Privacy Policy

1. Who we are

Longneckhorse provides ecommerce analytics and AI-assisted creative tools through longneckhorse.io and dash.longneckhorse.io. Longneckhorse is operated by GIRAFFE OÜ, a company registered in Estonia (registry code 14932090, address Liivalaia tn 28, 10118 Tallinn, Harju County, Estonia). GIRAFFE OÜ is the controller of personal data described in this policy unless we process data solely on a customer’s instructions.

Privacy questions and requests can be sent to support@longneckhorse.io.

2. Information we collect

Account and workspace information

• Name, email address, authentication records and account identifiers.
• Workspace settings, profile details and information you submit to support.
• Subscription, credit and billing status where paid services are used. Payment card details are handled by Stripe, our payment provider, and are never stored by Longneckhorse.

Connected ecommerce stores

• Store domain, platform, connection status and encrypted authorization credentials.
• Read-only product, order, revenue, currency and related commerce data made available by WooCommerce or Shopify.
• Longneckhorse minimizes the customer-level order information displayed and primarily uses connected-store data to calculate business metrics.

Google Analytics and Search Console data

• Google Analytics account and property names, identifiers and reporting data such as users, sessions, page views, traffic sources, ecommerce events and purchase revenue.
• Google Search Console property names, permission levels and search-performance data such as clicks, impressions, click-through rate, average position, search queries and landing pages.
• OAuth authorization metadata and encrypted access or refresh tokens needed to maintain each connection.

Meta Ads data

• Business Portfolio, ad account, Facebook Page, Instagram professional account and Dataset or Pixel names and identifiers that you choose to connect.
• Campaign, ad set, ad, delivery, budget and performance data, including spend, impressions, clicks, attributed purchases, CPA and ROAS.
• Creative content and campaign settings you submit when asking Longneckhorse to create an advertising draft.
• OAuth authorization metadata and an encrypted access token needed to maintain the connection. Meta credentials are isolated by workspace and connected store.

Creative tools and technical data

• Prompts, uploaded product media, generated images and videos, accepted assets and generation settings.
• IP address, browser/device information, security events, error records and service usage logs.

3. How we use information

• Provide, secure and maintain your account and workspace.
• Display store, traffic, ecommerce and advertising analytics that you requested.
• Create images or videos and maintain your creative library.
• Create Meta campaign, ad set, creative and ad drafts from the settings and creative you submit. Longneckhorse creates these objects as paused; you remain responsible for review and publication.
• Diagnose errors, prevent abuse, enforce service limits and improve reliability.
• Provide customer support and communicate important service or policy updates.
• Comply with legal obligations and establish or defend legal claims.

We do not sell connected-service data, transfer it to data brokers, or use it to train generalized AI models.

4. Google API data and Limited Use

Longneckhorse requests read-only access to Google Analytics and Google Search Console only after you explicitly choose to connect the relevant service.

Google Analytics access is used to list properties available to your Google account and display reporting data from the property you select. Google Search Console access is used to list verified properties available to your Google account and display the selected property’s organic-search performance, including clicks, impressions, click-through rate, average position, search queries and landing pages.

We store connection metadata and encrypted OAuth tokens needed to maintain these connections. Reporting data is processed to generate your dashboard and may be cached temporarily for performance and reliability. Connected Google data is isolated by account, workspace and store and is not made available to unrelated Longneckhorse customers.

We do not sell Google user data, use it for advertising, transfer it to data brokers or use it to train generalized AI models. We share Google data only with service providers that process it for Longneckhorse under appropriate confidentiality and data-protection obligations, or when required for security or by law. Human access is limited to cases where you request support, access is necessary to investigate security or abuse, or the law requires it.

Longneckhorse’s use and transfer to any other app of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

5. Legal bases

Where the GDPR applies, we process account and service data to perform our contract with you; connected-service data with your authorization and as necessary to provide requested features; security and reliability data for our legitimate interests; and information required by law to comply with legal obligations. Where consent is the legal basis, you may withdraw it at any time.

6. Service providers and international transfers

We use service providers for hosting, database and authentication, transactional communications, payment processing, AI generation and connected-platform APIs. Those providers process data only for their defined services and under their own applicable terms and data-protection commitments.

Our main providers are:

• Supabase: database and sign-in, hosted in the EU (Frankfurt).
• Hostinger: hosting of longneckhorse.io and dash.longneckhorse.io, and our email.
• Cloudflare: storage of uploaded and generated images and videos (R2).
• Runware: AI image and video generation from your prompts and uploaded media.
• Stripe: payment processing for plans and credit packs. Card details go directly to Stripe and are never stored by Longneckhorse.
• Google: Google Analytics and Search Console when you connect them, and Google Analytics on our own sites after you accept cookies.
• Meta: Meta Ads data and ad drafts when you connect a Meta ad account, and the Meta Pixel and Conversions API on our own sites after you accept cookies, to measure which of our ads bring sign-ups and purchases. Your email address is sent to Meta only in hashed form.
• Microsoft: Microsoft Clarity on our own sites after you accept cookies, to see how visitors use the pages through session recordings and heatmaps, so we can fix what is hard to use. Text you type into fields is masked and never sent to Clarity.

Some providers may process data outside the European Economic Area. Where required, we rely on an adequacy decision, Standard Contractual Clauses or another lawful transfer mechanism.

7. Retention

• Account and workspace data is kept while your account is active and for a limited period afterwards where needed for recovery, security, disputes or legal compliance.
• OAuth tokens and connection metadata are retained until you disconnect the integration, delete the relevant store/account, or close your Longneckhorse account, subject to limited backup retention.
• Generated assets remain until you delete them or close your account, subject to operational backups.
• Security, error and transaction records are kept only as long as reasonably necessary for security, service operation and legal obligations.

8. Your controls, Meta data deletion and rights

You can disconnect Google Analytics, Google Search Console, Meta Ads or an ecommerce store from the Connections area in Longneckhorse. Disconnecting Meta Ads deletes Longneckhorse’s stored Meta access token and asset connection; it does not delete campaigns or assets in Meta. You can also remove Longneckhorse from your Facebook settings. Revoking access stops future API access but does not automatically delete your Longneckhorse account.

To request deletion of Meta-related data or your Longneckhorse account data, disconnect Meta Ads in the dashboard or email support@longneckhorse.io from your account email. We will verify the request and delete the applicable connection data, subject to limited security, legal and backup retention.

You can revoke Google access from your Google Account connections page. Depending on applicable law, you may request access, correction, deletion, restriction, portability or objection, and may withdraw consent. You may also complain to your local data-protection authority.

9. Security

We use reasonable technical and organizational safeguards, including encrypted transport, access controls, workspace separation and protected storage of integration credentials. No online service can guarantee absolute security.

10. Children

Longneckhorse is a business service and is not directed to children under 16. We do not knowingly collect children’s personal data.

11. Changes

We may update this policy as the service or law changes. Material changes will be communicated through the service or by email where appropriate, and this page will be updated.