Privacy policy

This policy explains what personal data Firstview ("the platform") processes, why, and what your rights are. The platform is operated by LOGOS ECOM LLC, 175 SW 7th Street, STE 1517-1000, Ste R, Miami, FL 33130, United States ("we"), the data controller for your account data. Contact for privacy matters: support@firstview.io.

1. Who uses the platform

The platform is a financial tool for Shopify stores. Anyone can create an account, and installing from the Shopify App Store creates one. Some accounts are managed by an organisation: those accounts have a manager who follows their stores inside the platform, and use the extra features that come with being managed. An account that is not managed has no manager, and nobody other than the account holder and the people they invite sees its data.

2. Data we process

3. Why we process it and on what basis

• To provide the service — computing your Profit Sheet, Daily ROAS, refund and dispute analytics, and, for managed accounts, letting your manager follow them (performance of the agreement between you and us).
• Integrations — reading data from Shopify, Meta, Google, PayPal and Stripe only after you connect the account, and only with the permissions listed in section 4 (your consent, which you withdraw by disconnecting).
• Dispute defence — assembling the evidence package and, on your explicit confirmation, submitting it to the processor (performance of the agreement; legitimate interest in defending the store against chargebacks).
• Security and legal — protecting accounts, preventing abuse, keeping records we are required to keep (legitimate interest; legal obligation).

4. Integrations and the exact permissions we request

Every integration is connected by you, with your own credentials, one store at a time. We request the minimum permissions needed to read the numbers, and we never create, edit or pause anything in your accounts. The only write we ever perform is submitting dispute evidence, and only after you review it and click submit.

• Shopify — a custom app you create in your store admin, with these access scopes: read_orders, read_all_orders, read_customers, read_products, read_inventory, read_shopify_payments_payouts, read_shopify_payments_disputes, read_reports, read_returns, read_shopify_payments_dispute_evidences, write_shopify_payments_dispute_evidences, write_shopify_payments_dispute_file_uploads, write_products, write_orders, write_discounts, read_merchant_managed_fulfillment_orders, read_third_party_fulfillment_orders, read_store_credit_accounts, write_store_credit_account_transactions. Read scopes bring in orders, refunds, products, inventory, payouts and Shopify Payments disputes; the two write scopes exist only to submit the evidence of a dispute you confirmed.
• Meta Ads — authorised through Facebook Login for Business with ads_read, to read the ad accounts you choose, their campaigns and daily insights, and ads_management, used only when you press pause, reactivate or change a budget on a campaign in Daily ROAS. The app never changes your ads on its own, and you can decline the management permission in the Meta dialog — the buttons simply do not appear.
• Google Ads — authorised through Google OAuth with the https://www.googleapis.com/auth/adwords scope, used in read-only mode to list the ad accounts you have access to and to read their daily cost, click and conversion metrics. We also request openid and email to show which Google account is connected.
• Google Calendar (managers only) — managers may connect their Google account with https://www.googleapis.com/auth/calendar.events and https://www.googleapis.com/auth/calendar.events.freebusy, so the platform can create, update and delete the calendar events of the calls it schedules and check whether a time slot is free. We do not read the content of other events.
• PayPal — API credentials you create in your PayPal developer dashboard, used to read disputes (status, deadlines, reason, amount, linked order) and, only on your explicit confirmation, to send messages and evidence in a dispute.
• Stripe — a restricted API key you create in your Stripe dashboard with read access to disputes and charges. Nothing is ever written to Stripe.

5. Google API Services

Firstview's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Google Ads data is used only to display and compute your own advertising metrics on the platform, and Google Calendar data only to manage the events of the calls the platform schedules. Google user data is never used for advertising, never sold, never used to train models, and never read by humans except with your consent, for security, or as required by law.

6. Meta Platform data

Data received through Meta's Marketing API (ad accounts, campaigns and insights) is used solely to display your own advertising performance on the platform. We do not use it to build profiles, to advertise, to train models, or to share with third parties. We keep it only while your account and the connection exist. You can revoke access at any time in your Meta Business settings or by disconnecting the integration on the platform; when Meta notifies us of a removal, we delete the stored credential and the imported metrics within 30 days. See the data deletion page.

7. Your customers' data (Shopify)

We process your customers' personal data on your behalf and on your instructions, as your processor. You are the controller. There are two places where it happens, and nowhere else:

• Orders: when you use Supply chain or Customer support, the platform mirrors each order with the customer's name, email and phone, so you can chase a shipment or answer a question without leaving the page. These three fields are erased automatically 180 days after the order.
• Dispute defence: when — and only when — you build one, we read the full order file for the disputed order, including addresses and IP, to assemble the evidence you confirm before it is submitted.

It is never used for anything else, never combined across stores, never sold or shared for advertising, and never used to train models. Access to it by our staff is logged. Daily sales figures use order amounts, dates, currency, shipping country and products — never customer identities. When Shopify tells us a customer asked you to erase their data, we erase their name, email, phone and address from your store's data automatically; dispute files are kept while the dispute can still be decided against you.

8. Who we share data with

• For managed accounts: your manager and the staff of the organisation that manages the account, who see the accounts in their portfolio. An account that is not managed has no manager, and nobody else sees it.
• Service providers that host and run the platform under contract: Supabase (database, authentication, file storage), Vercel (hosting), Resend (transactional email). They process data on our instructions only.
• The services you connect (Shopify, Meta, Google, PayPal, Stripe) receive only what you explicitly submit (for example, dispute evidence).
• Authorities, when required by law.

We do not sell personal data, we do not share it with advertisers or data brokers, and we do not use it to train artificial intelligence models.

9. Retention

Account and store data are kept while the account is active and for up to 30 days after a deletion request. Integration credentials are deleted immediately when you disconnect. Data imported from an integration stays with the store until the store or the account is deleted. Server logs are kept for 30 days. Records we must keep by law (for example, billing) are kept for the legally required period.

10. Security

Integration credentials are encrypted at rest with a key held only by the server and are never sent to the browser. Access to data is enforced in the database, row by row, so that each account can only read its own stores. Traffic is encrypted in transit. Access by staff is limited to what their role needs and is logged.

11. Cookies

The platform uses only strictly necessary cookies: the session cookies that keep you signed in, and a preference for the light or dark theme. We do not use advertising or third-party analytics cookies, and we do not track you across other sites.

12. Your rights

You can ask for access to your data, correction, deletion, restriction, portability, and object to processing; you can also withdraw consent for an integration at any time by disconnecting it. If you are in the European Economic Area or the United Kingdom, these rights are granted by the GDPR and you may complain to your local supervisory authority. If you are a resident of California or another US state with a privacy law, you have the right to know, delete and correct your data and to not be discriminated against for exercising those rights; we do not sell or share personal data as those laws define it. To exercise any right, write to support@firstview.io. To delete your data, follow the data deletion instructions.

13. Children

The platform is a business tool for adults. We do not knowingly collect data from anyone under 18; if we learn we have, we delete it.

14. International transfers

We are established in the United States, and our providers may process data in the United States and in the European Economic Area. Where data of EEA or UK residents is transferred outside those areas, the transfer relies on the European Commission's standard contractual clauses, the UK addendum, or an adequacy decision.

15. Changes

We will post any change to this policy on this page and update the date above. Material changes are announced inside the platform.