1. Who we are
Noliky (“Noliky”, “we”, “us”) is an independent software business that builds apps for Shopify stores. We are responsible for the personal information described in this policy. You can contact us about anything in it at hello@noliky.com.
This policy explains how we collect, use, share and protect information when you visit noliky.com (the “Website”) and when you use our apps for Shopify, including Noliky Ad Savings (the “Apps”). The person who installs an App and connects their accounts is called the “merchant” in this policy.
2. Information we collect on our Website
- Contact information: when you email us, we collect the details you provide, such as your name, email address and store URL.
- Analytics: we use privacy-friendly, cookie-free analytics (Cloudflare Web Analytics) to understand overall website traffic. It does not use cookies and does not track you across other websites.
The Website has no account sign-up, no forms that store your data, and no advertising trackers.
3. Information our Apps access
Our Apps only access accounts that a merchant explicitly connects, and only the data needed for the features described below.
Shopify store data
When a merchant installs an App, it accesses data from their Shopify store through Shopify’s APIs:
- Shop details: store name, domain, currency, timezone, plan, and the store’s contact email for account and billing messages.
- Products and collections: titles, handles and page addresses, used to match ads and search results to store pages.
- Orders: order ID, date, total, and how the visit that led to the order started (for example landing page, referral source, UTM tags and whether the visit came from a Google ad).
We do not collect or store customers’ names, email addresses, phone numbers, postal addresses or payment details. Noliky Ad Savings does not make any changes to your Shopify store.
Google user data (Noliky Ad Savings)
When a merchant chooses “Connect Google”, they sign in with Google and approve the access shown on Google’s consent screen. We request only:
| Google access | What we use it for |
|---|---|
Basic profile: email address (openid, email) |
To show which Google account is connected, and so the merchant can recognise and manage the connection. |
Google Ads (https://www.googleapis.com/auth/adwords) |
To read the Google Ads accounts the merchant selects: campaigns, ad groups, keywords, search terms, landing pages, costs, clicks, impressions, conversions and conversion values. Only when the merchant approves a specific change (for example pausing one keyword, adding a negative keyword, or lowering a bid), we make that change, record it, and can undo it on request. We never make changes without that approval. |
Google Search Console, read-only (https://www.googleapis.com/auth/webmasters.readonly) |
To read search performance for the property the merchant selects: search queries, pages, clicks, impressions, click-through rate and average position. We cannot change anything in Search Console. |
We use this Google data only to provide the App’s user-facing features to the merchant who connected it:
- comparing what the store pays for in Google Ads with what it already ranks for organically;
- estimating potential savings and showing them in the App’s dashboard;
- running savings tests the merchant approves, monitoring them, and alerting the merchant if sales drop;
- reports and emails about the merchant’s own results.
We do not use Google user data for advertising, to build profiles of anyone, or for any purpose unrelated to these features.
4. Google API Services: Limited Use
Noliky’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular:
- We use Google user data only to provide and improve the user-facing features of the App that the merchant can see and use.
- We transfer Google user data to others only as needed to provide those features (to the service providers listed in section 7), to comply with the law, for security, or as part of a merger or acquisition with the merchant’s notice.
- We do not use or transfer Google user data to serve advertisements, including retargeting, personalised or interest-based advertising.
- We do not sell Google user data, and we do not use it to determine creditworthiness or for lending purposes.
- Nobody at Noliky reads Google user data unless the merchant gives us permission for specific data (for example in a support request), it’s needed for security reasons such as investigating abuse, it’s required by law, or the data is aggregated and anonymised for internal operations.
- We do not use Google user data to develop, improve or train generalised or non-personalised artificial intelligence or machine learning models.
5. How we use information
- To provide the Apps’ features described above.
- To operate, secure and fix our services, for example by investigating errors.
- To understand how merchants use the App’s screens, so we can make them easier to use. This uses usage events such as which pages are opened, not Google Ads or Search Console data.
- To contact merchants about their account, alerts, reports, billing and support requests.
