Platform & App Privacy Policy

This policy explains how Cerros ("we," "us") collects, processes, stores, and deletes data through the Cerros platform and its data connectors — including the Cerros AI Connector for Shopify, the Cerros connector for Amazon Selling Partners(Seller Central and Vendor Central, via Amazon's Selling Partner API), the Cerros connector for QuickBooks Online(via Intuit's Accounting API), the Cerros Data Connector for advertising platforms such as Meta, and the Cerros connectors for Google(Google Ads, Google Merchant Center, Google Analytics, and Google Search Console, via Google's APIs). It is separate from our website privacy policy, which covers only the informational site at cerros.ai. If you connect a data source or use the Cerros platform, this policy applies.

Our role

When a brand connects a data source (such as a Shopify store) to Cerros, that brand is the data controller and Cerros acts as a data processor on the brand's behalf. We process store data only to provide the Cerros platform to that brand, under the brand's instructions. Each brand's data is kept in its own isolated database and is never combined with, or made available to, any other brand.

Data we process

• Store data from connectors. Through the Shopify connector we access and ingest store data the brand authorizes, which may include orders and transactions, products and inventory, and customer records — including personal information such as customer names, email addresses, shipping/billing addresses, and order history. Other connectors ingest the equivalent data from marketplaces, distributors, and analytics tools.
• Amazon Selling Partner data.Where a brand connects its Amazon Seller Central (3P) or Vendor Central (1P) account, we ingest the data that account authorizes through Amazon's Selling Partner API — orders, settlements and fees, inventory, catalog, sales and traffic, and Brand Analytics reports. This access is read-only: we never write to the selling account. We deliberately request no Restricted Data Tokens and land no buyer personal information— no names, no email addresses, no street addresses; city, state, and postal code only. Amazon data is reported alongside a brand's other channels at an aggregate financial and inventory level and is never blended with other sources at the transactional or customer level. It is never used to train or fine-tune AI models, and is handled under Amazon's Data Protection Policy and Acceptable Use Policy.
• Accounting data from QuickBooks Online.Where a brand connects its QuickBooks Online company, we ingest the accounting data that company authorizes through Intuit's Accounting API — the chart of accounts, customers, vendors, items, transactions, and financial statements such as the profit & loss and balance sheet. This access is read-only: we never create, edit, void, or post anything in QuickBooks, and we request the accounting scope only — no payments and no payroll data. Customer and vendor records may include business contact information the brand keeps in its books. QuickBooks data is used solely to report the brand's own financials alongside its other channels, is never blended with other brands' data, and is never used to train or fine-tune AI models.
• Advertising data from connectors. Where a brand connects an advertising platform — including Meta (Facebook and Instagram) — we read the performance data for the ad accounts that brand explicitly grants us: campaign, ad set, ad, and creative details, and results such as spend, impressions, clicks, reach, and conversions. This access is read-only: we do not create, edit, pause, or run ads. Our advertising connectors read aggregated performance data; they do not retrieve individual-level customer, audience, or lead records from the advertising platform.
• Google data.Where a brand signs in with Google and grants Cerros access to its Google accounts, we read only what that grant covers, through Google's APIs: from Google Ads, campaign, ad group, keyword, and shopping performance — spend, impressions, clicks, and conversions; from Google Merchant Center, product listings, their status and disapprovals, and performance and pricing reports; from Google Analytics, aggregated site and app traffic, engagement, and e-commerce metrics for the properties the brand selects; and from Google Search Console, search queries, impressions, clicks, and rankings for the brand's own sites. All of this access is read-only: we never create, edit, or pause ads, never change product listings, and never write to a Google account. We read aggregated reporting data only; we do not retrieve individual-level user, audience, or customer records from Google. We use Google data solely to report the brand's own performance back to that brand, and we do not use it to serve advertising or transfer it to data brokers. Cerros's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.Google data is never used to train or fine-tune AI models, and no human at Cerros reads it except with the brand's consent, for security, or to comply with the law.
• Platform account data. For people who log in to the platform, we process account information such as name, email address, and authentication details.

