Privacy Policy

01Who this covers

BirunX is a service for online store owners. It reads the orders your store already receives, works out the real profit on each one, and sends that profit figure to Google Ads so your campaigns optimise for margin instead of revenue.

Two different groups of people appear in this policy, and we hold a different responsibility for each:

02What we collect about you

Card numbers never reach us and never will. Payment details are handled end to end by our payment processor; the only thing we ever hold is the two reference IDs above.

03What we process about your shoppers

This is the part that matters most, so it is stated exactly. When an order reaches us, we store:

• One-way SHA-256 fingerprints of the shopper's email, phone, first name, last name and postal code. A fingerprint cannot be turned back into the original value.
• The Google click identifier (gclid, gbraid or wbraid) if the shopper arrived through one of your ads.
• The order itself: amounts, line items, quantities, discount, shipping, status, and the delivery country.
• The two Google consent signals the shopper's consent banner produced.

The fingerprints exist for two reasons only: to let Google match a conversion when no click identifier survived, and to tell a first-time buyer from a returning one.

04What we never collect

• Your shoppers' names, phone numbers, emails or addresses in readable form
• Card numbers, CVVs or any payment credentials
• Full IP addresses of your shoppers
• Anything from your store beyond orders, products and their costs

We also do not keep the raw payload your platform sends. It is read once, turned into the fields listed above, and discarded, there is no column in our database that holds it.

05Google user data: what you grant, and who sees it

Connecting BirunX to Google Ads hands us access to a live advertising account that spends real money. You are entitled to know exactly what that access is used for before you grant it, and to check afterwards. The next eight sections state it in full.

We ask for two permissions and no others.

Connecting also gives BirunX a credential from Google (a refresh token) that lets it act on your account until you disconnect. It is encrypted with a key held outside the database, it is never shown on any screen, never included in any export, and never handed to anyone.

We share, transfer or disclose Google user data to these recipients, and to no others:

• Google itself. The data comes from Google and the profit figures go back to Google, and that exchange is the entire point of the connection.
• The providers that run BirunX on our behalf, named with their locations further down this page: Supabase stores it, Railway processes it, Vercel serves the dashboard page that displays it, and Sentry receives error reports that can carry your Google Ads account number when a call to Google fails. Each is bound by its own published data processing terms, which allow it to use the data only to run the service for us.
• The people you invite into your own BirunX store, as far as the role you gave them allows.
• A competent authority, where a law binding on us requires disclosure. We tell you when that happens, unless the law forbids us from telling you.

06What we send to Google Ads

One thing, once per qualifying order: the contribution margin of that order, as an offline conversion. Each upload carries:

• The conversion action it belongs to: one of the four BirunX creates in your account
• The value: the order’s contribution margin. A negative margin is sent as zero, because Google rejects negative values
• The currency of the order
• The date and time of the order, in your Google Ads account’s own time zone
• The Google click identifier, when the shopper reached you through an ad and gave advertising consent
• A one-way fingerprint of the shopper’s email or phone, only when no click identifier is available, so the conversion can still be matched
• The two consent signals recorded at purchase

If an order is later refunded or cancelled, we send a correction against that same conversion: a new value, or a full withdrawal.

We never send revenue. Revenue is the number Google already optimises for, and it is the reason a high-revenue, low-margin product can drain a budget. The whole point of BirunX is to replace it.

07What we read from Google Ads

• Account overview: your account’s name, ID, currency and time zone, so the dashboard shows the right account and stamps conversions in the right time zone.
• Campaign performance: campaign ad spend, clicks, conversion counts and conversion values, so the dashboard can set your real profit margins directly against your actual ad spend.
• Conversion actions: the list of conversion actions already in the account, so we create ours once instead of duplicating them.

08What we never do in your Google Ads account

• Create, edit, pause or remove campaigns
• Change budgets or bids
• Touch keywords, audiences, assets or ad copy
• Read or alter billing and payment details
• Promote a conversion action to a bidding one on your behalf
• Share your account data with anyone beyond the recipients named above

This is not a promise about intent. There is no code in BirunX that can do any of the above. The only parts of the Google Ads interface it uses are reading campaign performance, managing conversion actions, uploading offline conversions, and applying conversion corrections.

