Privacy Policy

Effective November 11, 2026.

1. Scope and who we are

JDBR Finance is an internal financial reporting tool. It is operated by JDBR Commerce VOF, the Netherlands ("we", "us"). It reports on online stores owned by JDBR Commerce VOF (the Netherlands) and a separately owned US limited liability company (LLC) ("the companies"), and only authorized staff of the companies use it, for their internal financial reporting. Each store, advertising account and financial record is assigned to the company it belongs to and reported separately.

This policy explains what data the tool accesses, in particular through the Google Ads API, and how that data is collected, stored, secured, retained, shared and deleted.

2. Google user data we access

• OAuth scope: https://www.googleapis.com/auth/adwords (Google Ads). We request no other Google scopes. In particular, we do not request your name, email address, profile, contacts, Gmail or Drive.
• Who grants access: authorized staff, signed in with a Google account that has access to the Google Ads manager account through which the companies' Google Ads accounts are reached.
• Read only: the tool only runs reporting queries. It never creates, changes or deletes campaigns, ads, budgets, users or settings in Google Ads.

3. Data we collect through the Google Ads API

We store the following, and only for the companies' own Google Ads accounts:

• Google Ads customer (account) ID
• campaign ID and campaign name
• date
• cost (metrics.cost_micros) and the account currency
• the time the figures were fetched

For an access check, the tool also reads which client accounts are linked to the manager account: their IDs, names, status, currency and time zone. This is shown to the administrator but not stored.

We collect no data about the people who see or click the ads. Google Ads reporting at campaign and day level does not contain any.

4. Other data in the tool

To calculate profit, the tool also stores order and refund records from the companies' Shopify stores and cost records from their fulfilment provider, Shipgoods.

• We request Shopify orders without customer names, email addresses, phone numbers or addresses. The only location we request is the shipping country.
• From Shipgoods we keep only order references, statuses, amounts, dates and product lines. Any buyer names, addresses, contact details or tracking numbers the provider returns are discarded before storage.

5. How we use the data

We use the data only to calculate, report and check the daily and monthly profit and loss of the companies' stores. We do not use it for advertising, profiling or selling, and we do not use it to train or prompt AI models.

JDBR Finance's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

6. Recipients, service providers and data sources

We do not sell, rent or share Google user data or Google Ads data. Only the following parties receive or provide data for the tool:

• Supabase (database hosting, service provider): stores all of the tool's data.
• Netlify (application hosting, service provider): runs the tool's server code in the United States (AWS us-east-2) and hosts this information site. Netlify's server logs record which store a run covered and whether each step succeeded. They contain no financial figures and no credentials. Like any web host, Netlify also processes technical request data, such as IP addresses, to deliver these pages.
• Google (Google Ads API and Google OAuth, data source): receives our OAuth credentials, the Google Ads account IDs and the date ranges we request, and returns the cost figures listed above. No other data from the tool is sent to Google.
• Shopify (data source): receives each store's app credentials and the date filters we request, and returns the store's order records. No other data from the tool is sent to Shopify, and the tool never changes anything in Shopify.
• Shipgoods (data source): receives each company's API key and the date ranges we request, and returns fulfilment cost records. No other data from the tool is sent to Shipgoods.
• Google (Gmail): if you email us at jdbrcommerce@gmail.com, your message is handled by Google as our email provider.

Data is also disclosed where the law requires it. Authorized staff may export a company's reports for that company's own bookkeeping.

7. Storage and security

• Access: row-level security in the database lets only accounts with the finance permission read the data, and only the owner/administrator role has that permission. All writes are made on the server.
• Connections: all connections use HTTPS.
• Credentials: the OAuth client secret and refresh token are kept as server-side environment variables in our hosting. They are never stored in source code or the database, never written to logs and never sent to a browser. Short-lived access tokens exist in memory only, for the duration of a request.
• Sync records: these keep only an error category, the Google Ads account ID and Google's error code. They never contain a token or a raw response.

8. Retention

Advertising cost data is kept as part of the companies' financial records for as long as it is needed for reporting and bookkeeping. The tool does not currently delete data automatically after a set period. The OAuth refresh token is kept until it is revoked or replaced.

9. Deletion and revoking access

• You can revoke the tool's Google access at any time at myaccount.google.com/permissions. We can also revoke it by removing the credentials from our hosting. After that, the tool fetches no further Google Ads data.
• To have the stored data of a Google Ads account deleted, email jdbrcommerce@gmail.com. We then delete that account's cost records, its link to a store and the daily results calculated from them, without undue delay, and the account is no longer fetched. Copies may remain in our database provider's backups until those expire. If a legal obligation requires us to keep data, we will tell you so.

10. Cookies

This information site sets no cookies and uses no analytics or tracking. The reporting application uses only the session cookies needed to keep authorized staff signed in.

11. Changes and contact

We will update this page whenever the tool's data handling changes and show the new effective date. Please send questions or requests to jdbrcommerce@gmail.com.