Legal
Simpleflow Privacy Policy
Simpleflow (the "Service") is a product catalog optimization platform for online stores: it imports the customer's catalog (from the Shopify app or a feed URL), enriches it, generates content optimized for Google Merchant Center, ChatGPT, Meta and the customer's own product pages, and publishes it.
This policy describes how the Service, available at https://www.simpleflow.app, collects, uses, stores and protects personal data and data received from Google APIs. It is written in accordance with Regulation (EU) 2016/679 ("GDPR") and the Google API Services User Data Policy.
Summary. With your consent, Simpleflow reads the accounts and products in your Google Merchant Center, together with their status and issues, for the sole purpose of uploading your optimized products and showing you diagnostics. Access tokens are encrypted. We do not sell your data and we do not use it for advertising or to train general-purpose AI models. You can revoke access and request deletion at any time.
1. Data controller
The data controller is Ketchup Adv S.p.A., Piazza Borromeo 14, 20123 Milano Italy, VAT IT09211640967. For any privacy question, email info@ketchupadv.com.
2. Which Google data we read
When you connect your Google account to Simpleflow and grant consent on Google's consent screen, the Service accesses, through the Google Merchant API (scope https://www.googleapis.com/auth/content), only:
- Merchant Center accounts: the ID and name of the Merchant Center accounts your Google user can access, so you can choose which one to connect;
- Merchant Center products: the product data in the account (e.g. offer ID, title, description, link, images, price, availability, GTIN, brand, category and other attributes);
- Product status: the approval status of each product per destination and country (approved, disapproved, pending, expiring);
- Product issues: the errors and warnings Google reports on each product (e.g. missing attribute, invalid GTIN, non-compliant image) and their description.
To identify you when you sign in with Google we also receive the email address and name associated with your Google account (scopes openid, email, profile). We do not access Gmail, Drive, Contacts, Calendar or any other Google service.
3. What we use Google data for
We use the data listed above only to provide the Simpleflow features you see in the application:
- Uploading optimized products: we read your existing products to suggest improved titles, descriptions and attributes and, after your approval, we upload them (insert or update) to your Merchant Center account;
- Showing diagnostics: we read product status and issues to display them in the dashboard, tell you what to fix, verify the outcome of uploads and compute the "channel health" criterion of your catalog's AI Readiness Score.
Simpleflow never changes or deletes products in your account without an explicit action from you.
4. Limited Use of information received from Google APIs
Simpleflow's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
In particular:
- we only use Google data to provide and improve the user-facing Simpleflow features described above;
- we only transfer Google data to third parties when necessary to provide those features, to comply with applicable law, or as part of a merger or acquisition with appropriate safeguards;
- we do not sell Google data or any other user data;
- we do not use or transfer Google data for advertising, including retargeting and personalized or interest-based advertising;
- we do not use Google data to determine creditworthiness or for lending purposes;
- we do not use or transfer Google data to develop, improve or train generalized artificial intelligence or machine learning models;
- no human reads Google data unless you give explicit consent (e.g. for support you request), for security purposes (e.g. investigating abuse), to comply with applicable law, or for internal operations on aggregated and anonymized data.
5. Other data we process
| Data | Purpose | Legal basis |
|---|---|---|
| Simpleflow account data (name, email, company, role, hashed password) | Account creation and management, invitation-based access, support | Performance of a contract (Art. 6(1)(b) GDPR) |
| Google data described in section 2 | Features described in section 3 | Performance of a contract and your consent on Google's screen (Art. 6(1)(a)/(b)) |
| Catalog data imported through the Shopify app (products, variants, product page content) or from the feed URL, including feed access credentials (encrypted) | Import, normalization, optimization and publishing of products; writing approved content to the Shopify site | Performance of a contract (Art. 6(1)(b)) |
| Customer configuration: Brand Kit, customer questions, rules, corrections and approvals | Generating content according to the customer's guidelines; approved corrections are used as examples only for that account and never for other customers | Performance of a contract (Art. 6(1)(b)) |
| Public product information gathered from the web (brand sites, technical sheets, retailers), with source and date | Enrichment of catalog product attributes | Legitimate interest (Art. 6(1)(f)); does not concern natural persons |
| Technical logs (IP address, date/time, browser type, errors) | Security, abuse prevention, troubleshooting | Legitimate interest (Art. 6(1)(f)) |
| Emails you send us | Answering your requests | Legitimate interest / pre-contractual steps |
6. Where and how we store data
- Where: data is stored on servers operated by our cloud infrastructure provider (Railway Corporation) located in the European Union (EU). Any transfer outside the European Economic Area only takes place with the safeguards required by Art. 44 et seq. GDPR (e.g. Standard Contractual Clauses).
