SD: Less Time Marketing — Privacy Addendum

How Less Time Marketing uses store, brand, and connected-account data to create, schedule, and publish content. This app does not read Shopify customers, orders, or payments. These practices apply only when you use this app or activate the relevant connection.

Effective: October 21, 2026Last updated: October 26, 2026

1. Scope, operator, and roles

ShopiDeck is a trade name of BONILLA CARRENO ANDRES CAMILO, a natural person (individual), Bogotá, Colombia. This addendum supplements the general ShopiDeck Privacy Policy exclusively for Less Time Marketing. For app-specific differences it prevails over the general policy, subject to mandatory law and the DPA for processor obligations. Bot Cleaner permissions, scoring, customer-profile retention, and suppression workflows do not apply here. Publishing these terms does not mean every integration is already available; availability and permissions are shown in the app before connection.

The operator and privacy contact are identified in the general policy. ShopiDeck is controller for account administration, billing, connection administration, security, and its own service communications; it is processor for personal data in store and brand materials and publishing instructions handled on the merchant's behalf. Social platforms act under their own terms for data they receive. A connection is not permission to use its data in another ShopiDeck app.

2. Data, sources, and purposes

Data and source	Use
Shopify: store domain, name, time zone, language, currency, and email; installation and session identifiers.	Identify the installation, authenticate users, schedule in the store's time zone, and send service notices.
Shopify products (read_products): titles, descriptions, prices, tags, and images.	Generate product-based copy, images, and videos.
Merchant: brand description, audience, tone, values, logo, colors, prohibited words, and prompts.	Adapt generated content to the brand and merchant instructions.
App: campaigns, posts, copy, hashtags, asset links, schedules, and publishing attempts.	Maintain the content calendar and show publishing status and errors.
Generated images and videos; Shopify Files (write_files).	Store final generated assets in the merchant's Shopify Files, rather than as a permanent media library on ShopiDeck servers.
Connected Meta, TikTok, Google/YouTube, or LinkedIn account: ID, display name, photo, granted scopes, and access/refresh tokens where issued.	Identify the chosen account, maintain the connection, and publish authorized content. Tokens are encrypted at rest using AES-256-GCM.
Shopify Billing and app: plan, credits, consumption, purchase and billing status; technical and audit logs.	Manage charges, credit balances, service reliability, security, and abuse prevention.

3. Data this app does not access

It does not request permissions to read Shopify customer records, orders, or payment details. Subscription billing status is separate from store customer payment data.
It does not read social-network messages, follower lists, audience analytics, or other people's social data for those purposes. Basic account/channel identity is used only for the selected connection.
It does not receive your social-network passwords: authorization takes place with the platform.
Product images are processed temporarily for generation; ShopiDeck does not keep permanent copies of the original product photos on its servers. AI providers may have their own processing and retention conditions.
Do not put customer lists, sensitive personal data, secrets, or third-party personal information into brand fields, prompts, or product materials for generation.

4. Legal bases, AI, and automation

Creating, scheduling, publishing, managing credits, and necessary service notices are based on performance of the contract where that basis applies. Billing and accounting also involve legal obligations. Security, abuse prevention, and optional weekly summaries may rely on legitimate interests where permitted; optional emails can be disabled in Settings → Emails. Consent or authorization is obtained where required, including under Colombian law. For data processed on your behalf, you determine the legal basis and instruct ShopiDeck.

All AI processing is routed through fal.ai. Depending on the selected task, the chain includes OpenRouter for routing, Anthropic and OpenAI for text/creative work, Google and OpenAI for images, MiniMax, Google and ByteDance for video, Kuaishou/Kling for background music, and fal.ai subtitle and FFmpeg assembly services. Legacy reserved jobs may also use earlier Seedance or Wan models. Only the inputs needed for the selected operation are sent to the relevant providers; not every provider receives every request. These are generation functions, distinct from Bot Cleaner's rule-based scoring.

ShopiDeck does not use your data to train its own AI models. The external providers' retention, downstream routing, transfer safeguards, and no-training restrictions are pending contractual confirmation. The current documentation does not establish a fal.ai or model-provider DPA or written no-training commitment. No zero-retention or universal external-provider no-training guarantee is made. General public privacy notices do not establish the terms of the specific API/model deployment.

This app does not make decisions producing legal or similarly significant effects about individuals. Publishing requires approval by default. If you enable automatic publishing for a campaign, eligible posts can be published without individual review; you can disable that option. TikTok always requires your explicit approval and publishing choices.

5. Social connections, information shared, and platform data

Only connections you activate receive content. Authorizing a connection does not activate all networks. Each platform's own privacy terms govern its independent processing, including public distribution of posts.

Data received from Meta, TikTok, Google/YouTube, or LinkedIn ("platform data") is used only to provide the connection and publishing features you request. ShopiDeck does not sell, rent, or license platform data; does not use it for advertising, profiling, or building audiences; does not share it with data brokers; does not combine it with data from other ShopiDeck apps; and does not use it to develop, improve, or train AI or machine-learning models. Platform data is not sent to AI generation providers.

Platform data is stored only for as long as the connection needs it and is deleted on disconnection, revocation, or a valid deletion request, within 30 calendar days at the latest, unless a narrow legal duty requires restricted retention. ShopiDeck personnel access it only for support you request, security, or legal compliance. Use of each platform's data follows the Meta Platform Terms and Developer Policies, the TikTok Developer Terms of Service, the LinkedIn API Terms of Use, and the YouTube API Services Terms and Developer Policies.

