ikePulse Privacy Policy

Effective date: October 4, 2026　Last updated: October 4, 2026
Privacy inquiries: [email protected]　General support: [email protected]

1. Who we are and what this policy covers

This Privacy Policy explains how ikePulse ("we", "us") collects, uses, shares, and protects information when you use the ikePulse service, including the web application at cloud.ikepulse.com (the "Service") and the AI assistant named Iko. The legal entity operating ikePulse is identified at the end of this Policy (Section 17).

The Service is a business-to-business ("B2B") tool for operators of independent e-commerce brands. We do not sell a product to the end customers of our users' stores; we provide analysis, diagnostics, strategy, GEO (AI-search optimization), reporting, and a conversational assistant to you, the business operator.

2. Information we collect

2.1 Information you provide directly

• Account information: email address, name (optional), and password (stored only as an irreversible cryptographic hash);
• Verification data: one-time email codes for sign-up and password recovery, invalidated after use;
• Your inputs: content you enter in conversations and documents or files you upload to your private library;
• Saved business information: goals, brand materials, and preferences you choose to save — including business context you give Iko in conversation. You can view, disable, or delete these in your library/settings.

2.2 Information from sources you connect

• With your explicit OAuth authorization, we retrieve data from the data sources you choose to connect — Google Analytics, Google Search Console, Google Ads, Shopify, and Meta Ads — only within the scope you grant and only to provide your analysis and reports;
• Connections are read-only by default. Authorization credentials (access/refresh tokens) are encrypted at rest. When you disconnect a source, we stop retrieving data immediately and delete the stored credentials.

2.3 Information generated by running the Service

• Account and security/operation logs (e.g., sign-in events, key actions) for security and audit;
• Billing and credit-consumption records;
• Technical logs (e.g., error and performance data) for troubleshooting and stability;
• Payment information: payments are processed by our third-party payment processor; we do not store full card numbers and receive only the last four digits, transaction date, amount, and card type for billing and support.

3. How we use information and the legal bases we rely on

• Provide the Service — generate answers, diagnostics, scheduled reports, and suggestions, and run connected workflows;
• Generate answers, which requires transmitting the necessary conversation content to our large-language-model provider(s) (see Section 5);
• Verify accounts, recover passwords, and deliver service notifications you subscribe to (e.g., scheduled reports);
• Protect the Service — abuse prevention, anomaly detection, and security auditing;
• Maintain and improve the Service using aggregate, de-identified technical data that cannot identify you or your customers.

Where the GDPR (or equivalent) applies, we rely on these legal bases: performance of our contract with you (Art. 6(1)(b)); legal obligations (Art. 6(1)(c)); our legitimate interests (Art. 6(1)(f)) in operating, securing, and improving a B2B service; and consent (Art. 6(1)(a)) where you choose to provide it. You may withdraw consent at any time.

We do not: sell your personal information; use your data to serve or target advertising; build cross-site profiles; or use human review of your connected data except as needed for security, compliance, debugging with your permission, or at your explicit request. Your private content (conversations, uploaded documents, saved business information) never enters any shared or public model/knowledge base and is never shown to other users.

AI model training. We do not use your conversation data, uploaded documents, or saved business information to train any AI model, and our AI providers are contractually prohibited from using your data for model training. If we ever choose to use customer data for training, we will (a) update this Policy and notify you in advance, (b) operate the program on an opt-in basis only, (c) provide an opt-in control in your settings, and (d) upon withdrawal, exclude your historical data from future training datasets.

4. Data from Google, Meta, and Shopify (platform-specific terms)

4.1 Google user data — what we access, how we use it, and how it is shared. This section applies when you connect a Google data source. ikePulse's use and transfer to any other app of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

• What we access (collect): when you connect Google Analytics 4, Google Search Console, or Google Ads, ikePulse retrieves — strictly read-only, within the OAuth scopes you grant, and only for the properties/accounts you select — reporting and performance data: traffic and engagement metrics (GA4), search-query and landing-page performance (GSC), and campaign/ad-group metrics such as spend, impressions, clicks, CTR and ROAS (Google Ads). We do not access your Google profile, contacts, email content, files, or any Google data outside these reporting scopes.
• How it is used: solely to generate the analysis, diagnostics, and reports you request in the Service; Google data is never used to build advertising audience profiles and is not used for personalized or cross-context advertising.
• How it is shared: Google data is not sold and not disclosed to third parties for their own purposes; it is shared only with the sub-processors strictly required to deliver the feature (see Section 5), bound by equivalent confidentiality and limited-use obligations;
• Human review of Google data occurs only as necessary for security, compliance, or with your explicit request.

4.2 Meta. Data retrieved through Meta (e.g., advertising data) is used solely to provide your analytics and reports, is not sold, and is handled under Meta's developer data-use requirements. You can disconnect Meta and request deletion at any time (see Sections 9 and 10).

