1. Who We Are
Shulman Analytics ("Service," "we," "us") is operated by Ranel Shulman. Shulman Analytics is a marketing analytics and reporting platform used by advertising and marketing agencies ("Agencies") to connect their own advertising and analytics accounts, calculate campaign performance metrics, and generate dashboards and reports for their own clients.
Contact: shulman.digital@gmail.com
2. Scope of This Policy — Two Different Roles
This Privacy Policy describes two different relationships with data, because they are legally different.
(a) Account holders. If you are a Platform Owner, an Agency Member, or a Client Viewer with a Shulman Analytics account, we are the controller for the account data described in Section 3.
(b) Data processed on behalf of an Agency. If an Agency connects its own advertising or analytics accounts to the Service, or installs our Browser SDK on its own client's website, the Agency — not Shulman Analytics — is the controller for that underlying advertising and website-visitor data. We process it solely as a service provider acting on the Agency's instructions, as described in Sections 4 and 5.
If you are a website visitor whose activity was captured through our Browser SDK, your relationship is with the website you visited and the Agency that manages its marketing, not directly with us — please direct any data requests about Section 4 data to that website/Agency.
3. Account Data We Collect (as Controller)
Depending on your role, we collect:
- Email address (every account type).
- For Platform Owner / Agency Members: a Google Account identifier (if you sign in with Google), an encrypted copy of your two-factor authentication secret, and hashed backup recovery codes. We do not store your Google password, and we never store your two-factor secret or recovery codes in plain text.
- For Client Viewers, one of two things applies, depending on how the Agency shared a dashboard with you (see Section 9 for the full distinction): either (i) a dashboard was shared with you as a protected link, in which case we collect nothing about you — the link itself is the only credential, and no account or session is created; or (ii) the Agency invited you by email to a full Client Viewer account, in which case we collect your email address and issue a session the same way described below.
- Session and device data (account holders only): an opaque session identifier and an optional "trusted device" identifier, stored in strictly-necessary cookies (see Section 10), so you don't have to sign in on every visit. Only a hashed form of each identifier is ever stored in our database — see Section 10 for exactly what the cookie itself contains.
- We do not collect your name or phone number for any account type unless you choose to provide it elsewhere (for example, in correspondence with us).
4. Browser SDK — What It Collects, Stores, and For How Long
Where an Agency installs our Browser SDK on a website it manages, the SDK runs in the website visitor's own browser and interacts with our systems as follows.
Storage in the visitor's browser. The Browser SDK itself never sets a cookie. It stores a small amount of attribution data in the browser's own localStorage: your first recorded marketing touch (source, medium, campaign, and any advertising click identifier) is kept for up to 400 days from when it was first recorded and is never refreshed after that; your most recent non-direct marketing touch is kept for 30 days, refreshed each time a new qualifying touch is recorded. A short internal cache of your cookie-consent state is kept for up to 5 minutes. This is the complete list — nothing else is written to localStorage by our SDK. This does not mean the website itself sets no cookies of its own; the Browser SDK simply plays no part in any cookies the website or its other tools may set.
No automatic detection. The Browser SDK does not automatically detect form submissions or purchases. A lead or purchase is only ever submitted to our servers when the website (directly, or through a Google Tag Manager integration) explicitly calls our lead- or purchase-capture function at the moment of a real conversion.
What a conversion request can contain, and what happens to each part. When a conversion is submitted, the request may include: the marketing touches described above; a form identifier/name (leads) or a transaction identifier, amount, currency, and items (purchases); and, optionally, custom fields the website chooses to send, including a section the website may use for personal fields such as a name, email, or phone number. We treat these differently:
- Marketing touches, the form identifier/name, and purchase transaction details are stored in our database, scoped to the Agency's project.
- The names of any custom fields the website sends are recorded in a per-connection "Field Registry," so the Agency can see which fields its own website is sending — this registry has no column to hold a field's value, only its name.
- The values of custom fields, and anything submitted in the personal-data section, are used only transiently to process the request and are never written to our database. We do not broadly describe this as storing "lead details" — only the specific items listed above are ever persisted.
- A short list of field names that look like credentials or payment data (for example, anything resembling a password, API key, card number, or bank account number) is additionally excluded from the Field Registry, as a courtesy on top of the point above — not because a field's value would otherwise be stored.
