Privacy Policy

Last Updated: May 22, 2026

Trellis is a product of Trellis Ads LLC, a Utah limited liability company. This Privacy Policy describes how we collect, use, store, and protect your information when you use the Trellis advertising analytics platform at trellisads.com.

1. Introduction

Trellis is an advertising audit and analytics platform for e-commerce businesses. We connect to your advertising platforms (Google Ads, Microsoft Advertising, Meta Ads) and e-commerce platforms (Shopify) to generate performance reports and optimization recommendations.

This policy applies to all users of trellisads.com, our APIs, and related services. By creating an account, you agree to these practices.

2. Information We Collect

a. Account Information

When you create a Trellis account, we collect:

• Email address
• Full name
• Company name
• Password (stored as a salted, one-way hash — never in plaintext)

b. Business Profile Data

To calibrate our analysis, we collect business targets you provide:

• Target CPA (cost per acquisition) and ROAS (return on ad spend) goals
• Campaign objectives and strategy preferences
• Profit margins and cost of goods sold (COGS)
• Average order value (AOV)

This data is entered by you and used exclusively to calibrate our analysis to your business goals.

c. Platform Credentials

When you connect your advertising or e-commerce accounts, we store:

• OAuth2 access and refresh tokens
• Service account keys (where applicable)

All credentials are encrypted at rest using industry-standard symmetric encryption and decrypted only at the moment of use for API calls on your behalf.

d. Advertising Platform Data

Once connected, we pull the following data from your advertising accounts:

• Campaign structure (campaigns, ad groups, ads)
• Performance metrics (impressions, clicks, conversions, cost, revenue)
• Keywords and search terms
• Quality Scores and ad relevance metrics
• Bid strategies and budget configurations
• Ad copy and asset details

e. Order & Revenue Data

If you connect your Shopify store, we access:

• Order totals and subtotals
• Cost of goods sold (COGS) per product
• Hashed customer email addresses (for attribution matching only — SHA-256 one-way hashing)
• UTM parameters for order attribution

We never store raw customer email addresses, only irreversible hashes used solely to match ad conversions to orders.

f. Usage Data

We collect standard usage data to maintain and improve the service:

• API access logs (endpoint, timestamp, response status)
• Feature usage patterns (which reports you generate, which pages you visit)
• Audit history (when audits were run and their configuration)
• Page views and session data via Google Analytics (GA4)

g. Communications

We retain records of transactional emails we send you, including:

• Audit completion notifications
• Credential expiration warnings
• Account security alerts
• Billing and payment confirmations

3. How We Use Your Information

We use your information to:

• Provide audit and analytics services across your connected platforms.
• Generate audit reports using artificial intelligence to produce detailed, contextual recommendations.
• Monitor credential health and alert you to expiring tokens or authorization issues.
• Send transactional notifications about audits, credentials, and important account events.
• Understand product usage so we can improve Trellis (via Google Analytics GA4).
• Process payments through Stripe using your provided payment method.

We do not use your information to:

• Sell, rent, or share your personal information with third parties for their advertising purposes
• Use data stored within our platform to build advertising profiles or target you with ads
• Build behavioral profiles beyond what is needed to provide our service
• Make credit, insurance, or employment decisions
• Train AI models on your business data

We may use cookies and similar technologies on our marketing website to measure advertising effectiveness and reach prospective customers through platforms such as Google and LinkedIn. These activities do not involve data you store within the Trellis product.

De-Identified and Aggregate Data

We may create de-identified, aggregated data derived from your use of the Service. This data does not identify you or any individual end user. We may use aggregate data for any lawful business purpose, including product improvement, benchmarking, and research. Aggregate data is not subject to deletion or portability obligations under this policy.

4. Google API Services User Data Disclosure

As required by Google's API Services User Data Policy, this section addresses our use of Google API data.

