Privacy Policy
How OOSA accesses, stores, and protects data on behalf of the brands and merchants who connect their advertising and e-commerce accounts to our platform.
About OOSA
OOSA ("we," "us," "our") is a marketing analytics and automation platform operated by Appaloosa Marketing LLC. We help merchants and brands connect their advertising and e-commerce accounts, pull performance data, and optimize marketing campaigns.
Our platform is accessible at oosa.ai. Questions about this policy can be directed to [email protected].
What we request from each integration
When you connect a platform to OOSA, we request only the permissions needed to provide the service described below.
| Platform | Data we access | What we store | Contains PII? |
|---|---|---|---|
| Shopify | Order totals, product counts, customer list (for ad audiences) | Aggregate sales metrics only; customer list is not stored (see Section 3) | Aggregates: No. Customer list: accessed ephemerally, never stored. |
| Amazon Advertising | Campaign metrics, ad spend, keyword performance | Performance aggregates | No |
| Amazon Seller Central | Order revenue, inventory levels, sales summaries | Aggregates | No |
| Google Ads | Campaign metrics, ad spend, conversion data | Performance aggregates | No |
| Meta Ads (Facebook/Instagram) | Campaign metrics, ad spend, audience sizes | Performance aggregates | No |
We process the minimum data required to provide each feature. We do not sell, rent, or share personal data with third parties for their own marketing purposes.
How we handle audience uploads
When a merchant uses OOSA's ad audience feature (e.g., uploading a customer list to Google Customer Match or Meta Custom Audiences), we:
- Pull customer records from the connected Shopify store via the Shopify API
- Process the data in memory only to generate the audience file
- Stream or export the file directly without writing customer records to our database
- Discard all customer data from memory immediately after the export is complete
We do not store customer names, email addresses, phone numbers, or any other personally identifiable customer information in our database at any point.
Merchants retain full control over their customers' data and are responsible for ensuring their customers have consented to the use of their data for ad targeting in accordance with applicable law.
The data we keep, and the data we don't
We store
- Encrypted API credentials and OAuth tokens for connected platform accounts (see Section 6 for encryption details)
- Aggregate advertising and sales performance metrics (spend, revenue, order counts, ROAS, etc.) — these contain no personally identifiable information
- Brand and account configuration (marketplace settings, enabled platforms, campaign preferences)
We do not store
- Customer names, email addresses, phone numbers, or other customer PII
- Individual order details (we store totals and counts only)
- Raw API responses containing personal data
How long we keep data
| Data type | Retention period | Reason |
|---|---|---|
| Ad & sales performance data | Indefinitely | Aggregate only; no PII; required for year-over-year reporting |
| OAuth credentials & API tokens | Duration of connection; wiped on disconnect or revocation | Needed to maintain active integrations |
| Customer list data | Not stored | Processed in memory and discarded after export |
| OAuth invite tokens | 7 days from creation; invalidated after first use | Short-lived by design; prevents replay |
| Shopify shop data | Deleted within 48 hours of app uninstall | Enforced via Shopify's mandatory shop/redact webhook |
We do not retain personal data longer than necessary for the stated purpose.
How we protect data
At rest: All platform API credentials, OAuth tokens, and refresh tokens are encrypted with AES-256 before being written to our database. Aggregate performance metrics (spend, revenue, ROAS) are stored without encryption as they contain no personal data.
In transit: All connections to OOSA's platform are served over TLS 1.2 or higher, enforced via Cloudflare on all endpoints. All outbound API calls to advertising and e-commerce platforms use HTTPS.
API key security: API keys issued by OOSA are processed through a one-way cryptographic hash before being stored. We never retain a raw API key after the moment it is displayed to the user. Keys can be configured to expire automatically, and any key can be revoked immediately from the account portal. All API endpoints enforce request rate limits to protect against abuse of compromised credentials.
Account security: Login attempts are rate-limited and accounts are locked after repeated failures. Sensitive account actions — such as viewing, generating, or revoking API keys — require password re-confirmation independent of the active session. That elevated access expires automatically after a short window.
Access controls: Database access is restricted to authorized internal services and personnel under least-privilege controls. Production credentials are not stored in source control. Sensitive administrative functions are only accessible to authenticated staff.
Infrastructure: All production services run as non-root processes. The platform is served behind Cloudflare, which provides DDoS mitigation, TLS termination, and origin IP shielding. Origin-to-CDN traffic uses end-to-end encryption (Full Strict mode).
Platform compliance: We adhere to the data-handling and security requirements of every platform we integrate with — the Shopify Partner Program, the Amazon Advertising and Selling Partner API terms, the Google Ads API terms, and the Meta Platform terms. Our practices align with GDPR data-subject rights and equivalent U.S. state privacy frameworks (CCPA, CPRA, and successor laws).
The mandatory webhooks we operate
For merchants who connect their Shopify store, we operate three mandatory GDPR compliance webhook endpoints:
- Customer data request (
/connect/shopify/webhooks/customers/data_request/) — We acknowledge data requests. Because we do not store customer PII, we have no customer records to report. - Customer redaction (
/connect/shopify/webhooks/customers/redact/) — We acknowledge redaction requests. No customer records are held by OOSA. - Shop redaction (
/connect/shopify/webhooks/shop/redact/) — Triggered when a merchant uninstalls our app. All sales data and credentials associated with that shop are permanently deleted within 48 hours.
All webhook requests are verified using Shopify's HMAC-SHA256 signature before processing.
How to access, correct, or delete your data
Depending on your jurisdiction, you may have the right to:
- Access the data we hold about your account
- Correct inaccurate account or configuration data
- Delete your account and all associated data
- Disconnect any platform integration at any time via your account settings or by contacting us
To exercise any of these rights, contact us at [email protected]. We will respond within 30 days.
The services we use to operate
We use the following subprocessors who may process data on our behalf:
| Subprocessor | Purpose |
|---|---|
| Cloudflare, Inc. | CDN, TLS termination, DDoS protection |
No other third-party subprocessors handle your data. Storage and processing happen on infrastructure operated directly by OOSA. We do not use third-party analytics, tracking pixels, or advertising SDKs on our platform.
How updates work
We may update this policy as our platform evolves. When we make material changes, we will update the "Last updated" date at the top of this document and notify connected merchants by email where required by law.
Continued use of the platform after changes take effect constitutes acceptance of the updated policy.
Reach us
Appaloosa Marketing LLC
Email: [email protected]
Website: https://oosa.ai · https://oosamarketing.com