IP address. The visitor's IP address is used only to apply abuse-prevention rate limits, held in a short-lived cache for up to 60 seconds for that purpose. It is not written to our database, and our own application logs do not include it. We cannot make promises about standard network-level connection logging performed by our hosting infrastructure itself (see Section 8), which is outside our application's control.
We do not sell this data, and we do not use it for advertising.
5. Connection Credentials We Process
To operate the data-source connections an Agency sets up, we process the credentials needed to authorize them — for example, OAuth access and refresh tokens (Google Ads, Google Analytics, Meta Ads, and similar providers), API keys, and comparable provider-issued credentials. These are encrypted at rest using industry-standard encryption. A small number of connection settings that are identifiers rather than secrets — such as which Google Sheet an Agency has pointed us to, or the public site/write key used to identify a Browser SDK installation — are not treated as secrets, the same way a website's own analytics tracking ID isn't.
6. Google User Data — Google API Services User Data Policy
What we receive. Where an Agency connects Google Ads and/or Google Analytics (GA4), we access only the read-only scopes needed for reporting — Google Ads' advertising-data scope (campaign, spend, click, and conversion metrics) and Google Analytics' read-only analytics scope (site/property traffic and engagement metrics). We do not request, and have no access to, your Google account itself, other Google services, or any Google data beyond what these two reporting scopes expose.
How it's used and stored. This data is used solely to calculate and display campaign performance metrics inside the Agency's own dashboards and reports. It is stored in our production database the same way as data from any other connected provider, and is included in the routine encrypted backups described in Section 8. It is retained for as long as the connection and its project remain active, per Section 12, and can be deleted on request as described there — disconnecting the Google account stops new data from being collected (Section 12) but does not by itself delete what was already synced; a separate deletion request is needed for that.
Whether it reaches an external AI provider. Only where an Agency has enabled AI Analysis (Section 7) — either by requesting it explicitly, or by opting a project into automatic generation — do we send anything derived from this data onward. What we send is never the underlying Google records: it is a small set of already-calculated, aggregated numeric fields (a KPI key, value, comparison value, and percent change, for each KPI), alongside only the internal project and dataset identifiers needed to process the request — to Anthropic PBC, our AI-analysis vendor, which is listed as a sub-processor in Section 8. No raw Google Ads/Analytics records, and no personal data, are ever included in that request.
Shulman Analytics's use and transfer of information received from Google APIs to any other app adheres to the Google API Services User Data Policy, including the Limited Use requirements. We do not use Google user data for advertising, and we do not transfer it to any third party except the narrow AI-analysis case above and the infrastructure providers in Section 8, each of which processes it only on our instructions.
7. AI Analysis
AI Analysis can be turned on for a project in two ways: an Agency Member can request it explicitly at any time, or an Agency can opt a project into automatic generation, in which case a new analysis is produced right after that project's data finishes syncing — never on a blind schedule, and never unless the Agency has opted in.
When AI Analysis runs, we send a small set of already-calculated, aggregated numeric values — KPI figures, comparison values, and percentage changes (for example, "clicks: 1,204, up 8% vs. previous period") — to Anthropic PBC, our AI-analysis vendor, to generate written observations. We do not send raw advertising records, website-visitor data, names, emails, phone numbers, or any other personal data to this vendor — only aggregated numbers derived from the metrics described in Sections 4 and 6.
AI Analysis output is limited to four categories — Facts, Observations, Hypotheses, and Investigation Suggestions — and our system instructs it never to produce strategy, budget, or bidding recommendations. It is not professional advice, may be incomplete or incorrect, and should be independently verified before being acted on.
8. Infrastructure, Sub-processors & International Processing
We use the following infrastructure providers to operate the Service, each processing data only as needed to provide that infrastructure:
- Railway — application hosting, database (PostgreSQL), and caching (Redis).
- Cloudflare R2 — two separate purposes: encrypted daily backups of our production database (private, retained for 7 days on a rolling basis — see Section 12), and a second, separate store for resized preview copies of connected ad creatives, which is public-read by design so previews can be served quickly inside dashboards and does not contain visitor-level or lead data.
- UptimeRobot — automated uptime checks against our own public health-check endpoint only; it never receives Agency, client, or visitor data.
- Anthropic PBC — AI Analysis, as described in Section 7.
We do not use any third-party analytics, advertising, or error-tracking service on the Service itself, and we do not currently use any email-delivery provider.