Scope requested: https://www.googleapis.com/auth/adwords

Data accessed from Google Ads:

• Campaign structure and hierarchy
• Performance metrics (clicks, impressions, conversions, cost)
• Bid strategies and budget settings
• Keyword reports and Quality Scores
• Ad group structure and ad copy

How this data is used: Trellis accesses your Google Ads data in a read-only capacity for the sole purpose of generating audit reports and performance analysis. Trellis does not make changes to your Google Ads account: no bid adjustments, no budget changes, no campaign modifications, no keyword additions or removals.

Storage: Google Ads data is encrypted at rest and stored in PostgreSQL on DigitalOcean infrastructure.

Sharing: Your Google Ads data is never shared with, sold to, or transferred to any third party. The only exception is that aggregated campaign metrics are sent to our AI sub-processors for analysis (see Section 7).

Human access: Access is limited to authorized personnel for support, debugging, and security investigations under appropriate safeguards. Trellis processes Google user data as a data processor on behalf of the account owner.

Limited Use Disclosure:

Trellis's use and transfer of information received from Google APIs to any other app will adhere to Google API Services User Data Policy, including the Limited Use requirements.

5. Microsoft Advertising Data Disclosure

Scope requested: msads.manage

Data accessed from Microsoft Advertising:

• Campaign structure and hierarchy
• Performance metrics (clicks, impressions, conversions, cost)
• Bid strategies and budget settings
• Keyword reports and Quality Scores
• Ad group structure and ad copy

How this data is used: Trellis accesses your Microsoft Advertising data in a read-only capacity for audit reports and performance analysis. Trellis does not make changes to your Microsoft Advertising account.

Storage, sharing, and human access: The commitments described in Section 4 for Google Ads data apply equally to your Microsoft Advertising data.

5.5 Meta Advertising Data Disclosure

Scopes requested: ads_read, business_management

Data accessed from Meta:

• Ad account structure (campaigns, ad sets, ads)
• Performance metrics (impressions, clicks, conversions, cost, reach, frequency)
• Targeting summaries and audience metadata
• Creative assets and ad copy
• Business asset metadata for the ad accounts you authorize

How this data is used: Trellis accesses your Meta Ads data in a read-only capacity for generating audit reports and performance analysis. Trellis does not create, edit, pause, or delete campaigns, ad sets, ads, audiences, pixels, or any other asset in your Meta Ads account.

Storage, sharing, and human access: The commitments described in Section 4 apply equally to your Meta Advertising data.

Data deletion callback: Meta requires apps to support user-initiated data deletion. Requests received at our deletion callback endpoint are honored within the timeframes Meta specifies. You may also initiate deletion via the methods in Section 12.

6. Shopify Data Disclosure

Scopes requested: read_orders, read_products, read_inventory

Data accessed from Shopify:

• Order totals, subtotals, line items, currency, and timestamps
• Product catalog (titles, SKUs, variants)
• Inventory unitCost per variant (for COGS-adjusted profitability analysis)
• Customer email addresses, used only after SHA-256 one-way hashing for attribution matching against advertising platform conversions
• UTM parameters attached to orders

How this data is used: Trellis accesses your Shopify data in a read-only capacity to (a) reconcile advertising platform conversions against real orders, (b) calculate COGS-adjusted ROAS and profitability, and (c) generate audit recommendations grounded in actual revenue. Trellis does not write to, modify, or delete any data in your Shopify store.

Raw customer email addresses are never stored. Only the SHA-256 hash is persisted, and only for the purpose of matching ad conversions to orders.

Storage, sharing, and human access: The commitments described in Section 4 apply equally to your Shopify data.

Shopify GDPR webhooks: When you connect your Shopify store, we honor Shopify's mandatory data-request and data-deletion webhooks within the timelines Shopify specifies:

• customers/data_request — we respond with all data we hold tied to the requested customer identifier.
• customers/redact — we delete (or irrevocably anonymize) customer-keyed data on receipt.
• shop/redact — on app uninstall, we delete all shop-keyed data.

The current Shopify-specified response window for customers/data_request and customers/redact is 30 days; the shop/redact purge follows app uninstall.

7. AI Processing Disclosure

Trellis uses third-party artificial intelligence services to analyze your advertising data and generate audit reports. Our current AI sub-processors are Anthropic, OpenAI, and Google, accessed exclusively via their paid commercial API tiers.

