Privacy Policy
Last updated: May 31, 2025
1. Introduction
OpticCPG (“we,” “our,” or “us”) operates the analytics platform available at https://app.opticcpg.com (the “Service”). This Privacy Policy explains what information we collect, how we use it, who we share it with, and the choices you have regarding your information.
By accessing or using the Service you agree to this Privacy Policy. If you do not agree, please discontinue use of the Service.
2. Information We Collect
2a. Account Information
When you register for the Service we collect your name, email address, and any other information you provide through our authentication provider (Clerk). This information is used solely to create and manage your account.
2b. E-Commerce Sales Data (Shopify)
If you connect your Shopify store via OAuth, we retrieve order-level data including order identifiers, order dates, revenue, customer identifiers (hashed), and product line-item details. We do not collect personally identifiable information about your customers (no names, addresses, or payment details are stored).
2c. Marketplace Sales Data (Amazon)
If you connect your Amazon Seller account via the Selling Partner API, or upload fulfillment reports manually, we collect order-level sales data including order identifiers, dates, revenue, quantities, and product details. No Amazon customer personal data is stored.
2d. Advertising Data (Meta Ads)
If you connect your Meta Ads account via OAuth, we access your ad account’s campaign performance data through the Meta Marketing API, including campaign names, spend, impressions, clicks, and return on ad spend (ROAS). We access this data using the following Meta permissions:
- ads_read — to read ad campaign performance metrics
- ads_management — to retrieve ad account structure and settings
- business_management — to identify and list your Business Manager assets
We do not use Meta permissions to post content, manage audiences, or take any action on your behalf beyond reading performance data for display in your dashboard. We do not share Meta advertising data with any third party, and we do not use it for ad targeting.
2e. Advertising Data (Google Ads)
If you connect your Google Ads account via OAuth, we access campaign performance data through the Google Ads API, including campaign names, spend, impressions, clicks, and conversions. Google Ads data is read-only and used solely to display performance metrics in your dashboard.
2f. Usage Data
We may collect standard server logs and usage analytics (page views, feature interactions) to improve the Service. This data is aggregated and not linked to individual identities.
3. How We Use Your Information
We use the information we collect to:
- Provide, operate, and improve the Service
- Calculate and display retention, cohort, and marketing analytics in your dashboard
- Authenticate you and maintain the security of your account
- Respond to support requests and communicate about the Service
- Comply with applicable laws and regulations
We do not sell your data, use it for advertising, or share it with third parties for their own marketing purposes.
4. How We Share Your Information
We do not sell, rent, or trade your information. We may share data only in the following limited circumstances:
- Service Providers: We use Supabase (database), Clerk (authentication), and Vercel (hosting). Each provider processes data only as necessary to deliver the Service and is contractually bound to protect your data.
- Legal Requirements: We may disclose information if required by law, subpoena, or other legal process, or to protect the rights and safety of OpticCPG or others.
- Business Transfers: In the event of a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction. We will notify you via email or prominent notice on the Service before your data is transferred under a different privacy policy.
5. Data Retention
We retain your account information for as long as your account is active. Sales and advertising data synced from connected platforms is retained until you disconnect the integration or delete your account, at which point it is permanently removed from our systems within 30 days.
You may request deletion of your data at any time by contacting us at privacy@cpgplaybook.co.
6. Data Security
We implement industry-standard safeguards including encrypted data transmission (TLS), encrypted data storage, and access controls that restrict who within our organization can view your data. OAuth tokens are stored encrypted and used only to refresh your data on your behalf.
No method of transmission or storage is 100% secure. If you believe your account has been compromised, please contact us immediately at privacy@cpgplaybook.co.
7. Third-Party Platforms
The Service integrates with third-party platforms (Shopify, Amazon, Meta, Google) via OAuth. When you connect these platforms, you are also subject to their respective privacy policies and terms of service:
You can disconnect any integration at any time from within the Service, which will revoke our access to that platform’s data.
8. Your Rights and Choices
Depending on your location, you may have the right to:
- Access the personal data we hold about you
- Correct inaccurate or incomplete data
- Delete your data and account
- Export your data in a portable format
- Withdraw consent at any time by disconnecting an integration or deleting your account
To exercise any of these rights, contact us at privacy@cpgplaybook.co. We will respond within 30 days.
9. Children’s Privacy
The Service is intended for business use and is not directed at children under the age of 13. We do not knowingly collect personal information from children. If you believe we have inadvertently collected such information, please contact us and we will delete it promptly.
10. Changes to This Policy
We may update this Privacy Policy from time to time. When we do, we will revise the “Last updated” date at the top of this page and, for material changes, notify you by email or via a notice in the Service. Your continued use of the Service after changes are posted constitutes acceptance of the updated policy.
11. Contact Us
If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us at: