Privacy Policy

LeakFinder is a software-as-a-service platform for e-commerce merchants. When a merchant authorizes a connection, LeakFinder analyzes store and advertising data from services such as Shopify, Google Ads and Meta Ads to provide reporting, diagnostics, performance insights, revenue-leak detection and optimization recommendations.

When you create an account we collect the information needed to operate it, such as your email address and any name you choose to provide. If you sign in with Google, we receive the basic profile information Google shares for authentication (typically your name and email address). If you contact us, we receive the contents of that message.

We store your account record, sign-in method, business/workspace settings, and notification preferences. Passwords are handled by our authentication provider and are never stored by LeakFinder in readable form.

Connected-service data is only accessed after you explicitly authorize the relevant integration. You can revoke each connection at any time (see “Disconnecting and revoking access” below).

Shopify

When you connect a Shopify store, LeakFinder uses a read-only connection with the scopes you approve (read_orders, read_customers, read_products). We read order, checkout and related store information needed to detect revenue leaks, and your current product catalogue (titles, variants, SKUs and prices) so product performance reflects the prices shown in your Shopify admin. We do not write to your store, and we do not read or store shopper payment card numbers.

Google Ads

When you connect Google Ads, LeakFinder uses Google OAuth authorization and the Google Ads API to access only the data authorized by you, for the advertising accounts you select. This can include account identifiers, campaign, ad group and ad information, performance metrics (such as spend, impressions and clicks), and conversion information as reported by your Google Ads account.

Meta Ads

When you connect Meta Ads, LeakFinder uses Meta OAuth to access the advertising accounts you select, including account identifiers, campaign/ad-set/ad information and performance metrics such as spend, impressions, clicks and reported conversions.

Other connected services

Additional platforms (for example TikTok Ads or email service providers) follow the same pattern: access begins only after your authorization and is limited to the data required to provide the corresponding reporting and diagnostics.

We use connected-service data solely to provide LeakFinder's functionality to the merchant who authorized the connection: revenue-leak detection, advertising and store reporting, historical analysis, diagnostics, performance insights and optimization recommendations. We do not sell your personal information or your connected-service data, and we do not share it with advertisers or unrelated third parties.

Cross-source analysis (for example combining advertising spend with store revenue) is only performed for your own business and, where the advertising account's relationship to your store is uncertain, only after you confirm that mapping.

Google authorization

LeakFinder accesses Google Ads data only after the user explicitly connects Google Ads and authorizes LeakFinder through Google's OAuth consent flow.

LeakFinder uses the Google Ads OAuth scope:

https://www.googleapis.com/auth/adwords

This authorization allows LeakFinder to access Google Ads account information necessary to provide its Google Ads reporting and analysis functionality. It does not grant LeakFinder access to Gmail, Google Drive, Google Calendar, contacts, or unrelated Google products. LeakFinder does not use those services for its Google Ads integration.

Google data LeakFinder collects

Depending on what is available in the connected Google Ads account, LeakFinder may retrieve and process the following Google Ads data:

• Google Ads customer/account ID
• Account name and descriptive information
• Account currency
• Manager/customer account relationships needed for account discovery
• Campaign IDs and campaign names
• Campaign type and status
• Ad group IDs, names and status
• Ad IDs and related advertising information
• Campaign, ad group and ad performance data
• Impressions
• Clicks
• Advertising cost/spend
• Click-through rate
• Average cost per click
• Conversions
• Conversion value
• Cost per conversion
• Conversion-action information
• Reporting dates and time periods
• Other Google Ads reporting metrics required to calculate and display advertising performance

Why LeakFinder uses Google data

LeakFinder uses the Google Ads data described above to:

• Allow the merchant to select the correct Google Ads account
• Display Google Ads performance reporting
• Display historical performance and trends
• Calculate advertising performance metrics
• Identify changes or deterioration in advertising performance
• Identify potential advertising inefficiencies and revenue leaks
• Generate plain-language diagnostic findings
• Provide optimization recommendations
• Compare current performance with the merchant's own historical and account-level performance
• Combine Google Ads data with the merchant's Shopify data ONLY when the merchant has confirmed that the advertising account corresponds to that Shopify business

LeakFinder does not use Google Ads data for unrelated advertising, consumer profiling, selling data, or building advertising audiences for third parties.

Storage of Google data

• Google Ads reporting data needed by LeakFinder is stored in LeakFinder's managed database so historical reporting and diagnostics can be provided.
• Google OAuth access and refresh tokens are stored server-side in encrypted form.
• OAuth tokens are not exposed to other LeakFinder customers.
• Stored records are scoped to the business that authorized the Google Ads connection.
• Google data belonging to one LeakFinder business is not made available to another LeakFinder business.

