconnect Google Ads or Google Analytics in the Service’s Integrations, we immediately delete that integration, the associated OAuth tokens, synced Google reporting we held for that connection, and related suggestions and scan logs for that platform (so Google user data from that connection is removed from our systems promptly when you disconnect).

When you delete your account or uninstall our Shopify app, we delete your data within 30 days, except where we are required to retain it by law (e.g. billing records). Anonymised, aggregated data that cannot be linked back to you may be retained for analytical purposes.

You may request deletion of your personal data (including Google-related data we still hold) by contacting us at [email protected]; we will complete verifiable requests within a reasonable time and consistent with applicable law.

5. Data Security

We implement industry-standard security measures including encryption in transit (TLS/HTTPS), encryption at rest for sensitive data (passwords are hashed with bcrypt), secure OAuth token storage (including tokens issued by Google for Ads and Analytics connections, which are treated as confidential credentials), and access controls. No method of transmission over the internet is 100% secure, and we cannot guarantee absolute security.

6. Your Rights

6.1 General Rights

Depending on your jurisdiction, you may have the right to:

  • Access the personal data we hold about you
  • Correct inaccurate data
  • Request deletion of your data
  • Object to or restrict processing
  • Data portability (receive your data in a structured format)
  • Withdraw consent at any time where processing is based on consent

To exercise any of these rights, contact us at [email protected].

6.2 GDPR (European Economic Area)

If you are in the EEA, our legal bases for processing are: performance of a contract (providing the Service), legitimate interest (improving the Service, preventing fraud), and consent (where applicable). You may lodge a complaint with your local data protection authority.

6.3 CCPA (California)

California residents have the right to know what personal information we collect, request deletion, and opt out of the sale of personal information. We do not sell personal information. To submit a request, email [email protected].

7. Shopify Data Protection

As a Shopify app, we comply with Shopify’s API Terms of Service and data protection requirements:

  • We only request the minimum Shopify API scopes needed to provide the Service
  • We implement mandatory GDPR webhooks (customer data request, customer data erasure, shop data erasure) as required by Shopify
  • When a merchant uninstalls our app, we delete their store data within 30 days
  • We do not use merchant data for purposes unrelated to providing the Service
  • Access tokens are stored securely and never exposed to the client

8. Cookies

We use essential cookies for authentication and session management. We may use analytics cookies to understand how the Service is used. You can control cookies through your browser settings, though disabling essential cookies may prevent you from using the Service.

9. Children’s Privacy

The Service is not intended for use by anyone under 16 years of age. We do not knowingly collect personal information from children. If we learn that we have collected data from a child, we will delete it promptly.

10. International Data Transfers

Your data may be transferred to and processed in countries outside your jurisdiction. We ensure appropriate safeguards are in place, including standard contractual clauses where required.

11. Changes to This Policy

We may update this Privacy Policy from time to time. If we change how we access, use, store, or share Google user data, we will update this Policy and, where required, refresh disclosures on the Service or notify you (for example by email or in-product notice) so you can review the changes before continuing to use affected features.

For other material changes we will notify you by email or by posting a notice on the Service. Your continued use of the Service after the changes take effect constitutes acceptance of the revised policy where permitted by law.

12. Contact Us

If you have questions about this Privacy Policy or our data practices, contact us at:

Pareto Hub (Ratking Labs Pty Ltd, Australia)
Email: [email protected]
Website: https://paretohub.com