Privacy Policy

Last updated: 21 August 2026

The platform's privacy policy, addressed to merchants who run a store on it. For an individual store's policy, see that store's own policy page.

1.About this policy

This policy describes what information Infinity AI Solutions ("we", "the platform") collects, how it is stored and what we do with it, in operating the platform at infinity-ai-solutions.com — a service where business owners ("merchants") create and run an online store.

Effective and last updated: 21 August 2026.

2.What this policy does not cover

Every store built on the platform has its own privacy policy, written and published by that merchant at /policies/privacy-policy on the store's own domain. If you reached this page after buying from a particular store, the policy that applies to you is that store's, not this one.

For shopper data, the merchant is the controller and we act as a processor on their behalf and on their instructions.

3.Signing in with Google

Merchant sign-up and sign-in happen exclusively through Google. We request the openid, email and profile scopes.

Google returns the account identifier (sub), email address, name and profile picture.
We persist only the email address and the account identifier, in the central store registry, to link your sign-in to your store.
The name is kept only in a signed cookie, for seven days, to display "signed in as…". The profile picture is never stored.
Authorization is requested with access_type=online, so no refresh token is issued or stored — we have no ongoing access to your Google account after sign-in.

4.Connecting a Google account for marketing channels

Separately from sign-in, a merchant may connect their Google account to link the store to Merchant Center, Google Ads and Google Analytics. This is a completely separate OAuth client, and the connection is started by the merchant from the "Marketing channels" screen in the store admin.

Here authorization is requested with access_type=offline, so a refresh token is issued and stored — that is what lets synchronization continue without asking you to sign in again each time.

The consent screen is shown with prompt=consent and include_granted_scopes=true. It may therefore list permissions previously granted to the app, beyond the four described below.

5.Which scopes we request, and exactly what we do with them

https://www.googleapis.com/auth/userinfo.email: One call to oauth2/v3/userinfo. From the response we keep only the email address — to show you which account is connected and to detect if the connection was re-linked to a different account. The "test connection" button makes the same call.
https://www.googleapis.com/auth/adwords: Two uses. Read: one call to customers:listAccessibleCustomers, which returns a list of Google Ads account IDs and nothing else, so you can pick which account the store is associated with. No campaigns, no spend and no performance data are read. Write: once you have configured a conversion action, we upload offline conversions on your behalf via customers:uploadClickConversions, so that a purchase which began with an ad click is credited to that ad. Each upload contains the Google click identifier (gclid, or its gbraid/wbraid equivalents), the order value, the currency, the time of purchase and the order number. No email address, phone number or any other personal identifier of the shopper is included in these uploads. Both uses require an approved Google Ads developer token and are skipped entirely without one.
https://www.googleapis.com/auth/content: Two uses. Read: a call to accounts/authinfo, which returns Merchant Center account IDs, so you can pick which account receives the store's product feed. Write: registering the feed URL as a data source on that account and triggering its fetch, creating a supplemental data source, and updating price, sale price and availability for products that changed, so that what Google shows does not lag behind your store. The response carries each item's status at Google, which is what the channel sync panel displays to you. All of this is your own store's data, and it is written only to the Merchant Center account you selected.
https://www.googleapis.com/auth/analytics.readonly: Read only, in three places. accountSummaries returns GA4 property IDs and display names, so you can pick the store's measurement property; properties/{id}/dataStreams returns those properties' measurement IDs (G-XXXXXXX), so you do not have to type them in by hand; and the performance screen in your own admin area calls runReport and receives aggregate figures only for the last 30 days — sessions, conversions, transactions and revenue. No user-level data is read, and no report is stored on our side.

The description above reflects the current state of the system. If we broaden the use of any scope, this document will be updated together with that change and before it goes live.

6.Where data is stored, and what is encrypted

Every store has its own database (PostgreSQL on Neon, by default in the us-east-2 region). Channel connections and selected assets are stored in that store's database only — not in a table shared across customers.
Access and refresh tokens are encrypted before being written, using AES-256-GCM (prefix enc:v1:). The encryption key exists only in the runtime environment and is never stored in the database.
The connected account's email address, and the discovered account identifiers (Google Ads, Merchant Center, GA4 properties), are stored unencrypted — so we can show you in the interface what is connected and what is selected.
Sign-in identity (email address and Google account identifier) is stored in the central store registry, not in any store database.

