Privacy Policy

This Privacy Policy explains how OneClick (“OneClick”, “we”, “us”, or “our”), located in Carmel, Indiana, United States, collects, uses, stores, and protects information in connection with our website at https://yesoneclick.com and our Shopify application OneClick: Google Ads Tracking (collectively, the “Service”).

1. Roles: Data Controller vs. Data Processor

• Merchant & Website Visitor Data (Data Controller): When you visit yesoneclick.com, install OneClick: Google Ads Tracking on your Shopify store, connect your Google account, or contact our support team, OneClick acts as the data controller for your merchant account and contact details.
• Storefront Shopper Data (Data Processor / Service Provider): When our Shopify App Web Pixel, Theme App Embed, or Custom Pixel processes storefront conversion events on behalf of a Shopify merchant, the merchant is the data controller (or “business” under US state privacy laws) and OneClick acts strictly as a data processor (“service provider”) processing events solely according to the merchant’s configuration and storefront consent state.

2. Information We Collect & Process

A. Shopify Merchant Account Information

When you install and use OneClick: Google Ads Tracking, we receive and store:

• Shopify Store Metadata: Your *.myshopify.com domain, primary domain, store name, currency, country code, Shopify plan tier, Shopify OAuth session tokens, and Shopify billing subscription status (we never receive or store your payment card details; all billing is processed directly by Shopify).
• Google Account & Ads Configuration: When you explicitly sign in with Google, we store your Google account email address, OAuth 2.0 access and refresh tokens, selected Google Ads Customer ID (xxx-xxx-xxxx), optional Google Merchant Center account ID, and the metadata of conversion actions created or managed through OneClick (conversion_action resource names, labels, categories, and goal settings).
• Support Communications: Messages, attachments, and diagnostic context submitted through our in-app support chat widget or sent to support@yesoneclick.com / ryan@yesoneclick.com.

B. Storefront Event & Shopper Data (Processed on Behalf of Merchants)

To measure advertising conversions for a merchant’s linked Google Ads account, OneClick processes:

• Conversion & Commerce Events: Page views, product views (shopify_{COUNTRY}_{product_id}_{variant_id}), add-to-cart events, checkout-started events, and completed purchase events (order ID for transaction deduplication, order value, currency, and line-item identifiers).
• Consent Signals (Google Consent Mode v2): Real-time consent preferences read from Shopify’s Customer Privacy API (Shopify.customerPrivacy — marketingAllowed and analyticsProcessingAllowed), mapped to ad_storage, ad_user_data, ad_personalization, and analytics_storage.
• Consent-Gated First-Party Attribution Cookies: When shopper marketing consent is granted, OneClick may read or maintain lightweight first-party attribution cookies on the merchant’s storefront domain (_gcl_aw, _gcl_gb, _gcl_gs, _gcl_au, _ocg_click, _ocg_vreg, and _ocg_cp_active) to link ad clicks (gclid, gbraid, wbraid) to completed checkouts and prevent duplicate tag firing. When marketing consent is denied, OneClick does not write attribution cookies.
• Hashed Customer Data for Google Enhanced Conversions: Where Enhanced Conversions are enabled by the merchant and permitted by shopper consent, customer identifiers provided at checkout (such as email address, phone number, name, and postal address) are normalized and one-way SHA-256 hashed before transmission to Google Ads for conversion matching.
• Non-PII Storefront Heartbeat Pings: Aggregate event-type counters and timestamps per *.myshopify.com domain (containing zero shopper PII) so merchants can verify inside Shopify Admin that their storefront tag is active.

3. Google API Services User Data Policy (“Limited Use” Disclosure)

OneClick: Google Ads Tracking’s use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Specifically:

1. Strict Scope Purpose: We request access to Google Ads (https://www.googleapis.com/auth/adwords), Google Merchant Center (https://www.googleapis.com/auth/content), and basic account identity (userinfo.email) solely to let the authorizing merchant select their Google Ads / Merchant Center accounts, create and configure conversion actions, upload first-party conversion and Enhanced Conversion adjustments to their own Google Ads account, and view conversion/campaign diagnostics inside the OneClick dashboard.
2. No Sale or Third-Party Advertising Transfer: We never sell, rent, or transfer Google user data to data brokers, ad networks, or any third party outside the merchant’s own authorized Google accounts and essential infrastructure subprocessors listed below.
3. No Generalized AI/ML Model Training: Google Workspace and Google API user data obtained through OAuth scopes is never used to train, fine-tune, or improve generalized or third-party artificial intelligence or machine learning models.
4. Revocation at Any Time: Merchants can disconnect their Google account inside OneClick (Google Account settings) at any time or revoke access directly at Google Account Permissions.

4. How We Use Information

We use merchant and service data solely to:

• Provide, operate, verify, and maintain Google Ads conversion tracking and reporting for your Shopify store;
• Detect and alert our engineering team to broken pixel configurations or revoked OAuth tokens so tracking remains reliable;
• Respond to merchant-initiated support tickets (including automated store diagnostic lookup and Google Cloud Vertex AI draft triage strictly under enterprise zero-training terms, with every response reviewed by a human operator before sending);
• Comply with legal obligations and enforce our Terms of Service.

We do not send unsolicited marketing newsletters, sell merchant contact lists, or display third-party advertisements.

5. Infrastructure Subprocessors

We rely on industry-standard infrastructure providers bound by data processing and confidentiality obligations:

Subprocessor	Purpose	Region
Shopify Inc.	App hosting integration, OAuth authentication, billing, and Web Pixel / Theme Extension runtime	United States / Global
Google LLC (Google Cloud & Google Ads)	Merchant-authorized Google Ads / Merchant Center APIs and enterprise Vertex AI support ticket triage (customer data excluded from model training under Google Cloud Data Processing Addendum)	United States
Cloudflare, Inc.	DNS, static web hosting, CDN, and per-shop R2 Custom Pixel script delivery	Global Edge / United States
Amazon Web Services, Inc. (AWS)	Application compute (us-east-1) and transactional support email delivery (Amazon SES)	United States
PlanetScale, Inc.	Managed encrypted PostgreSQL database hosting	United States
MXroute LLC	Inbound merchant support email routing	United States

6. Data Retention, GDPR / CPRA Webhooks & Deletion

• Shopify Privacy Webhooks: OneClick automatically processes Shopify’s mandatory privacy webhooks:
  • customers/data_request and customers/redact: Responds to customer data access and erasure requests on behalf of the merchant.
  • shop/redact: Permanently deletes store-specific customer records 48 hours after an app uninstallation when triggered by Shopify.
• Uninstallation & Account Deletion: When you uninstall OneClick from Shopify, recurring billing stops immediately via Shopify, storefront App Web Pixels and Theme App Embeds are deactivated by Shopify, and you may request immediate deletion of stored OAuth credentials and store metadata at any time by emailing support@yesoneclick.com.
• Support Knowledge Base Redaction: Resolved support transcripts used internally to improve troubleshooting accuracy are automatically scrubbed of email addresses, phone numbers, and store domains before indexing.

7. Security

We protect data using TLS 1.2+ encryption in transit, encrypted database storage at rest, strict HMAC-SHA256 request signing between internal microservices, DMARC/DKIM sender verification on support workflows, and least-privilege access controls.

8. Your Privacy Rights (EEA, UK, Switzerland & US States)

Depending on your jurisdiction, you have the right to request access to, correction of, export of, or deletion of personal data we control about you. Storefront shoppers seeking to exercise privacy rights regarding a specific Shopify store should contact that merchant directly (or contact us at support@yesoneclick.com and identify the store so we can forward the request to the merchant controller).

9. Updates & Contact Us

We may update this Privacy Policy periodically to reflect architectural or regulatory updates; the “Last Updated” date at the top of this page indicates the latest revision.

For privacy inquiries, data deletion requests, or questions regarding our Google API data practices, contact us at:

• Email: support@yesoneclick.com
• Developer: OneClick (OneClick: Google Ads Tracking), Carmel, Indiana, United States