Privacy policy
SIA "Advento.pro", registration no. 40203689734, Latvia. Last updated: 26 October 2026.
Who we are
Advento is run by SIA "Advento.pro", a company registered in Latvia with registration number 40203689734, registered address Jēkabpils nov., Viesīte, Brīvības iela 6-7, LV-5237 ("we", "us").
This policy covers three things:
- Advento App (app.advento.pro, and the Advento app in the Shopify App Store): a read only profit dashboard for your store.
- The Advento dashboard (dashboard.advento.pro): the dashboard we run for brands we work with.
- This website (advento.pro).
For your account, the website and our own emails, we are the data controller. For the data you connect from your store and ad accounts, we act as your processor: we use it only to run the service for you, under our terms and our data processing agreement.
Questions about privacy or your data: toms.strasevskis@advento.pro. Help with the app: support@advento.pro.
What we collect about you
| Data | Why | Legal basis |
|---|---|---|
| Account: your name, work email, the workspace you belong to and your role in it | To let you sign in and use the service | Contract (Article 6(1)(b) GDPR) |
| Sign-in and security records: sign-in times, IP address, browser, the devices you are signed in on | To keep accounts safe, show you where you are signed in and stop misuse | Legitimate interest in security (Article 6(1)(f)) |
| Billing contact and plan | To bill you and keep the records tax law asks for | Contract and legal obligation (Article 6(1)(b) and (c)) |
| Support messages and calls we invite you to, including Talk to Tom in the app. A draft of Tom's reply is written with an AI provider (listed on our sub-processors page); Tom reads it and decides what is sent | To help you | Contract, or legitimate interest in answering you |
| How you use the app: event name, workspace and time, recorded by us, with no store data in it | To fix problems and make the app better | Legitimate interest (Article 6(1)(f)) |
| Your email choices, and your choice to get the free Monday report | To send only the emails you want | Contract; for the free Monday report, your consent (Article 6(1)(a)) |
Data from the platforms you connect
When you connect a platform, you sign in on that platform's own screen and choose what to share. We only ask for read access. We cannot spend, post, change settings or edit anything in your accounts. We do not read your customers' names, emails, phone numbers or addresses. For this data we act as your processor under our data processing agreement.
| Platform | What we read |
|---|---|
| Shopify | Orders, order lines, refunds, products, product costs, fulfilments and payouts. Never customer names, emails, phone numbers or addresses. Each order carries a customer number; we keep only a one-way hash of it, to count repeat buyers. |
| Meta (Facebook and Instagram ads) | Ad account insights: spend and results per day by campaign, ad set and ad, and the list of ad accounts you choose |
| Google Ads | Ad account reports: spend, impressions, clicks, conversions and conversion value per day by campaign |
| Google Analytics 4 | Daily totals only: visits, engaged visits, add to carts, checkouts, purchases and purchase value, per day, channel and device type. Never anything about a single visitor. |
| Google Search Console | Daily totals only: clicks and views in Google Search per page. Never anything about a single visitor. |
| Klaviyo | Campaign and flow results, and list sizes |
| Microsoft Clarity | Daily counts per page and device type: rage clicks, dead clicks, quick backs and scroll depth, read with the export token you paste in yourself. Never recordings or anything about a single visitor. |
| TikTok ads (coming soon) | Ad account reports: spend and results by campaign, ad group and ad |
We use this data only to show you your own numbers: real sales, profit after costs, ad spend, return on ads, the leaks that cost you money, and how much of your sales each platform claims; to send the emails you ask for; and, if you ask, to give you support or prepare your X-Ray. Order data is about your customers even without their names. We never contact your customers and never use their data for anything else.
We never sell your data, never use it for advertising, never use it to train AI models, never use it to build products for anyone else and never show it to another business. Benchmarks across stores are only ever made from anonymised totals, and only if you opt in.
We never use the data you connect to find sales leads for our agency work. If you ask us to fix something for you, we use only what you send us and the leak you picked, and record that you asked.
The free money scan
If you run the free scan, you connect Shopify (and Meta if you want) and we read your last 60 days once, to show you your real profit and the money you could get back. No card is needed. We delete what we read 7 days later, unless you start a plan or tick "send me my Monday report". Ticking that box is your consent for us to keep reading your store once a week to write that email. You can switch it off at any time, and we then delete what we read as described below.
