Privacy Policy Effective Date: November 6, 2026 Pixel Labs, LLC d/b/a Helium10 (“Pixel Labs”) owns and operates the Helium10 business, including the Helium10 platform, analytics, information, applications, websites and other products and services (the “Services”, as defined in the Terms & Conditions). All references to “we”, “us”, this “website” or this “site” refer to Pixel Labs. Capitalized terms used, but not defined, in this Privacy Policy are defined in the Terms & Conditions. This Privacy Policy is supplemented by and subject to the Terms & Conditions. Our Services are designed for businesses and are not intended for personal, family or household use. Accordingly, we treat all personal information covered by this Privacy Policy, including information about any visitors to our website, as pertaining to individuals acting as business representatives, rather than in their personal capacity. Still, we do receive limited personal information in providing the Services. So, this Privacy Policy describes: what personal information we collect; how we collect it; how we use it; how and when we share it; how to change and/or delete data; terms specific to certain types of users, such as European and California users and children under 13; terms specific to our Shopify app and our Google Ads and Meta Ads integrations; and how to contact us For information on third-party interest-based advertising conducted through our Services, please see the “Targeted Advertising” section below. Residents of the European Economic Area (“EEA”), which includes the member states of the European Union (“EU”), should consult the sections of this policy relating to the “EEA Residents” and “International Data Transfers” for provisions that may apply to them. California residents should consult the section titled “Your California Privacy Rights” for rights that apply to them. We reserve the right to change this Privacy Policy at any time. We may inform you about any revisions. All changes are effective on the date listed at the top of this page and will apply to all information that we have about you. Your continued use of the Services after any change is posted indicates your acceptance of this Privacy Policy and your continued consent to our processing of your Personal Information in the manner set forth herein. If at any point you do not agree to any portion of the Privacy Policy, you should immediately stop using the Services. Because this Privacy Policy contains legal obligations, we encourage you to review this Privacy Policy carefully. If you have any questions concerning this Privacy Policy or our information collection, storage and disclosure practices, please contact us at [email protected]. INFORMATION WE COLLECT Personal Information. “Personal Information” is information that may be used to directly or indirectly identify an individual (which in some cases, may include certain device information). The Personal Information we collect may include your (a) name, postal address, email address, and phone number; (b) Internet Protocol (IP) address, device ID or other persistent identifiers tied to your computer or device; and (c) information about your third party accounts (“Third Party Accounts”) you may choose to provide us for integration and analytics purposes. In general, Personal Information we collect includes, but is not limited to: Personal Information needed for you to be able to use the Services, including for establishing an account, logging in, paying for subscription to the Services, and linking your Third Party Accounts; Personal Information to contact and respond to you, including to provide you with results of our analytics services, reply to your inquiries, and keep in touch with you regarding features or matters of interest regarding the Services; Un-identifiable and aggregated Personal Information pertaining to your visits to and use of the Services and Site that help us maintain the appropriate features, functionality and user experience Usage Data. “Usage Data” is information passively or automatically collected by us through your use of the Services. Usage Data may be collected using cookies, web beacons, page tags or similar tools. All Usage Data is anonymous transactional data that is not associated with any users as individuals. Such Usage Data may include: your Internet Protocol (IP) address, mobile identifiers, browser type, and internet service provider (ISP); your operating system; which of our web pages you access and how frequently you access them; referral or exit pages; click stream data; and the dates and times that you visit the Services or Site. Customer Data. In order to provide you with our services, and with your permission (which you are providing if you link any of your Third Party Platforms to your Company account), we may collect and process data regarding your customers and their use of your services (“Customer Data”). How we treat that Customer Data is set forth in the “Customer Data” section of our Terms and Conditions. As set forth in more detail in our Terms & Conditions, you represent and warrant that all Customer Data was collected by you in accordance with your privacy policy and all applicable laws and that you have the right to provide us with such Customer Data for the purposes set forth in the Terms & Conditions. For clarity, your Third Party Platform accounts are governed by their own privacy policies and are not under the control of Company. HOW AND WHEN WE COLLECT INFORMATION Personal Information. We collect Personal Information at the time you provide it to us. We collect Personal Information through sign-up forms and as part of your registration for an account, product, or service, promotion, or contest from this website. In addition, we collect personal information from communications with site visitors as well as from third-party outside sources including data brokers and aggregators. Usage Data. We use cookies when you sign in to keep track of your personal session. We also use cookies to track your activity on the Services, including your interactions with emails we send, and via social media platforms, third-party platforms, applications, integrations, and services of our marketing partners to provide you with the optimal experience. This data may be passively or automatically collected (that is, gathered without your actively providing the information) using various analytics and reporting technologies, such as cookies, web beacons, locally stored objects, and mobile device identifiers and SDKs, and other similar methodologies as well as similar technologies developed in the future. “Do Not Track” Requests. Some Web browsers have a “Do Not Track” feature that signals to websites that you do not want to have your online activity tracked. Because each browser communicates “Do Not Track” signals differently, we do not respond to “Do Not Track” signals at this time. HOW WE USE INFORMATION We may use your Personal Information and Usage Data to take actions you request and for the basic purposes of the Services. We may use your Personal Information in connection with other products or services we may offer, with our internal reporting for this site (such as security assessments), or to contact you with promotions regarding other products or services offered by us, our affiliated entities or our third party partners. We may, for example, use aggregated Usage Data information to optimize the Services or to evaluate the success of particular marketing and advertising campaigns or search engine optimization strategies. We may also send you messages related to certain features or your activity on this site. We may also send you news or updates about changes to our Services. By default, you will receive these messages via email. We may use publicly available Personal Information posted on social media profile information including photos for purposes of assisting us, and our marketing partners with marketing and advertising activities and with contact management. We may use Usage Data without restriction in our sole discretion for administrative and optimization purposes, such as to improve the Services and personalize ads (as described more particularly below under “Targeted Advertising”). We may combine and use the Personal Information and Usage Data we collect from all services and products offered by us and our Affiliated Entities over various websites to provide, protect, and improve them, and to develop and offer new services and products. We will treat you as a single user of these combined services and products. HOW AND WHEN WE SHARE AND DISCLOSE INFORMATION General Disclosure Policy. We may share and disclose your Personal Information as described below. We may share and disclose Usage Data without restriction, such as in the ways described below. Affiliated Entities. “Affiliated Entities” are entities that we legally control (by voting rights) or that control us. We may provide your Personal Information and Usage Data to any affiliated entities we may have, including our subsidiaries. Service Providers. We may provide access to your Personal Information and Usage Data to trusted service providers that assist us with the operation and maintenance of the Service. For example, we may contract with third parties to facilitate purchases from the Services, process payments, host our servers, provide security, and provide production, fulfillment, optimization, analytics, reporting, and software maintenance and development services. Our service providers will be given access to your information only as is reasonably necessary to provide the services for which they are contracted. Successors. If we sell or otherwise transfer part or all of our business or assets to another organization, such as in the course of an acquisition, merger, bankruptcy or liquidation, we may transfer your Personal Information and Usage Data. Legal Process, Enforcement and Security Notice. We may disclose your Personal Information and Usage Data if we have a good faith belief that access, use, preservation or disclosure of such information is reasonably necessary (i) to satisfy any applicable law, regulation, legal process or enforceable governmental request (such as for example, to comply with a subpoena or court order), (ii) to detect, prevent, and address fraud or other illegal activity, and (iii) to investigate, respond to, or enforce violations of our rights or the security of this site. With Your Consent. We may share your Personal Information with other parties with your consent. Connected AI Tools (MCP). If you connect a third-party AI application, agent, or tool (an “AI Client”) to your account through the Model Context Protocol (“MCP”) or a similar interface, you direct us to transmit the data you query to that AI Client and its provider, and we share that data at your direction to enable the connection you requested. Once transmitted, the data is controlled and processed by the AI provider under its own terms and privacy policy, including its data-retention and model-training practices, over which we have no control. Data transmitted may include information sourced from or derived from third-party platforms, including Amazon (such as Best Sellers Rank, search volume, ASIN-level metrics, and keyword data). If we later offer a managed MCP gateway or proxy service through which your data is routed, we will update this Privacy Policy and our subprocessor disclosures to reflect that change. Analytics Partners. We may participate with third party analytics partners to monitor and analyze Web traffic and to keep track of user behavior on this site. Transfer Outside Country of Residence. In general, any Personal Information we may collect may be stored and processed in our servers located in the United States or in any other country in which we, or our affiliates, subsidiaries, or agents maintain facilities. By using this site, you consent to any such transfer of Personal Information outside your country of residence to any such location. TARGETED ADVERTISING We engage certain third-party service providers to serve advertisements on our behalf across the Internet and to provide analytics services. We may also participate in third-party affiliate advertising and allow third-party affiliate links to be encoded on some of our pages. This means that we may earn a commission when you click on or make purchases via third-party affiliate links. Our advertisers or the ad networks that serve advertisements may utilize cookies or other similar tracking technologies (including within the ads) to collect anonymous information from you such as your device identifiers, advertising IDs, and IP address, web browser, actions you take relating to the ads, any links you click on, and conversion information. This information may be used by us, our service providers and their clients in aggregated, anonymous form to, among other things, analyze and track aggregated data, determine the popularity of certain content or products, measure the effectiveness of ad campaigns, determine the proper amount of repeat views of a given ad, and deliver advertising and content targeted to your interests on our Services and outside of our Services on other websites (also known as “interest-based advertising”). These service providers are prohibited from collecting any Personal Information from you and we do not share any of your Personal Information with them. You have a choice about participating in interest-based advertising. If you wish to opt out of such participation, you have a few options: On your mobile device, you can visit https://youradchoices.com/appchoices to learn about and download the Digital Advertising Alliance’s opt-out app, which allows you to opt your mobile device out of interest-based advertising from participating companies. Your device settings may allow you to limit the use of information from your device in interest-based advertising through your browser’s settings (such as under the “Security & Privacy” settings of the Safari app on an iOS device) or an “Opt Out of Interest-Based Ads” setting (on an Android device). You can learn more about advertising networks and interest-based advertising, and your ability to opt out, by visiting the Digital Advertising Alliance at www.aboutads.info/choices or the Network Advertising Initiative at www.networkadvertising.org/choices. In providing you with transparency and choice regarding interest-based advertising, we are acting in accordance with our commitment to the Digital Advertising Alliance’s Self-Regulatory Principles. To learn more about these Principles, please visit http://www.aboutads.info/consumers. CHANGING AND DELETING PERSONAL INFORMATION Under certain laws, including as described below with respect to the GDPR and CCPA, you may have the right to: obtain confirmation that we hold Personal Information about you, request access to and receive information about the Personal Information we maintain about you, receive copies of the Personal Information we maintain about you, update and correct inaccuracies in your Personal Information, object to the continued processing of your Personal Information, and have the Personal Information blocked, anonymized or deleted, as appropriate. The right to access Personal Information may be limited in some circumstances by local law, including as described above under California law. If you qualify, in order to exercise these rights, please contact us as described under “Contact Us”. You may opt out of promotional communications by sending us an email at the email address below under “Contact Us”. We may ask you to provide additional information for identity verification purposes, or to verify that you are in possession of an applicable email account. Please understand, however, that we reserve the right to retain an archive of such Personal Information for a commercially reasonable time to ensure that its deletion does not affect the integrity of our data; and we further reserve the right to retain an anonymous version of such Information. TERMS FOR SPECIFIC TYPES OF USERS EEA Residents. This section of the Privacy Policy is applicable to residents of the EEA. The EEA consists of the member states of the EU, i.e., Austria, Belgium, Bulgaria, Croatia, Republic of Cyprus, Czech