• What is sent: Aggregated campaign metrics — click counts, conversion rates, costs, Quality Scores, keyword statistics, and bid strategy configurations.
• What is NOT sent: No personally identifiable information. We do not send customer names, email addresses, phone numbers, or any data that could identify your end customers.
• Provider data policies: The commercial API tiers we use do not train models on customer-submitted data.
• Nature of outputs: Audit reports are informational and analytical. They do not constitute financial, legal, or professional advice. Recommendations should be evaluated in the context of your business before implementation.

8. Sub-Processors

We engage the following sub-processors to deliver Trellis. Each is bound by contractual obligations to protect your data and receives only the minimum data necessary to perform its function.

• DigitalOcean — application hosting, PostgreSQL database, and object storage for audit PDFs
• Stripe — subscription billing and payment processing
• Anthropic — AI analysis for audit report generation
• OpenAI — AI analysis for audit report generation
• Google — AI analysis for audit report generation, and Google Analytics (GA4) for product analytics
• Mailgun — transactional email delivery
• Sentry — application error monitoring

We do not share raw advertising data, credentials, or business metrics with any party outside this list. We will update this list when we add or change a sub-processor and provide notice as described in Section 15.

9. Data Retention

We retain your data only as long as needed to provide the service:

• Account data (email, name, company, preferences): retained while your account is active; deleted upon account deletion request.
• Conversion upload data and attribution check results: typically retained for under 12 months.
• Operational logs (API access, audit runs): typically retained for under 18 months, for security and debugging.
• Audit reports: retained until you request deletion. You may delete individual reports or request bulk deletion at any time.
• Platform credentials (OAuth tokens, service account keys): deleted immediately upon platform disconnect or account deletion.
• Payment records: retained as required by applicable law.

When you delete your account, we remove associated data within a commercially reasonable period, except for records retained for legal compliance.

10. Data Security

We protect your data with the following measures:

• Encryption in transit: All data transmitted between your browser and our servers uses TLS/HTTPS. API calls to third-party platforms are also made over encrypted connections.
• Encryption at rest: Platform credentials are encrypted using industry-standard symmetric encryption with key rotation support. Database backups are encrypted.
• Rate limiting: API endpoints are subject to rate limits to prevent abuse and brute-force attacks.
• Account lockout: Brute-force login attempt protections are enabled.
• Multi-factor authentication: Available via TOTP-compatible authenticator apps.
• Admin access controls: Administrative access is restricted by IP allowlist and requires multi-factor authentication.
• Monitoring: Regular security monitoring, alerting, and audit logging for all administrative actions.
• Dependency management: We regularly update dependencies and monitor for known vulnerabilities.

Security Incident Notification

In the event of a personal data breach, we will notify affected users without undue delay and within the timeframes required by applicable law (including GDPR Article 33 where it applies), via the email address on file. If you believe your account has been compromised, contact us immediately at [email protected].

11. Cookies

a. Essential Cookies

These cookies are required for Trellis to function and cannot be disabled.

These cookies do not track you across other websites and are never shared with third parties.

b. Analytics Cookies

We use Google Analytics (GA4) to understand how users interact with Trellis so we can improve the product. IP anonymization is enabled, and analytics data is not used for targeted advertising, behavioral profiling, data sales, or cross-site tracking.

c. Advertising and Tracking Cookies

We do not use any advertising, retargeting, or social media tracking cookies on the Trellis application. We do not serve ads on Trellis, participate in advertising networks, or embed social media tracking pixels.

d. Managing Cookies

You may opt out of Google Analytics via your browser settings or the Google Analytics Opt-out Browser Add-on. We respect Do Not Track signals; when DNT is detected, analytics cookies are not set. Blocking essential cookies will prevent you from logging in to Trellis.

