Privacy Policy

Effective before public launch; last reviewed 16 September 2026.

What AdForge processes

AdForge is a Shopify embedded app for creating advertising creatives from merchant-selected Shopify product information. We process the shop and account/session information needed to authenticate and operate the app, selected product, variant, and image metadata, and immutable Generation snapshots that record the facts used for a requested creative. We process generated creative metadata, validation evidence, usage-reservation and provider-attempt evidence, and operational and audit records needed to operate, secure, support, and account for the service.

AdForge does not intentionally collect or store Shopify buyer/customer, order, checkout, or customer-contact data in its current product scope.

Processors and infrastructure

Generated-image requests are processed by OpenAI. Private generated assets are stored in Cloudflare R2 or another configured private S3-compatible object store. PostgreSQL is the authoritative store for AdForge business records; Redis supports recoverable queue transport and is not the authoritative source of Generation state. These providers may process data in jurisdictions outside the merchant's country.

Retention and deletion

The current retention targets are approximately 12 months for successful generation history, assets, snapshots, provider metadata, validation evidence, and audit records; approximately 30 days for failed/rejected binary assets and application logs; and approximately 90 days for failed normalized metadata. A Shopify shop-redact request immediately removes session credentials and fences work, then deletes tenant records and private generated assets through a durable retryable workflow. Minimal non-content redaction evidence is retained solely to prevent restored backups from reactivating a redacted shop. Deletion from live systems does not erase older encrypted backups, which expire under the 30-day backup-retention policy.

Your requests

For privacy questions, access requests, or deletion requests, contact admin@novastack.studio and include your Shopify shop domain and the request type. See data deletion instructions for Shopify redaction requests.

Security

AdForge uses authenticated Shopify sessions, tenant and lifecycle controls, private object storage, and access-controlled operational systems. No security measure can guarantee absolute security.