Republic, Denmark, Estonia, Finland, France, Germany, Greece, Hungary, Ireland, Italy, Latvia, Lithuania, Luxembourg, Malta, Netherlands, Poland, Portugal, Romania, Slovakia, Slovenia, Spain, Sweden, and the United Kingdom, and Iceland, Liechtenstein, and Norway. This section also applies to residents of Switzerland and the United Kingdom. Residents of the EEA, Switzerland and the United Kingdom are referred to here as “EEA Residents”. Since May 25, 2018, all processing of Personal Information of EEA Residents is performed by us in accordance with the General Data Protection Regulation (2016/679) of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons regarding the processing of Personal Information and on the free movement of such data (“GDPR”). Under the GDPR, we are the controller and a processor of the Personal Information of EEA Residents. Our purpose for collecting and processing Personal Information from EEA Residents is to obtain contact information, to substantiate such information and to provide the Services. The legal basis for collecting Personal Information is your consent. You may withdraw consent for obtaining such communications by following the “Unsubscribe” instructions on any communication or by contacting us at [email protected]. If you are a resident of the EEA and believe that we have Personal Information about you, and you wish to access or correct the Personal Information that we have about you or have any questions relating to the processing of your Personal Information, please contact us at [email protected]with the subject line “GDPR Data.” International Data Transfers. If you are resident outside the United States, including in the EEA, we transfer Personal Information provided by you for processing in the United States. Under the GDPR, we are considered a “controller” and a “co-processor” of the Personal Information of EEA Residents. By providing Personal Information to us for the purpose of setting up an account, obtaining Services, or adding yourself to our contact lists, you consent to the transfer of your Personal Information to the United States. The transfer of your Personal Information to the United States is necessary for the performance of a contract between you and us for obtaining Services. California Consumers. This section pertains to the rights of individuals or households in California (“California consumers”). Under certain circumstances, California Civil Code Section 1798.83 states that, upon receipt of a request by a California consumer, a business may be required to provide detailed information regarding how that business has shared that customer’s Personal Information with third parties for direct marketing purposes. However, the foregoing does not apply to businesses like ours that do not disclose Personal Information to third parties for direct marketing purposes. The CCPA (California Civil Code Section 1798.100 et seq.) provides California consumers with additional rights regarding Personal Information that identifies, relates to, describes, is capable of being associated with, or could reasonably be linked, directly or indirectly with a particular consumer or household. The categories of Personal Information we collect are generally described above but differ for individual consumers depending on the services used by such consumers. Under the CCPA, qualifying California consumers may have the following rights: Right to Know and Right to Delete. A California consumer has the right to request that we disclose what Personal Information we collect, use, disclose and sell. A California consumer also has the right to submit requests to delete Personal Information. When we receive a valid request to know or delete from a California consumer, we will confirm receipt of the request within 10 days and provide information about how we will process the request, including our verification process. We will respond to such requests within 45 days. Right for Disclosure of Information. A California consumer may also submit requests that we disclose specific types or categories of Personal Information that we collect. Under certain circumstances, we will not provide such information, including where the disclosure creates a substantial, articulable and unreasonable risk to the security of that Personal Information, customers’ account with us, or the security of our systems or networks. We also will not disclose California consumers’ social security numbers, driver’s license numbers or other government-issued identification numbers, financial account numbers, any health insurance or medical identification numbers, or account passwords and security questions and answers. Submitting Requests. If you are a California consumer and would like to make any requests under the CCPA, please see the “Changing and Deleting Personal Information” section. Verifying Requests. If we receive any request, we will use a two-step process for online requests where the California consumer must first, clearly submit the request and then second, separately confirm the request. We will use other appropriate measures to verify requests received by mail or telephone. To verify a request, a California consumer must provide a business with sufficient information to identify the consumer, such as name, e-mail address, home or work address, or other such information that is on record with us so that we can match such information to the Personal Information that we maintain. Do