- To comply with legal obligations.
We do not sell personal information.
6. AI processing
Noliky Ad Savings uses an AI provider (Anthropic) to write short plain-language explanations of findings, such as why something is an opportunity and what to watch during a test. All numbers are calculated by our own code; the AI only explains them.
For each explanation we send only the minimum data needed for that single item: for example a keyword or search query, the related store page, and calculated figures such as spend, position and sales totals. We never send customer personal data, access tokens, or data from more than one store in the same request. We use the AI provider only under commercial terms that do not allow it to train its models on this data and that limit how long it keeps it. AI-written explanations can occasionally be imperfect, so the figures shown next to them are always the source of truth.
7. Service providers (sub-processors)
We use the following providers to run our services. They process data only on our instructions and only for the purpose shown.
| Provider | Purpose | Data involved |
|---|---|---|
| Cloudflare | Website hosting, security and cookie-free website analytics | Website visit data |
| Zoho | Email (hello@noliky.com) | Emails you send us |
| Railway | Hosting the Apps and their database | All App data described in section 3 |
| Anthropic | Writing plain-language explanations (see section 6) | Minimal calculated figures per item, as described in section 6 |
| Resend | Sending App emails, such as alerts, reports and test results | Merchant email address and the email’s content |
| Sentry | Error monitoring, so we can find and fix problems | Technical error details; we configure it to avoid personal data and never send access tokens |
| PostHog | Product analytics for how the App’s screens are used | Usage events and a store identifier; no Google Ads or Search Console data |
| Shopify | App platform and billing | As set out in Shopify’s own privacy policy |
| Source of the Google Ads and Search Console data the merchant connects | As set out in Google’s own privacy policy |
We will update this list, and the “Last updated” date, before adding a new provider that receives App data.
8. Data retention and deletion
- While an App is installed, we keep only the data needed to provide it, such as the performance history the App’s reports and savings tests use.
- Disconnecting Google: when a merchant disconnects Google in the App’s settings, we immediately revoke and delete our access token and stop syncing. The Google Ads and Search Console data already synced is deleted within 30 days. Merchants can also remove Noliky’s access at any time from their Google Account at myaccount.google.com/permissions.
- Uninstalling an App: we stop all syncing immediately and delete the store’s App data within 30 days, as part of the deletion process Shopify requires.
- Deletion on request: merchants can ask us to delete their data at any time by emailing hello@noliky.com.
- Emails you send us are kept for as long as needed to respond and follow up, or until you ask us to delete them.
We may keep limited records longer only where the law requires it, for example billing records.
9. Security
We protect data with encryption in transit (HTTPS) and encryption of stored access tokens (AES-256). We keep each store’s data separate from every other store’s, restrict access to production systems, and never write access tokens into logs. No system is 100% secure, but we work hard to protect your data and will notify affected merchants of a breach as the law requires.
10. Cookies
The Website does not use cookies. Inside the Apps, Shopify and the App use only the cookies and browser storage needed to sign you in and keep the App working, plus product analytics as described in section 7. We do not use advertising cookies.
11. International transfers
Our providers may process data in countries outside your own, including the United States and the European Union. Where required, we rely on appropriate safeguards such as Standard Contractual Clauses.
12. Your rights
Depending on where you live (for example under the UK GDPR, EU GDPR or US state privacy laws), you may have rights to access, correct, delete or restrict use of your personal information, to receive a copy of it, and to object or withdraw consent. To exercise these rights, email hello@noliky.com. You may also complain to your local data protection authority.
If you’re a customer of a Shopify store that uses our Apps, the store is responsible for your data; we handle the data-request and deletion notifications Shopify sends us on the store’s behalf.
13. Children
Our services are intended for businesses and are not directed at children under 16.
14. Changes
We may update this policy. We’ll change the “Last updated” date and, for significant changes, notify merchants using our Apps before the change takes effect.
15. Contact
For any questions about this policy or your personal information, email hello@noliky.com.