Privacy

Checkout is run by Creem, our payment partner and the merchant of record. It collects your name, email, billing country and payment details; card numbers never reach us. We receive your email, the amount and the country to give you access, measure our ads and help you if something goes wrong.

If you leave your email in a form, we check that the address can receive mail and add it to our email list to send what you signed up for. Every email has an unsubscribe link.

We measure visits and purchases to know which pages and ads work: with PostHog (product analytics, EU servers) and the Meta Pixel and Conversions API. These use cookies and an anonymous visitor id; when you buy or subscribe, your email is sent to Meta hashed (scrambled), never in plain text, to match the purchase to the ad you saw. You can block these in your browser settings.

You sign in with your email and a one-time code we send you. A cookie keeps you signed in on that browser, and once a day we check with Creem that your purchase is still valid. The numbers you enter in the toolkit (your products' names, prices and costs, and your daily budget) are saved in your browser and copied to your account on our server (Vercel Blob storage), so your AI assistant can read them and they come back on a new device. They're stored under a code made from your email, not your email itself. To have them deleted, write to us.

To use the assistant you sign in the same way, with your email and a one-time code; we check with Creem that you have access. Your email travels only inside the sign-in token your AI app holds, encrypted. It reads the store numbers you saved in the course. When it calculates something, our server receives only the totals it needs (spend, purchases, revenue, clicks) and doesn't store them. Your ad account is read by Meta's official connector in your own Claude or ChatGPT, not by us.

Vercel (hosting), Creem (checkout and payments), Resend (sign-in emails), Meta (ads measurement), PostHog (analytics), Encharge (email), Clearout (email validation) and Supabase (database). Each processes data only to provide its service.

You can ask to see, correct or delete your data, or object to its use, by writing to luca@grapefox.com. If you're in the EU or UK you can also complain to your data protection authority. We keep purchase records as long as tax law requires, and everything else only as long as it's useful to you.