- Encrypted tokens: Google OAuth tokens (access and refresh tokens), as well as Shopify app tokens and feed credentials, are stored encrypted in the database using AES-256-GCM; the encryption key is stored separately from the database and is not accessible to unauthorized staff. Tokens are never shown in the interface or written to logs.
- In transit: all communication between your browser, Simpleflow and Google uses HTTPS/TLS.
- Isolation: all data is tied to the customer's account and every read and write is restricted to that account.
- Access: access to production systems is restricted to authorized staff, with strong authentication and on a least-privilege basis.
7. How long we keep data
- Google OAuth tokens: for as long as the Google connection is active. They are deleted immediately when you disconnect Google from Simpleflow, when you revoke access from your Google account (as soon as we detect it), or when your Simpleflow account is closed.
- Product, status and issue data read from Merchant Center: kept while your Merchant Center account remains connected and refreshed on each sync; deleted within 30 days of disconnection or account closure.
- Catalog data, generated content and Shopify tokens: for the duration of the relationship; Shopify tokens are deleted when the app is uninstalled, catalog data within 30 days of removing the source or closing the account.
- Simpleflow account data: for the duration of the relationship, deleted within 30 days of account closure unless the law (e.g. tax law) requires longer retention.
- Technical logs: up to 90 days.
- Backups: encrypted backups are overwritten on a rolling basis within 30 days; deleted data disappears from backups within that period.
8. Who we share data with
We do not sell or hand over data to third parties. We only share it with providers that help us run the Service, appointed as data processors under Art. 28 GDPR and contractually bound to use it only on our behalf:
- Cloud infrastructure and database (Railway Corporation): hosting of the application and data;
- Anthropic PBC (Claude API, United States): to enrich products and generate optimized copy we send only the product content needed (e.g. title, description, attributes, customer questions). We use the commercial API, whose terms provide that this content is not used to train models; the transfer outside the EU is based on Standard Contractual Clauses;
- Transactional email service: sending invitations, password resets and notifications;
- Google: the products you approve are sent to your Merchant Center account;
- Shopify: if you use the Shopify app, approved content is written to your store;
- Channels you configure (e.g. Meta, OpenAI): they read the feed links you choose to connect to their systems.
We may disclose data to authorities when required by law. The up-to-date list of processors is available on request at info@ketchupadv.com.
9. How to revoke access to Google
You can revoke Simpleflow's access to your Google account at any time in either of these ways:
- in Simpleflow, from the account's Connections section (Admins only), with Google → Disconnect: we revoke the token with Google and delete the stored tokens;
- from your Google Account at myaccount.google.com/permissions: select "Simpleflow" and choose "Remove access".
After revocation Simpleflow can no longer read or upload data in your Merchant Center. Revocation does not automatically delete products already uploaded to your Merchant Center, which remain under your control in Google.
10. How to request deletion of your data
To request deletion of your data (including all data received from Google), email info@ketchupadv.com from the email address associated with your account, with the subject "Deletion request". We will acknowledge your request and complete the deletion within 30 days, confirming it in writing. Company account administrators can also request account closure from within the application.
11. Your rights
Under Articles 15–22 GDPR you have the right of access, rectification, erasure, restriction, portability and objection, and the right to withdraw consent at any time without affecting the lawfulness of prior processing. To exercise them, email info@ketchupadv.com. You also have the right to lodge a complaint with the Italian Data Protection Authority (www.garanteprivacy.it) or the authority of your country.
Simpleflow is a business service and is not directed at children under 16.
12. Cookies
This public website does not use profiling cookies or advertising trackers. The Simpleflow application only uses strictly necessary technical cookies to keep you signed in and for security.
13. Changes and contact
We may update this policy; the last-updated date is shown at the top. If we make material changes, in particular regarding the use of Google data, we will notify you in the application or by email and, where required, ask for your consent again.
Contact: Ketchup Adv S.p.A., Piazza Borromeo 14, 20123 Milano Italy · info@ketchupadv.com