not provide social security numbers, driver’s license numbers, account numbers, credit or debit card numbers, medical information or health information with requests. If requests are unclear or submitted through means other than outline above, we will provide the California consumer with specific directions on how to submit the request or remedy any deficiencies. If we cannot verify the identity of the requestor, we may deny the request. Children Under 13. We are committed to preserving online privacy for all of its website visitors, including children. Consistent with the Children’s Online Privacy Protection Act (COPPA), we do not knowingly collect any personal information from children under the age of 13, and we delete any such information we become aware of. If you are a parent or guardian and you believe your child has provided us with Personal Information, please contact us as provided below under “Contact Us,” and be sure to include in your message the same login information that your child submitted. SHOPIFY APP, GOOGLE ADS, AND META ADS INTEGRATIONS Scope. This Section 8 applies to our Helium10 app for Shopify, our Google Ads and Meta Ads integrations, and the features in Helium10 that use data from them (together, the “D2C Services”), and to the information we process through them (“D2C Data”). D2C Data includes data we receive from your Shopify store, including through our web pixel (“Shopify Data”); data we receive from Google APIs (“Google User Data”); and data we receive from Meta’s platform (“Meta Data”). If this Section 8 conflicts with any other part of this Privacy Policy, this Section 8 controls for the D2C Services and D2C Data. Our Role. If you use the D2C Services, we call you a “merchant” in this Section 8. You decide which sources to connect and which optional features to turn on. For personal information about your shoppers (“Shopper Data”), we act as your service provider and processor: we process it on your behalf and under your instructions, which include the features you turn on. Your own privacy policy governs how you collect and use your shoppers’ personal information. Shoppers who wish to exercise privacy rights over Shopper Data should contact you, and we will help you respond. If you opt in to model improvement under Section 8(d)(4), we use Shopper Data for that purpose only after we de-identify it. We maintain and use de-identified data only in de-identified form and do not attempt to re-identify it. To the extent data protection law treats that use as our own purpose, we act as an independent controller for that use. Information We Collect. Shopify Data. Through the Shopify Admin API we collect: store information; order information, including amounts, line items, discounts, refunds, transactions, fees, shipping region and country, customer IDs, and the pages a shopper visited before purchasing; product, variant, inventory and location information; fulfillment orders; customer information, such as order count, total spent, status, tags and segments; Shopify Payments payouts and balance transactions, such as processing fees, shipping label fees and chargebacks; and Shopify reports, such as sales and sessions. Web Pixel. Our app places a web pixel on your storefront and checkout pages. It collects standard storefront and checkout events; Shopify client, customer, session and cart identifiers; a visitor identifier we assign; advertising click identifiers (such as gclid, gbraid, wbraid, fbclid, ttclid and msclkid); UTM parameters; advertising cookies (such as _fbp, _fbc, _ga, _gcl_au and _ttp); page URLs and referrers; and device type, operating system, browser, time zone and IP address. Where consent is required, the pixel loads only after the shopper consents to analytics and marketing. It does not load for shoppers who opt out of the sale or sharing of their personal information, and we discard any event received without analytics consent. To attribute orders across visits, the pixel stores in the shopper’s browser advertising click identifiers and UTM parameters (7 to 90 days, depending on the platform), a history of up to 200 advertising clicks (90 days), the visitor identifier and linked identifiers (365 days), and a session identifier (for the session). Shopper Contact Information. We collect shopper names, email addresses, phone numbers and street addresses only when you use a feature that needs them and Shopify has approved our access to them. We store email addresses and phone numbers in hashed form, unless a feature you use needs them readable, such as a list of shoppers for you to contact, and we tell you which features use them. Google User Data. When you connect a Google Ads account, you authorize us through Google’s OAuth process to access: the email address of the Google user who authorizes the connection; Google Ads account information, such as account ID, name, currency, time zone and status; your campaigns, ad groups, ads, keywords, assets, audiences, budgets and other settings; performance reports, such as spend, impressions, clicks, conversions, conversion value, revenue, gross profit and cost of goods sold, by campaign, ad group, ad, keyword, search term, asset, product and click (gclid); product status; and Google Ads recommendations. You may also give a connection a nickname. Meta Data. When you connect a Meta account, you authorize us through Meta’s login to access: your Meta user ID, name, two-factor