09How this changes your bidding

Every conversion action BirunX creates is created as secondary, observational. Google records it and shows it to you, and it does not feed bidding until you deliberately promote it. That switch is yours, made in Google Ads, and we never make it for you.

Once you do promote it, Google Ads Smart Bidding starts optimising towards margin instead of order value. An order that looks big but leaves you almost nothing stops being chased.

10Consent before anything identifying is sent

Nothing that identifies a shopper is sent without consent. Our tag reads Google Consent Mode v2 before it does anything: without advertising consent it captures no click identifier, and every upload carries the shopper’s consent state so Google applies it at their end too.

11Disconnecting from Google

One button in your BirunX settings. We revoke the token with Google immediately, delete our copy, and stop sending. The conversion actions and the conversions already uploaded stay in your Google Ads account. They are yours, and removing them is your decision to make in Google Ads.

12Google API Services User Data Policy and Limited Use Disclosure

BirunX’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. That policy is published at https://developers.google.com/terms/api-services-user-data-policy.

• Data usage. We access and process your Google Ads and Data Manager data exclusively to perform our core service: reading campaign performance (ad spend, clicks, conversion counts and conversion values) to set it against your real profit margins, and uploading each order’s contribution margin as an offline conversion so your campaigns can optimise for profit.
• Data sharing and transfer. We do not sell Google API user data, and we do not share, transfer or disclose it to any data broker, advertising platform or other application. The only parties that ever hold it are the service providers that operate BirunX on our behalf, named above, and a competent authority where the law compels us.
• Human inspection. No person reads or inspects your Google API user data unless you have explicitly authorised it for technical support, a security or abuse investigation requires it, the law mandates it, or it has first been aggregated so that no single account can be identified.

13Cookies

If you install our tag, it sets first-party cookies on your own domain, not on ours. They are:

The first three are written only when the shopper has granted advertising consent; the last two only when they have granted analytics consent. If consent is refused, nothing is written.

We set no third-party cookies and we do not fingerprint devices.

14Where your data lives

Your data is processed outside your own country. Your orders are stored in Germany, and the companies that run the service are established in the United States. Here is each of them and what it handles.

Each operates under its own published data processing terms, which allow it to handle your data only in order to provide the service to us.

Your store platform, whether Salla, Zid, Shopify, WooCommerce or EasyOrders, is not on this list. It is your provider, not ours, sending us your data on your instruction.

We add no new company to this list without telling you first.

15How long we keep it

To close your account, write to support@birunx.com. The whole store record goes with it (every order, every fingerprint and every click identifier attached to it) within 30 days.

16How we protect it

• Everything travels over HTTPS. There is no unencrypted path in or out.
• The database is encrypted at rest.
• Your Google, Snapchat and TikTok tokens get a second layer of encryption on top of that, with the key held outside the database, so a copy of the database alone cannot open them.
• Row-level security in the database means one store's data is unreachable from another store's session, not merely hidden by the interface.

17Your rights

You can ask us to show you what we hold about you, correct it, delete it, hand it over in a portable form, or stop processing it. Write to support@birunx.com and we will answer within 30 days.

These rights follow you, not us. Which law protects you depends on where you are, not on where our company is registered, so a store in Saudi Arabia is covered by the Personal Data Protection Law and a store in Egypt by Law No. 151 of 2020, whichever country we operate from. We apply the same rights to everyone regardless.

You can revoke our Google Ads access yourself at any time, from your dashboard or from your Google account, without asking us.

18Your shoppers' rights

Your shoppers exercise their rights through you, not through us. You are their point of contact, and we act on your instruction. If a shopper asks you to erase their data, write to support@birunx.com with the order and we will clear the fingerprints and click identifiers from it, keeping the amounts so your own reporting stays intact.

Because we hold no readable contact detail for your shoppers, we cannot identify them ourselves. The order reference has to come from you.

19If something goes wrong

If personal data is exposed, we tell every affected store owner directly, and we notify the competent authority within 72 hours: the Saudi Data and Artificial Intelligence Authority (SDAIA) for stores in Saudi Arabia, and the Personal Data Protection Centre for stores in Egypt.

If you believe we have mishandled your data, you can complain to us at support@birunx.com, and if our answer does not satisfy you, you can take it to the authority for your country named above.

20Changes

If we change this policy in a way that affects what we collect or who we share it with, we email you before it takes effect. Smaller wording changes appear here with a new date at the top.