Facebook, Instagram, Meta, TikTok, YouTube, Google, and LinkedIn are trademarks of their respective owners. Less Time Marketing is an independent app and is not endorsed by, sponsored by, or affiliated with those companies.

Connection and access	Content sent
Google/YouTube: youtube.upload and youtube.readonly to identify the channel.	Video, title, description, hashtags, and selected publishing options.
Meta: publish to the selected Instagram professional account or Facebook Page.	Copy, hashtags, and image or video, plus the chosen target account.
TikTok: basic profile and video publishing permissions.	Copy, hashtags, video, and the privacy, interaction, and commercial-content choices you explicitly select.
LinkedIn: openid, profile, and w_member_social for the connected member profile.	Copy, hashtags, images or video, and the selected publishing destination.

6. Google/YouTube and Limited Use

Less Time Marketing uses YouTube API Services. By using the YouTube integration, you agree to be bound by the YouTube Terms of Service; Google's Privacy Policy explains Google's processing.

Less Time Marketing's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Google user data is used only to provide the user-facing connection and publishing features you authorize, is not sold or used for advertising, and is not transferred to another ShopiDeck app or to AI providers, and is not used to develop, improve, or train generalized AI or machine-learning models. Humans do not read it except with your affirmative agreement for specific data, for necessary security purposes, to comply with law, or as otherwise expressly permitted by that policy.

Revoke access at any time through the Google security settings page (https://security.google.com/settings/security/permissions) or disconnect in the app. You may also request deletion directly from ShopiDeck without first revoking access. Revocation stops further authorized access; deletion of retained connection data is handled under the retention rules below and, for YouTube authorized data, within 30 calendar days of revocation or a deletion request. Previously published videos remain on YouTube unless you delete them there.

7. Providers and international processing

This app uses Shopify for installation, products, Files and billing; Vercel for hosting; Neon for its database; fal.ai and relevant model providers for generation; Resend for service emails; and only the social platforms you connect for publishing. Supabase and Klaviyo are not Less Time Marketing providers merely because Bot Cleaner uses them. The provider register describes the relevant data and roles, including downstream model providers.

The operator is in Colombia. Processing may occur in the United States, Canada, the configured Neon region, and other countries in the provider register. Neon's specific deployment region is not established in the supplied product documentation; request the current location and safeguards at team@shopideck.com. Where required, transfers must rely on an applicable lawful mechanism, such as contractual safeguards; no provider certification or signed transfer instrument is presumed by this notice.

Less Time Marketing provider register

8. Retention, disconnecting, and uninstalling

The following periods apply to this app's active local records. Earlier deletion on uninstall or a valid request takes precedence over ordinary retention. They do not promise deletion of Shopify Files, published social content, independent platform records, provider logs, or backup copies at the same instant.

Disconnecting a network in the app removes its local tokens immediately and stops new publishing through that connection; revoking from the platform stops API access and is followed by connection cleanup. Uninstalling removes the app's social credentials and stops future jobs. Shopify normally sends shop/redact approximately 48 hours after uninstall; on that event ShopiDeck deletes the local store record and related app records. This is not a guarantee that all copies at every provider disappear exactly 48 hours after uninstall. You can request deletion directly without waiting for that event.

Record	Ordinary retention or deletion trigger
Connected-account tokens	Until disconnect, revocation, or uninstall; removed immediately on in-app disconnection.
Campaigns, posts, publishing attempts	365 days after completion, or earlier on store-data deletion.
Generation-credit history	24 months, or earlier on store-data deletion unless legally required records must be retained.
Plan and package purchases	While installed, with only records required by law retained afterwards; Shopify retains its own invoices.
Generated files no longer referenced by any post	Nightly cleanup in Shopify Files while the app remains installed and has access. After uninstall you manage remaining files in Shopify.
Other local store and connection records	Deleted on shop/redact or a valid earlier deletion request, subject to narrowly necessary legal retention.
Privacy-request and used-trial hashes	Only minimal pseudonymous evidence for request handling and preventing repeated trials; restricted to those purposes and removed when no longer necessary or legally required. Hashes are not anonymous data.

9. Rights, deletion, security, and changes

Send access, correction, deletion, portability, objection, or other applicable rights requests to team@shopideck.com, identifying Less Time Marketing and your store. The general policy gives jurisdiction-specific rights and response periods. Shopify customer requests are checked within this app's scope: because it does not store Shopify customer records, the response reports that absence where applicable. That response does not decide whether Bot Cleaner holds the same person's data.

For Meta data deletion, disconnect in the app, remove access in Meta, or use the public deletion instructions linked below to request deletion of connection data. This website provides instructions and contact, not an automated Meta callback or generated confirmation-code service. A Meta callback and status URL, if configured in the app, are separate app functions.

Security measures include HTTPS, AES-256-GCM encryption of stored social tokens, minimum necessary access, and audit records. Incidents affecting personal data are notified without undue delay as required; notification to an authority within 72 hours applies where the law requires it, not to every technical incident. The service is for adult business users. Material privacy changes are communicated in the app or by email and any necessary new authorization is obtained before the changed use.