authentication status, and the permissions and tasks you grant us; the businesses, ad accounts, Facebook Pages, Instagram accounts and Meta Pixels you give us access to; campaign, ad set and ad structure, settings, targeting and creative content, such as headlines, text, links, images and videos; audiences you choose to manage through the D2C Services; and ad performance data, such as spend, impressions, clicks, purchases and purchase value. How We Use D2C Data. Subject to the rules for each source in Section 8(f), we use D2C Data to: provide the D2C Services you use, such as dashboards and reports, profit and sales analytics, attribution of orders to marketing, forecasts, alerts and recommendations; make changes in your connected advertising accounts that you approve, one at a time or through rules you set up, such as creating or editing campaigns, ads, audiences, budgets, bids and other settings; provide AI features you choose to use, and send data to AI assistants and other services you connect, as described in Section 8(e); maintain, secure and improve the D2C Services, including troubleshooting and preventing abuse, and, if you opt in, improving the models behind our features, such as attribution, forecasts, recommendations and AI features; show your D2C Data alongside your other data in your Helium10 account, such as your Amazon data; and comply with law and enforce our terms. Features You Turn On. Some features send D2C Data outside Helium10 at your direction. For each, we send only the data the feature needs and keep a record of your direction. You can turn a feature off at any time, and we then stop sending data. These features include: AI assistants and other AI Clients you connect through MCP or similar interfaces, as described in Section 4(g); Amazon Marketing Cloud: we send hashed email addresses and phone numbers of your shoppers, with order information, from your Shopify Data to your own Amazon Marketing Cloud instance, so you can measure how your customers overlap with your Amazon audiences and avoid advertising to customers you already have; customer lists for advertising platforms you connect, such as Meta Custom Audiences or Google Customer Match: we send hashed contact information from your Shopify Data to the advertising account you choose, for example to exclude existing customers from your ads; conversion data for advertising platforms you connect, such as Meta’s Conversions API or Google Ads enhanced conversions: we send order and event data from your Shopify Data so the platform can measure and optimize your ads; and exports and integrations you request. Features 2 to 4 use only Shopify Data. These features exclude shoppers who have opted out of the sale or sharing of their personal information or, where consent is required, have not consented to marketing. Data you direct us to send is then governed by the recipient’s terms and privacy policy. Rules For Each Source. The rules below apply to each source’s data, including when a feature combines data from more than one source and when the data is anonymized, aggregated or derived. When we show results from more than one advertising platform, we also show each platform’s results separately. Shopify Data. We use Shopify Data only to provide the D2C Services to the merchant it relates to, as described in this Privacy Policy, and for purposes you choose, such as the features in Section 8(e). We transfer it to others only as needed to provide the D2C Services or as you expressly authorize or as required by law. Features such as attribution and forecasts may use models fit to your own store’s data to produce your results; by using those features, you agree to that use. We use Shopify Data to train or improve models that serve other merchants only if you opt in. We do not use Shopify Data for competitive benchmarking, and we contact your shoppers only if you turn on a feature that does so on your behalf. Google User Data. Helium10’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular: We use Google User Data only to provide or improve user-facing features of the D2C Services, such as reports, analytics, attribution, recommendations, AI features and the changes you approve. We transfer Google User Data only to provide or improve those features with your consent, such as to an AI Client you connect; for security purposes, such as investigating abuse; to comply with applicable law; or as part of a merger, acquisition or sale of assets after obtaining your explicit prior consent. We do not transfer or sell Google User Data to advertising platforms, data brokers or information resellers. We do not use or transfer it to serve ads, including retargeting and personalized or interest-based advertising, or to determine creditworthiness or for lending. Our personnel do not read Google User Data unless you agree, it is necessary for security purposes (such as investigating a bug or abuse) or to comply with law, or the data is aggregated and used for internal operations. We use Google User Data to improve models that serve other merchants only if you opt in. Meta Data. We access Meta Data as your technology provider, on your behalf and at your direction. We use it only to provide the D2C Services to you, including to measure, optimize and manage your Meta campaigns, and not for our own purposes or for any other merchant. We use Meta advertising data only in aggregate and anonymous form, keep each merchant’s