Google user data
Advento's use and transfer of information received from Google APIs to any other app will adhere to Google API Services User Data Policy, including the Limited Use requirements.
| Google API | Access we ask for | What we read and why |
|---|---|---|
| Google Analytics Data API | Read only (analytics.readonly) | Daily totals of visits, carts, checkouts and purchases per channel and device, to show where shoppers drop off and which channels bring sales |
| Google Search Console API | Read only (webmasters.readonly) | Daily clicks and views per page in Google Search, to show which pages bring free visits and when they fall |
| Google Ads API | Reports only (adwords; we never create or change anything) | Daily spend and results per campaign, to show what your Google ads cost and earn next to your real sales |
In plain words: we use Google data only to show you your own numbers and to give you support. It is stored with the rest of your data in our database in the EU (Netherlands), encrypted in transit, and your Google connection token is encrypted at rest. We do not transfer it to anyone except as needed to run the service, to comply with the law, or as part of a merger or sale with notice to you. We do not use it for advertising and never sell it. People at Advento read it only with your permission (for example when you ask for help or for your X-Ray), for security reasons, or to comply with the law.
Emails we send
- Sign-in codes (always sent, they are how you sign in).
- Your daily profit email and your Monday report.
- Alerts when profit drops or spend jumps, and leak alerts.
- Your trial ends in 3 days, and your plan has stopped.
Each person can switch off the emails they do not need in Settings. We send emails about an area only to people who may see that area in the workspace.
Who can see your data
- The people in your workspace, the ones you invite, each limited to the areas you let them see.
- Advento staff, only to give you support, prepare your X-Ray or keep the service safe. Every time a member of our staff opens your workspace, it is logged.
- The sub-processors that run the service for us, listed on our sub-processors page.
- Authorities, where the law requires it.
No one else. Shopify and Stripe handle payments as separate controllers under their own privacy policies: App Store installs are billed by Shopify, and direct sign-ups by Stripe. We never see your full card number.
Sub-processors
The companies that run parts of the service for us, what they do and where, are on our sub-processors page. In short: Railway (hosting and database, EU West, Netherlands), Resend (email), Cloudflare (network protection), Cal.com (scheduling a call when we invite you). We give workspace owners 30 days notice by email before we add or change a sub-processor that handles connected data.
Where your data lives
Your account and connected data are stored in the EU, in Railway's EU West region (Netherlands). Some of our sub-processors are companies based in the United States. Transfers out of the UK and EU go only to listed sub-processors and rely on an adequacy decision, the EU-U.S. Data Privacy Framework and its UK Extension, or Standard Contractual Clauses with the UK Addendum (GDPR Chapter V).
How long we keep it
| Data | How long |
|---|---|
| Free money scan data | 7 days after the scan, then deleted, unless you start a plan or ask for the Monday report |
| Connected platform data, while you have a plan | While the platform is connected. |
| When the service stops (the trial ends without a plan, a payment fails, or a cancelled plan reaches the end of its paid period) | Kept 30 days, out of use, so you can come back, then permanently deleted |
| When you disconnect one platform | That platform's data is deleted within 30 days. See data deletion. |
| When you delete your workspace yourself | Deleted at once. Backups expire within 35 days. |
| When you uninstall the Shopify app | Shopify asks us to delete your store data; we do it within Shopify's 30 day deadline |
| Your account (name, work email, sign-in) | While your account is open, then up to 30 days, then permanently deleted |
| Security and sign-in logs | 12 months |
| Staff access log | 24 months |
| Invoices and billing records | As long as Latvian accounting and tax law requires |
| Website server logs | 30 days |
| Google Analytics data (this website) | Up to 14 months (Google's standard retention) |
| Microsoft Clarity data (this website) | Up to 13 months (Microsoft's standard retention) |
| Findings, X-Ray and audit requests made on this website | 24 months from your last contact with us, or until you ask us to delete them |
You can download everything and delete your workspace yourself at any time in the app, under Settings.
Website visitors
Server logs
When you load a page we log your IP address, browser type, referring page, pages visited and times, to keep the site secure and fix problems. Legal basis: legitimate interest (Article 6(1)(f) GDPR).
Measurement and ads on this website
On advento.pro we use Google Analytics 4 (pages visited, approximate location, device type, how far you scroll and the buttons you press), Microsoft Clarity (anonymised clicks and scrolling), and the Meta, TikTok and LinkedIn pixels (that someone who saw our ad visited the site, opened the booking calendar or booked a call). They set cookies and send these events, with your IP address and browser details, to Google, Microsoft, Meta, TikTok and LinkedIn. We use this to know which pages and ads bring people who book a call, and to show our ads to people like them.
