GoAudience is a product of Rebatus Inc. d/b/a GoAudience ("GoAudience," "we," "us," or "our"), a Delaware corporation with offices at 18 W 18th St, New York, NY 10011, United States. This Privacy Policy explains what information we collect, how we use it, how long we keep it, and the choices available to you. It applies to goaudience.com, the GoAudience application, and our integrations with third-party platforms including Shopify, Klaviyo, and Meta (together, the "Services").
1. Who we are and the two roles we play
GoAudience is a customer intelligence platform for e-commerce brands. Because of what the product does, we handle personal information in two distinct roles:
- As a service provider / processor. When a brand connects its store and marketing platforms to GoAudience, we process that brand's customer data on the brand's behalf and under its instructions. The brand is the controller of that data. Brand customers are additionally covered by our Data Processing Agreement, available on request.
- As a controller. For the information of our own users and website visitors (account details, billing, support communications, product usage), we decide how and why the data is processed.
2. Information we collect
Account information. When you create a GoAudience account we collect your name, work email address, company name, and role information you provide. Billing is handled by Stripe; we receive billing status and plan details but never store full payment card numbers.
Brand customer data (processed on the brand's behalf). When a brand connects its platforms, we ingest the data needed to provide the Services:
- Shopify: customer profiles (name, email, location), order history for customers who purchased within the trailing 24 months, product catalog data, and order attribution data (such as UTM parameters).
- Klaviyo: list and segment membership, subscription and consent status, campaign and flow engagement metrics, and template/campaign metadata. Where the brand approves it, we create segments, flows (in draft state), and templates in the brand's Klaviyo account.
- Meta and other ad platforms (where the brand grants access): ad account structure and performance data (campaigns, ad sets, spend, results). Where the brand directs it, we sync audience definitions to these platforms.
Enrichment data. To build customer personas, we match brand customer records against licensed third-party demographic data provided by a licensed data enrichment provider. Enrichment returns attributes such as estimated age band, gender, household income band, and geography, associated with the brand's customer records and used solely to provide the Services to that brand.
Usage and device information. We collect product analytics (pages viewed, features used, session information) and standard log data (IP address, browser type) through our analytics providers to operate, secure, and improve the Services.
Data not intended for the Services. The Services are not designed for sensitive categories of data, and we instruct brands not to submit them, including: government identification numbers, financial account numbers, precise geolocation, health information, biometric data, information about children, or account credentials. If we become aware such data has been submitted, we will work with the brand to remove it.
3. How we use information
- To provide the Services: generating customer personas, segments, insights, and marketing artifacts for the connected brand.
- To operate AI-assisted features. GoAudience uses large language model providers (currently Anthropic) to generate insights and artifacts. Data submitted to our AI providers through their business APIs is not used by them to train their models, and we do not use identifiable customer data to train models shared across customers.
- To operate, secure, and improve the product, including debugging, abuse prevention, and aggregate analytics.
- To communicate with our users about the Services, including onboarding, support, and product updates.
What we do not do. We do not sell personal information. We do not use one brand's customer data to provide services to another brand, except in de-identified or aggregated form that identifies neither individuals nor brands. We do not use brand customer data for advertising our own services.
4. How we share information
We share information only with subprocessors and service providers that help us operate the Services, under contracts that restrict their use of the data:
- Amazon Web Services — cloud hosting and storage
- Licensed data enrichment provider — customer data enrichment
- Anthropic — AI model provider
- Stripe — billing and payments
- PostHog and Google Analytics — product and website analytics
A current list of subprocessors, including functions and locations, is maintained and available to brand customers; we provide notice of material subprocessor changes as described in our Data Processing Agreement. In addition, at the brand's direction, we transmit data to the platforms the brand has connected (for example, syncing a segment to Klaviyo or an audience to Meta). These platforms act under their own agreements with the brand. We may also disclose information where required by law, or in connection with a merger, acquisition, or sale of assets, in which case this policy's protections continue to apply to previously collected data.
5. Data retention and deletion
- While a brand is connected, we retain that brand's customer data as needed to provide the Services, scoped to customers with a purchase in the trailing 24 months plus their lifetime order history.
- On disconnection or uninstall, the brand may request return of a copy of its data as provided in its agreement with us; we delete the brand's customer data from production systems within 30 days of the disconnect or a verified deletion request, whichever is earlier.
- Backups are retained on a rolling schedule and purged within 90 days; deleted data ages out of backups on that cycle and is not restored to production.
- Shopify privacy webhooks. We implement Shopify's mandatory privacy webhooks (customers/data_request, customers/redact, shop/redact) and honor them within the timeframes Shopify requires.
- Account information is retained while your account is active and deleted or de-identified within 90 days of account closure, except where retention is required for legal, tax, or accounting purposes.
6. Security
We maintain administrative, technical, and physical safeguards designed to protect personal information, including encryption in transit (TLS 1.2+) and at rest, role-based access controls with multi-factor authentication for production systems, logging and monitoring, and a vulnerability management program with defined remediation timelines. Our security practices are described further in our Information Security Policy, available to partners and customers on request. No method of transmission or storage is completely secure; if we become aware of a breach affecting your personal information we will notify affected parties as required by applicable law.
7. Your rights and choices
Depending on where you live, you may have rights to access, correct, delete, or receive a copy of your personal information, to object to or restrict certain processing, and to withdraw consent where processing is based on consent.
- If you are a customer of one of the brands we serve, the brand is the controller of your data. Please direct requests to the brand; we support brands in fulfilling them, including through the platform deletion mechanisms described above.
- If you are a GoAudience user or website visitor, contact us at privacy@goaudience.com and we will respond within the timeframes required by applicable law.
- California residents: we do not sell or share personal information as defined by the CCPA/CPRA, and we treat brand customer data as service-provider data. You may exercise CCPA rights through the contacts above without discrimination.
- EEA/UK individuals: our legal bases are performance of a contract, legitimate interests in operating and improving the Services, and consent where required. Where we transfer data internationally, we rely on appropriate safeguards such as Standard Contractual Clauses. You may lodge a complaint with your local supervisory authority.
8. Children
The Services are business tools and are not directed to children under 16. We do not knowingly collect personal information from children. If you believe a child has provided us information, contact us and we will delete it.
9. Changes to this policy
We may update this policy from time to time. We will post the updated version at goaudience.com/privacy with a revised effective date, and for material changes we will provide additional notice to account holders.
10. Contact
Rebatus Inc. d/b/a GoAudience
18 W 18th St, New York, NY 10011, United States