Privacy Policy

Last updated: September 23, 2026

1. Introduction

This Privacy Policy describes how Kodac Checkout ("Kodac," "we") collects, uses, stores, and protects the information of merchants ("you") who use our SaaS platform to operate custom checkouts, calculate net profit, and integrate with payment and advertising platforms.

Kodac is a B2B platform — it is not intended for end consumers. End consumer data (customers of merchants' stores) is processed on behalf of the merchant, who is the data controller.

2. Data We Collect

2.1 Merchant Data (Kodac Account Holder)

  • Name, email, and profile photo (via Google Sign-In or manual sign-up)
  • Password (stored with bcrypt hashing)
  • Login and dashboard activity logs

2.2 Integration Data (Authorized by the Merchant)

  • Shopify: OAuth tokens, products, orders, product costs.
  • Meta (Facebook): long-lived access token, ad account ID, business ID, per-campaign spend data (impressions, clicks, cost).
  • Google Ads: refresh token, customer ID, campaign data.
  • Payment gateways (Whop, Ocean, PayPal, Shopify Payments): credentials required to process payments.

2.3 End Consumer Data (Processed on Behalf of the Merchant)

  • Name, email, phone number, shipping address
  • Order information (products, quantity, amount)
  • Attribution IDs (gclid, fbclid, fbc, fbp) used for server-side tracking of conversions (Meta CAPI, Google Ads Conversions API)

We do not store credit card data. Payments are processed directly by the authorized gateways (Whop, Ocean Payment, PayPal, Shopify Payments).

3. How We Use Your Data

  • Operate the Kodac platform (authentication, dashboard, data persistence)
  • Calculate financial metrics (net profit, ROAS, POAS, MER) and display them to the merchant
  • Sync data with Shopify, Meta Ads, and Google Ads as authorized
  • Send notifications about sync status and expiring tokens
  • Comply with legal and tax obligations

We do not sell data to third parties. We do not share data with advertisers, data brokers, or advertising networks outside the direct scope of the integrations authorized by the merchant.

4. Meta Permissions (ads_read, business_management)

When you connect your Meta Ads account to Kodac, we request the following permissions:

  • ads_read: used for three read-only calls to the Marketing API: /me/adaccounts, to list your ad accounts so you can choose which ones to connect; /act_<id>/adspixels, to identify the pixel tied to each account; and /act_<id>/insights, to retrieve cost, impressions, and clicks aggregated by campaign and by day. This data is visible only on your own Kodac dashboard.
  • business_management: used to read which Business each ad account belongs to, so your accounts can be grouped by Business in the dashboard. It is called when you connect an account and whenever you re-sync your assets.

We never write to the Marketing API. Kodac does not create, edit, pause, or delete campaigns, ad sets, or ads. Every call listed above is a read.

5. Where We Store Your Data

Supabase database (managed PostgreSQL), with encryption in transit (HTTPS/TLS 1.2+) and at rest. Servers located in the United States (AWS US-East region). Daily encrypted backups.

Access to data is restricted to Kodac engineers with 2FA authentication and audit logging.

6. Sharing with Third Parties

We share data only with essential infrastructure providers:

  • Supabase — storage and authentication
  • Vercel — hosting and CDN
  • Meta Platforms, Inc. — receives attribution IDs (fbclid, fbc, fbp) and conversion data for browser-and-server deduplication (Conversions API)
  • Google LLC — receives gclid and conversion data for Enhanced Conversions

Each of these providers operates under its own data processing agreement (DPA) and complies with the Brazilian General Data Protection Law (LGPD) and the EU General Data Protection Regulation (GDPR).

7. Your Rights (LGPD/GDPR)

You may, at any time:

  • Request access to the data we store about you
  • Request correction of inaccurate data
  • Request deletion of your account and associated data (see /data-deletion)
  • Revoke authorization for any integration (Meta, Google, Shopify) at any time — simply disconnect it in the dashboard or revoke it directly on the originating platform
  • Export your data in JSON format

To exercise any of these rights, send an email to contact@kodac.io.

8. Cookies

We use strictly functional cookies (session, JWT authentication) and preference cookies (theme, language). We do not use advertising cookies in the admin dashboard.

The custom checkouts that run on merchants' storefronts may use additional cookies (_fbp, _fbc) controlled by the merchant themselves for tracking purposes.

9. Retention

We retain your data for as long as your account remains active. After account deletion, data is erased within 30 days, except for records we are required to retain for legal purposes (tax, accounting) for up to 5 years under Brazilian law.

10. Children

Kodac is intended for businesses and professionals. We do not knowingly collect data from children under the age of 13. If we identify data belonging to minors in our records, it will be removed immediately.

11. Changes to This Policy

We may update this policy periodically. Material changes will be communicated by email and/or a notice in the dashboard at least 30 days in advance.

12. Contact

Data Protection Officer (DPO): contact@kodac.io

Kodac Checkout
Website: https://app.kodac.io