If you visit from the EU, the EEA, the UK or Switzerland, none of this loads until you click Accept in the banner. Legal basis: your consent (Article 6(1)(a) GDPR). From anywhere else, it loads unless you turn it off below or your browser sends a Global Privacy Control signal.
When you book a call in the calendar on our page and measurement is on, we also tell Meta (and TikTok, when we use it) from our server that a call was booked, with your email address only as a one-way hash, so the booking is counted once even if an ad blocker stops the pixel.
The findings form
The "Get my 5 findings" form asks for your store link and email, and records the page and campaign that brought you (UTM tags). We use them to look at your store and send you the findings, and to keep a record of the conversation. Legal basis: steps you asked for before a contract, and our legitimate interest in replying to you.
Requests made through earlier versions of this site
Earlier versions of this site had an X-Ray form that asked for your name, work email, store URL, monthly sales and ad spend bands and, optionally, one line about your biggest headache (the earlier audit form also asked for platform, role and an optional phone number), with the page and campaign that brought you (UTM tags and Meta click identifiers). We keep these to reply to you and keep a record of the conversation. If you had accepted cookies, we told Meta a lead came from our ad, sending your email address only as a one-way hash. Legal basis: legitimate interest in replying to your enquiry; your consent for the Meta measurement.
Scheduling a call
When we invite you to a call, the scheduling link opens Cal.com. The details you give there (name, email, store name and anything you type) are collected by Cal.com, and we receive them to hold the call.
Cookies
- Advento App: one session cookie that keeps you signed in, and one short-lived cookie that protects the connect step when you link a platform. Both are strictly necessary, so we do not ask for consent for them. The app has no analytics, advertising or session recording cookies.
- The Advento dashboard: only the cookies needed to keep you signed in and to connect your platforms safely. They are strictly necessary, so we do not ask for consent for them.
- This website: one entry in your browser remembers your choice. The measurement and ad cookies are listed under "Measurement and ads on this website" above; in the EU, the EEA, the UK and Switzerland they are set only after you click Accept.
Security
Connection tokens are encrypted at rest and never shown on a screen. Data travels over encrypted connections. Each workspace's data is kept apart from every other workspace's at the database level. Access by our staff is limited to the people who need it and is logged. More detail is in Annex 2 of our data processing agreement.
Your privacy choices
Your choice is saved in this browser.
Your choice applies to this browser. If you clear this site's data, choose again here.
California and other US states
We do not sell personal information for money. Sharing visit and booking events with ad platforms for ads based on your activity on other sites can count as "selling" or "sharing" under the California Consumer Privacy Act and similar state laws. You can opt out with the button above (it reads "Do not sell or share my info" when you visit from the US), and we treat a Global Privacy Control signal from your browser as the same opt-out. We collect the categories listed in this policy, for the purposes listed, and keep them for the periods listed. You can ask to know, correct or delete your personal information by emailing toms.strasevskis@advento.pro, and we will not treat you differently for using these rights. We do not knowingly collect information from anyone under 16.
Your rights
Under the EU GDPR and the UK GDPR you can ask for access to your personal data, correction, deletion, restriction, and a copy in a machine-readable format. You can object to processing based on legitimate interest, and withdraw consent at any time. Most of this you can do yourself in the app: download your data, change your details, switch emails off, or delete the workspace. Or email toms.strasevskis@advento.pro. We reply within 30 days.
If your customers ask about their data in your store, contact us and we will help you answer within the time the law gives you. Shopify's customer data requests and deletion requests are handled automatically.
You can also complain to a supervisory authority: the Latvian Data State Inspectorate (Datu valsts inspekcija, www.dvi.gov.lv), which is our lead authority, the UK Information Commissioner's Office (ico.org.uk) if you are in the UK, or the authority where you live.
Changes
We may update this policy. The date at the top shows the latest version. If a change affects connected data, we tell workspace owners by email before it applies.
Contact
SIA "Advento.pro", registration no. 40203689734
Jēkabpils nov., Viesīte, Brīvības iela 6-7, LV-5237, Latvia
Privacy: toms.strasevskis@advento.pro
Help: support@advento.pro