Sharing and disclosure of Google data

LeakFinder does not sell Google user data.

LeakFinder does not share Google user data with advertisers, data brokers, or unrelated third parties.

Google data may be processed by infrastructure and service providers strictly as necessary to host, secure, maintain, and operate LeakFinder, subject to appropriate contractual and data-protection obligations.

Google data may also be disclosed where legally required by valid legal process.

Retention and deletion of Google data

Google Ads data is retained only for as long as necessary to provide the connected merchant with LeakFinder's reporting, historical analysis, and diagnostics, or as otherwise required for legitimate legal or security obligations.

Users can:

1. Disconnect Google Ads from LeakFinder's Integrations page.
2. Revoke LeakFinder's Google authorization through their Google Account.
3. Request deletion of their LeakFinder account or data through LeakFinder's privacy controls or by contacting info@backcorrect.com.

When Google Ads is disconnected, LeakFinder deletes or invalidates the stored Google OAuth credentials for that connection and stops making new Google Ads API requests for that connection.

Following an applicable account or data deletion request, associated stored Google Ads data and derived business findings are deleted or anonymized according to LeakFinder's deletion process, except where limited retention is legally or security required.

Google API Services User Data Policy

"LeakFinder's use and transfer to any other app of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements."

Google Ads API behavior

LeakFinder's current Google Ads integration is used for reporting, historical analysis, diagnostics, and recommendations. It does not automatically create, edit, pause, delete, or otherwise change Google Ads campaigns, ad groups, ads, budgets, bids, or targeting.

Contact

For privacy, access, and deletion requests, contact info@backcorrect.com.

When you connect an integration, the resulting access and refresh tokens are stored only on our servers, in encrypted form, and are never returned to the browser, exposed in page output, or written to logs. Platform application credentials (for example our Google or Meta app secrets) are likewise stored server-side only.

All traffic runs over TLS. Data is held in a managed database with encryption at rest and row-level security that scopes every record to the owning business. Access is limited to what is needed to operate the service.

LeakFinder is multi-tenant: every record belonging to your business is scoped to your business identifier, enforced by database row-level security policies. One business's credentials, store data and advertising data are not accessible to another business.

We rely on a small number of service providers to operate LeakFinder, including our hosting and database provider (Lovable Cloud / Supabase infrastructure) and, where enabled by you, email delivery providers used to send the messages you configure. These providers process data only to the extent needed to deliver their services to us.

We do not sell personal information. We may disclose information only in limited circumstances: to service providers necessary to operate the service (as described above), when required by law or valid legal process, to protect the rights, safety or security of LeakFinder or its users, or as part of a business transfer such as a merger or acquisition, subject to this policy.

Account information is retained while your account is active and for as long as reasonably necessary to provide the service, comply with legal obligations, resolve disputes, and protect the service. Connected store and advertising data is retained only for as long as necessary to provide LeakFinder's reporting, diagnostics, historical analysis, and related functionality.

When you disconnect an integration, LeakFinder removes the stored credentials associated with that connection. When you request deletion of your account, LeakFinder deletes or anonymizes associated business data, derived findings, and stored integration credentials, except where retention is required by law or reasonably necessary for security, fraud prevention, dispute resolution, or enforcement of our agreements.

You can export or request deletion of your LeakFinder data from Settings → Privacy in the application. You can also contact us using the details below and we will process your request.

You can disconnect any integration from the Integrations page in LeakFinder, which deletes the stored credentials for that connection. You can additionally revoke LeakFinder's access directly with the provider — for example in your Google account's third-party access settings, your Meta Business settings, or by uninstalling the app from your Shopify admin.

Depending on where you live, you may have rights to access, correct, export, delete or restrict the processing of your personal information, and to object to certain processing. You can exercise these rights from within the product where available or by contacting us. We do not discriminate against you for exercising your rights.

LeakFinder uses the cookies and browser storage necessary to operate the service — primarily to keep you signed in and to maintain your session. We do not use third-party advertising cookies on the application.

LeakFinder may process and store information in countries other than your own through our hosting and service providers. Where required, we rely on appropriate safeguards for cross-border transfers.

LeakFinder is a business tool and is not directed at children under 16. We do not knowingly collect personal information from children.

We may update this Privacy Policy from time to time. Material changes will be posted on this page with an updated “Last updated” date, and where appropriate we will notify you in the product or by email.

For privacy questions, data access requests, deletion requests, or other privacy-related inquiries, contact: info@backcorrect.com

LeakFinder is currently operated as an independent software service from Serbia. Where required by applicable law, additional information concerning the operator of the service may be provided upon request.