4.3 Shopify. Shopify data is accessed under the Shopify API License and Terms and used only to provide the Service to you. The Service is not embedded in the Shopify admin and does not act on your store without your approval.

5. Third-party service providers (sub-processors)

These providers process data only as necessary for the stated purpose and under appropriate data-processing terms. We do not provide your data to other third parties except as described in Section 8. We keep this list current and will notify you of material changes; if we add or change model providers, this list is updated before or at launch of the change, and conversation content is transmitted only to the provider generating your answer at the time of use.

6. International data transfers

The Service is hosted in the Singapore region and operated globally. Your information (including content sent to model providers and data sent to our hosting provider) may be processed in jurisdictions other than your own — which may have different data-protection rules. Where required:

• We use appropriate safeguards, such as the European Commission Standard Contractual Clauses (2021/914), the UK International Data Transfer Addendum, data-processing agreements, and encryption;
• You may request a copy of the relevant safeguards by contacting [email protected].

By using the Service, you acknowledge these transfers as necessary to receive the Service.

7. Cookies and local storage

• We use a strictly necessary session cookie to keep you signed in and local storage for interface preferences. We do not use advertising or cross-site tracking cookies;
• Our CDN/security provider may set limited cookies required for security (e.g., to block malicious traffic);
• You can clear cookies and local storage in your browser (this signs you out).

8. When we disclose information

We disclose information only: (a) to the service providers listed in Section 5 as necessary to deliver the Service; (b) where required by law or by a lawful request of judicial or administrative authorities; (c) to protect the rights, property, or safety of users or the public; or (d) in connection with a merger, acquisition, or asset transfer, in which case we will require the recipient to continue to apply this Policy and will notify you where required.

9. Data retention

Legal hold: We may retain data beyond the periods above where necessary to comply with a legal obligation, to establish or defend legal claims, or to respond to a regulatory inquiry or preservation order, and only for the period the legal requirement lasts.

10. Data deletion and account cancellation

• You can delete at any time, in-product: individual or all conversations, private documents, saved preferences/memories, and data-source connections;
• Deleted content is removed from production systems promptly and clears from encrypted backups within the backup window (~30 days);
• To cancel your account, contact [email protected]. We will confirm and delete your account information and private content within approximately 30 days, except financial records we are legally required to retain;
• Data deletion requests (including Meta users): email [email protected] with the account/email and we will action the request per applicable law.

11. Your privacy rights

• If you are in the EEA/UK (GDPR/UK GDPR), you may: access, correct, or delete your personal data; restrict or object to certain processing; request data portability; withdraw consent; and lodge a complaint with a supervisory authority. You will not be penalized for exercising these rights.
• If you are a California resident (CCPA/CPRA), you may: know what personal information is collected; access and delete it; correct inaccurate data; opt out of any sale or sharing (we do not sell or share personal information for cross-context advertising); limit the use of sensitive personal information; and receive equal service and pricing if you exercise your rights. Certain information may be exempt under applicable law.
• Other regions: If you are elsewhere, contact us and we will address your request under applicable local law.

12. Roles under business data (Controller / Processor) and DPA

• For your account and registration data, ikePulse acts as a data controller;
• For personal data of your customers that you make available through connected sources, you are the controller and ikePulse acts as a processor on your documented instructions, to provide the Service. Upon request we will enter into a Data Processing Agreement (DPA) covering sub-processors, security, audits, breach notification, return/deletion, and GDPR/UK GDPR terms;
• You confirm you have a lawful basis and any necessary notices/consents for the customer data you make available.

13. Automated decision-making

Iko provides analysis and recommendations; it does not carry out decisions that produce legal or similarly significant effects on individuals by automated means. Any action that changes your store, ads, or emails requires your explicit review and authorization before execution.

14. Security

We use HTTPS/TLS in transit, encrypt credentials and sensitive data at rest, encrypt backups, and apply access controls and monitoring. No method of Internet transmission or storage is completely secure; in the event of a personal-data breach we will notify affected users and, where ikePulse is the controller, the relevant authorities within the periods required by law.

15. Children

The Service is intended for business/commercial users aged 18 or older and is not directed to individuals under 18 (or the age required in your region). We do not knowingly collect data from minors. If we learn we have collected data from a minor, we will delete it promptly.

16. Changes to this policy

We may update this policy. For material changes, we will provide advance notice in the Service or by email and update the "Last updated" date. Continued use after the effective date constitutes acceptance where permitted by law.

17. Contact

• Privacy questions / DPA / deletion requests: [email protected]
• General support: [email protected]

Operating entity: Chengdu Aike Technology Co., Ltd., Chengdu, Sichuan, China