12. Your Rights

Depending on your jurisdiction, you have the following rights regarding your data:

All Users

• Access: Request a complete copy of all data we hold about you.
• Export: Download your audit reports, account information, and business profile data in a machine-readable format.
• Deletion: Request deletion of your account and all associated data (see Data Deletion Instructions below).
• Credential Disconnect: Revoke platform access at any time via your account settings or by revoking OAuth authorization directly in Google, Microsoft, or Meta.
• Communication Preferences: Opt out of non-essential notifications at any time. Transactional messages related to account security and credential health cannot be disabled while your account is active.

Data Deletion Instructions

You can request deletion of your Trellis account and all associated data in any of the following ways:

1. Self-service (recommended): Log in, go to Settings → Account → Delete Account. We confirm by email and then process the deletion.
2. By email: Send a deletion request from the email address on your Trellis account to [email protected]. We aim to respond within 5 business days and complete deletion within 30 days.
3. Through a connected platform: Uninstalling Trellis from Shopify triggers our shop/redact webhook handler (Section 6). Revoking our Google, Microsoft, or Meta OAuth grant invalidates our tokens and triggers the credential-deletion path in Section 9. Where a connected platform provides a data deletion callback (Meta), we honor it within the windows that platform specifies.

Utah Residents (UCPA)

Under the Utah Consumer Privacy Act, you have the right to:

• Access and obtain a copy of your personal data
• Delete personal data you have provided
• Opt out of targeted advertising and data sales

Trellis does not sell personal data and does not engage in targeted advertising, so these rights are inherently satisfied by our business model.

California Residents (CCPA/CPRA)

Under the California Consumer Privacy Act and California Privacy Rights Act, you have the right to:

• Know what personal information we collect and how it is used
• Request deletion of your personal information
• Opt out of the sale or sharing of personal information
• Non-discrimination for exercising your privacy rights

We do not sell personal information as defined by CCPA/CPRA. We do not share personal information for cross-context behavioral advertising as defined by CPRA. We do not collect "sensitive personal information" as defined by CPRA §1798.140(ae).

European Union Residents (GDPR)

If the General Data Protection Regulation applies to you, you have the rights of:

• Access, rectification, and erasure
• Data portability (receive your data in a structured, machine-readable format)
• Restriction of processing and objection to processing
• Withdrawal of consent at any time

Our lawful basis for processing is contract performance (providing the service you signed up for) and legitimate interest (product improvement and security).

To exercise any of these rights, contact us at [email protected]. We will respond within 30 days.

Data Processing Agreement

Customers subject to data protection laws that require a written data processing agreement — including GDPR Article 28 and UK GDPR — may request a Trellis Data Processing Agreement at [email protected]. Trellis serves the United States market at launch; a formal DPA is provided on request to customers in jurisdictions that require one.

13. Children's Privacy

Trellis is a business-to-business advertising analytics platform. It is not directed at individuals under 16 years of age. We do not knowingly collect personal information from children. If we become aware that we have collected data from a child under 16, we will delete that information promptly.

14. International Data Transfers

All Trellis data is stored and processed in the United States (DigitalOcean infrastructure).

Trellis acts as a data processor with respect to advertising platform data you authorize us to access, processing that data on your behalf and at your direction.

If you access Trellis from outside the United States, your data will be transferred to and processed in the United States. By using Trellis, you consent to this transfer.

Trellis is not currently certified under the EU-U.S. Data Privacy Framework. Customers in jurisdictions that require Standard Contractual Clauses or another transfer mechanism should contact us at [email protected] before connecting an account so we can put the appropriate safeguards in place.

15. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes:

• We will provide reasonable advance notice, typically 30 days, before the changes take effect.
• Notice will be delivered via email to your registered address and displayed as a banner within the Trellis application.
• Continued use of Trellis after the notice period constitutes acceptance of the updated policy.

Changes required to comply with applicable law or address security concerns may take effect immediately. Non-material changes (formatting, clarifications) may be made without notice. The date at the top always reflects the most recent revision.

16. Contact Us

If you have questions about this Privacy Policy, want to exercise your data rights, or have concerns about how your information is handled:

Trellis (Trellis Ads LLC) Utah, United States [email protected]

We aim to respond to all privacy-related inquiries within a reasonable time, typically 5 business days.