How we use it

We use connected data solely to operate the platform for the brand that owns it: to unify and standardize the brand's data, store it in the brand's database, generate reports and analytics, and power the brand's private AI "Brain" and tools. A brand's data and its AI models are private to that brand. We do not sell personal information, we do not use connected data for third-party advertising, and we do not use one brand's data to train models or features shared with other customers. Data obtained from a platform on a brand's behalf — such as Amazon Selling Partner data, Meta advertising data, or Google data — is used only to provide the Cerros platform back to that same brand, and is never sold, shared with other brands, or transferred to a data broker. The AI "Brain" answers from a brand's data by secure real-time retrievalwithin that brand's own workspace; connected data — including Amazon Selling Partner data — is never used to train or fine-tune AI models. We never aggregate one seller's marketplace data with another's, never benchmark sellers against each other, and never derive or publish insights about a marketplace's own business.

Where it's stored and who processes it

Cerros runs on Microsoft Azure. Each brand's data is stored in its own isolated, enterprise-grade database hosted on Azure. We use a limited set of sub-processors to operate the platform (for example, Microsoft Azure for hosting and database services, and Anthropic for AI model processing that powers the Brain). These providers process data on our behalf under their own security and privacy commitments and are not permitted to use it for their own purposes. Beyond our sub-processors, we disclose data only if required by law — and when a government or public authority asks, we review the request's legality, challenge it if it is unlawful, disclose only the minimum necessary, and tell you unless we are forbidden to. See Government Requests for Data.

Security

Data is encrypted in transit and at rest. Access is restricted through role-based access controls, and administrative access is audit-logged. Each brand's environment is isolated from every other brand.

Retention

We retain a brand's connected store data for as long as the connection and the brand's account remain active, so the platform can provide historical and trend analysis. When a connection is removed, an app is uninstalled, or an account is terminated, we delete the associated data as described below.

Data deletion and privacy requests

We support the data-subject and deletion obligations required by the platforms we connect to and by applicable law (including GDPR and CCPA/CPRA). Step-by-step instructions for every route below — including how long each one takes — are on Data Deletion Instructions.

• Customer data requests. When a store customer requests the data held about them, we provide the store owner with the customer information Cerros has stored for that store (Shopify customers/data_request).
• Customer redaction. When a customer's data must be deleted, we delete that customer's personal information from the store's database (Shopify customers/redact).
• Shop redaction. When a store uninstalls the app, we delete that store's data — within 48 hours of receiving Shopify's shop/redact request.
• Amazon Selling Partner disconnection. A brand can press Disconnect in Cerros, or revoke Cerros in Seller Central under Apps and Services → Manage Your Apps. Either route starts a clock, and the data collected under that authorization is deleted seven dayslater — well inside the 30 days Amazon's Data Protection Policy allows. Reconnecting within the window cancels the deletion.
• QuickBooks Online disconnection. A brand can press Disconnect in Cerros, or revoke Cerros inside QuickBooks under My Apps. Either route stops collection: revoking in QuickBooks invalidates our access immediately, and we detect it and record the date it stopped. The accounting data we hold for that company is deleted on request — email data@cerros.ai or follow the data deletion instructions— and in any case when the brand's account is terminated.
• Revoking advertising access. A brand can disconnect Cerros at any time — inside the Cerros platform, or from its own settings on the advertising platform (for Meta, in Business settings → Integrations). Disconnecting inside Cerros stops collection immediately and deletes the advertising data we hold for those ad accounts within seven days; reconnecting within that period cancels the deletion. Revoking on the advertising platform also stops collection — we detect that the access we were granted no longer works and record the date it stopped, which starts the same deletion. A brand that wants its data removed sooner can disconnect in Cerros or email us.
• Revoking Google access.A brand can disconnect any Google connector inside Cerros, or revoke Cerros's access from its Google Account at myaccount.google.com/permissions. Disconnecting inside Cerros stops collection immediately and deletes the Google data we hold for that connection within seven days; reconnecting within that period cancels the deletion. Revoking at Google also stops collection — the access we were granted no longer works, we record the date it stopped, and the same seven-day deletion begins. A brand that wants its data removed sooner can email us.

Brands and individuals may also request access, correction, export, or deletion of personal information directly. Email data@cerros.ai and we'll honor reasonable requests promptly.

International transfers

Cerros is operated from the United States and may process and store data in the United States and other regions where our sub-processors operate. Where required, we rely on appropriate safeguards for cross-border transfers.

Children

The Cerros platform is a business-to-business product and is not directed to children under 16. We do not knowingly collect information from them.

Changes

If we change this policy, we'll update it here with a new "last updated" date. Material changes to how we handle data will be reflected before they take effect.

Contact

Cerros — data@cerros.ai