Meta Data separate, use it to improve models only for your own account, and allow only you and people acting on your behalf to access it. We do not use Meta Data to build or augment user profiles, to retarget on or off Meta, or to target or optimize campaigns on other advertising platforms, and we do not attempt to re-identify, de-anonymize or reverse-hash it. We share Meta Data only with you; with our service providers, as needed to provide the D2C Services to you; with your service providers, such as an AI Client, when you expressly direct us to, and we keep a record of your direction; and as required by law. We do not share Meta user IDs, access tokens or app secrets except with service providers that help us build, run or operate the D2C Services. What We Do Not Do. We do not sell, rent or license D2C Data to third parties. We do not allow AI model providers or other service providers that process D2C Data for us to use it for their own purposes, including to train their models. We do not use D2C Data to make eligibility decisions about anyone, such as for credit, lending, housing, employment, insurance, education or government benefits; for surveillance; or to discriminate against people based on personal characteristics. We do not use Shopper Data to make decisions about shoppers that have legal or similarly significant effects on them. Storage, Security and Service Providers. We store D2C Data in the United States. We use service providers for cloud hosting, data storage and processing, logging and monitoring, customer support and AI models. Before they receive D2C Data, they must agree in writing to process it only on our behalf and at our direction to provide services to us, and for no other purpose; to protect it at least as strictly as this Privacy Policy and the terms of Shopify, Google and Meta require; to keep it secure and confidential; to bind their own service providers to the same terms; and to delete it when they stop providing services to us. We list our service providers at [service provider list URL]. We encrypt D2C Data in transit and at rest, including backups and the access tokens for your connected accounts. We limit access to authorized personnel who need it, require multi-factor authentication and strong passwords, log access, keep production data out of test environments, and maintain data loss prevention and security incident response procedures that cover the D2C Services. You can report a security vulnerability to [security contact]. Retention and Deletion. Retention. We keep raw web pixel events for up to 2 months and the details of each connection while it is active. We keep other D2C Data for up to 25 months from the date of the order, event or activity it describes, unless you ask us to keep it longer for features you use or a shorter period below applies. Deleted data may remain in encrypted backups until they are overwritten, within [35] days. Shopify Data. If you uninstall the app, we delete your Shopify Data within 30 days. If you disconnect your store in Helium10 but keep the app installed, we stop collecting new data from it and keep existing data for the periods above unless you ask us to delete it. You can ask us at any time to delete your Shopify Data, give you a machine-readable copy of it, or correct it, and we will do so within 30 days. When a shopper asks you to delete or provide their personal information and Shopify sends us the request, we delete it, or provide it to you, within 30 days. If you close your Helium10 account, we delete your Shopify Data within 30 days. Google User Data. If you disconnect a Google Ads account in Helium 10, we revoke our access immediately and delete the related Google User Data after 7 days, unless you reconnect it within those 7 days or it is still connected through another of your connections. If you remove our access in your Google account settings, we delete the related Google User Data within 30 days unless you reconnect. You can also ask us to delete it at any time. Meta Data. Anyone can ask us to modify or delete Meta Data about them by emailing [email protected] with the subject “Meta Data Deletion Request”, or through Facebook by following the instructions at https://www.helium10.com/meta-data-deletion/. After verifying the request, we act on it as soon as reasonably possible and in any case within 30 days. We also delete your Meta Data within 30 days after you disconnect your Meta account in Helium 10 or close your Helium 10 account, and within 30 days after our access is removed in Meta or expires, unless you reconnect. Data Sent at Your Direction. Turning off a feature in Section 8(e) stops further sending. Data a recipient already holds is subject to the recipient’s terms, and you can ask the recipient to delete it. Changes. Before we use D2C Data in a new way or for a purpose not described in this Section 8, we will update this Privacy Policy and notify you. Before a new use of Google User Data, we will also ask you to consent to the updated policy. Before materially changing how we process Meta Data, we will complete Meta’s App Review. Before a new use of Shopify Data that requires Shopify’s approval, we will obtain it. CONTACT US If you have any questions regarding this Privacy Policy, please contact us at: Pixel Labs, LLC Attn: Legal Department 18200 Von Karman Avenue Suite No. 950 Irvine, California 92612 Contact: [email protected] with a copy to: [email protected]