7.What we do not do with the data

We do not sell or rent information received from Google.
We do not transfer it to third parties, other than the infrastructure providers listed below.
We do not use it to serve advertising, for ad targeting, or for profiling.
We do not feed it to AI models. The platform uses Anthropic's API for exactly two features — translating store content and the design assistant — and neither ever receives Google tokens, the connected account's email address, or any data retrieved from Google APIs. None of this data is used to train models.
No telemetry, analytics or session-recording tools are installed.
A human reads such data only in the cases listed in the Google policy section below.

8.Compliance with the Google API Services User Data Policy (Limited Use)

Infinity AI Solutions' use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

In practice, this means:

Information received from Google APIs is used only to provide or improve user-facing features that are prominent in the app's interface.
It is not transferred to others except with your explicit consent, for security purposes, to comply with applicable law, or as part of a merger or acquisition with prior notice.
It is not used for serving advertising, ad targeting or profiling.
No human reads it, except with your explicit consent, for security purposes, to comply with applicable law, or where the data is aggregated and anonymized.

9.Retention

Access token — short-lived (about one hour), replaced on every refresh.
Refresh token — until you disconnect, or until the store is deleted.
The connected account's email address — until you disconnect.
Selected account and asset identifiers — until the store is deleted. They are kept after a disconnect as well, so that reconnecting the same account restores exactly the setup you had.
Sign-in identity in the registry — until the store is deleted.
Sign-in cookie — seven days.

10.How to disconnect

You can disconnect at any time: store admin → Marketing channels → Google → Disconnect. The action immediately deletes the access token, the refresh token and the connected account's email address from the database, and the platform stops calling Google on your behalf. Asset selections are kept so that reconnecting restores the same setup.

Disconnecting in the admin does not revoke the grant at Google. To revoke access completely, go to myaccount.google.com/permissions and remove the app's access there.

11.Deleting your data

To delete all of your data, contact us at noam.salomon@gmail.com from the email address registered on the account. Deleting a store deletes its entire database, its media files and its registry row — and with them every Google token, the connected account's email address and every stored account identifier. This is irreversible. We will action the request within 30 days.

Even after deletion on our side, revoking the grant on Google's side is done separately at myaccount.google.com/permissions.

12.Data sent to Google from stores

When a merchant selects a GA4 property and supplies a Measurement ID and API Secret, the platform sends server-side ecommerce events to Google Analytics via the Measurement Protocol. These are authenticated by the property's API Secret, not by any OAuth token — which is why they keep working after the Google account is disconnected.

What is sent: the client identifier from the _ga cookie, the session identifier, the order identifier, item details (id, name, price, quantity), the value and currency, and a consent object derived from the visitor's cookie consent.
No email address and no phone number are sent.
When consent is denied, the event is blocked before dispatch.

Separately, when a merchant has configured a Google Ads conversion action and an approved developer token exists, a purchase that originated from an ad click is reported to Google Ads as an offline conversion. That call is authenticated with the merchant's OAuth token, so it stops when the account is disconnected.

What is sent: the Google click identifier (gclid, gbraid or wbraid) captured from the landing URL, the order value, the currency, the time of purchase and the order number.
No email address, phone number, name or any other personal identifier of the shopper is sent. We do not use enhanced conversions.
Here too, an event whose consent was denied is blocked before dispatch.

Product data is not shopper data. Separately from the above, and at the merchant's choice, the store's catalogue data — product title, description, images, price and availability — is sent to their own Merchant Center account. This is the merchant's business data rather than information about visitors, and it reaches Google both through a public feed whose URL we register and through direct updates over the API.

For this data the merchant is the controller, and their store's privacy policy is the one that applies.

13.Infrastructure providers

The platform relies on the following providers, each receiving only what its role requires:

Vercel — running the application and serving traffic.
Neon — databases; a separate database per store.
Cloudflare R2 — storage for stores' media files.
Anthropic — store content translation and the design assistant. Receives no Google data whatsoever.
Resend — sending email.
Google — the services the merchant chose to connect.

14.Security

Tokens are encrypted at rest (AES-256-GCM).
All traffic is encrypted in transit with TLS.
A separate database per store, so one store cannot reach another store's data.
Session cookies are signed with HMAC-SHA256.
Rate limiting on sign-in routes and public endpoints.

We hold no security certifications and make no such claim. No system is completely secure.

15.Your rights

Under the Israeli Protection of Privacy Law, 5741-1981, you have the right to review the information we hold about you, to request its correction and to request its deletion. Contact details are at the end of this document.

16.Children

The platform is a business service, is not directed at anyone under 18, and we do not knowingly collect information from them.

17.Changes to this policy

We will update this document from time to time; the last-updated date appears at the top. We will notify the account's registered email address of any material change.

18.Contact

Infinity AI Solutions · noam.salomon@gmail.com · infinity-ai-solutions.com