These providers may process data on servers located outside Israel. Where that happens, we take reasonable steps to put appropriate contractual and security safeguards in place with the provider.
9. Client Viewers and Share Links
Not every Client Viewer has an account. An Agency can share a project's dashboard either way:
- As a protected link. The link itself is the only credential — we create no account, no session, and no cookie for the person viewing it. Anyone with the link can view that dashboard.
- As a full Client Viewer account. The Agency invites a specific email address, which signs in with a one-time code sent to that address (no password) and receives a session the same way described in Section 10, scoped only to the dashboards that Agency has granted.
An Agency can use either model, or both, depending on which projects it shares and how.
10. Cookies
Account holders (Platform Owner, Agency Members, and Client Viewers who sign in with a full account — see Section 9) are kept signed in using a small number of strictly-necessary cookies: a session cookie, and an optional "remember this device" cookie. Each cookie holds only an opaque, randomly-generated identifier — the value we can look up against our database to confirm it's valid is kept only on our server, never in the cookie itself. These cookies are set as Secure and HttpOnly (not readable by page scripts) and are scoped so they are only ever sent back to Shulman Analytics. The "remember this device" cookie, where used, expires after 7 days.
These cookies are not used for advertising or tracking across other websites, we set no other cookies beyond the ones described above (including no separate CSRF cookie — the limited cases that need CSRF protection use a different, non-cookie mechanism), and none of this is set by our Browser SDK on any Agency's own website — Section 4 explains how that data is handled instead.
11. Legal Bases for Processing
Depending on the processing activity, we rely on one or more of the following:
- performing our agreement with you or the Agency you're associated with;
- our legitimate interests in keeping the Service secure, preventing fraud and abuse, and operating and improving it;
- compliance with our legal obligations;
- your consent, where we rely on it;
- and, where we act as a processor on an Agency's behalf (Sections 2(b), 4, 5, and 6), the Agency's own instructions.
12. Data Retention & Deletion
We retain account and dashboard data for as long as your account or your Agency's workspace remains active.
Disconnecting a provider is not the same as deleting its data. Disconnecting a Google (or other provider) connection immediately stops any further data from being collected through it, but by itself it does not delete the data already synced from that connection — that data continues to exist in our database, as part of the project's dashboard history, until a separate deletion request (below) is made and completed.
Archived projects. An Agency can archive a project rather than delete it. Archiving is not a form of deletion: it stops new data from syncing in, but the project's existing dashboard and any client-facing share link keep working, frozen at their last synced state, for as long as the Agency's workspace remains active.
Requesting deletion. You can request deletion at shulman.digital@gmail.com, at three different levels: (i) the data synced from one specific provider connection (for example, your Google Ads or GA4 data for a project), (ii) your own personal account data, for Agency Members and Client Viewers — the single Platform Owner account is, by design, a permanent account that always exists and cannot itself be deleted, though its data can always be corrected, or (iii) an entire Agency workspace and everything in it. This is currently a manual process carried out by our team upon a verified request — it is not yet a self-service, automated feature. Once actioned, the data is deleted or irreversibly anonymized in our active database, except where we are legally required or permitted to keep limited records (for example, for security, fraud-prevention, audit, or legal-compliance purposes). Where applicable law gives you a right to request deletion and sets a specific response period, we will act within that period; otherwise we aim to act within a reasonable time.
Backups. We also keep routine encrypted backups of our entire database for up to 7 days on a rolling basis (Section 8). A backup created before your deletion request is processed may still contain the deleted data until that backup is itself rotated out — meaning a copy of your data can persist in backup storage for up to 7 additional days after active deletion completes, even though it is no longer visible or usable in the live Service.
Operational and security records. Sign-in session records and audit logs are not currently deleted on any fixed schedule and may be retained indefinitely for security and accountability purposes, separately from the data described above.
If you are a website visitor covered by Section 4, please direct deletion requests to the website/Agency you interacted with — they can also route a request to us.
13. Your Rights
Depending on your location, you may have rights to access, correct, export, or delete your personal data, or to object to or restrict certain processing. To exercise any of these rights, contact us at shulman.digital@gmail.com. We will respond within a reasonable time and in any event within the period required by applicable law.
14. Security
We encrypt stored authentication secrets and connection credentials, store only hashed (non-reversible) session and recovery-code values, and use workspace-level access controls and other technical and organizational measures designed to prevent unauthorized cross-workspace access. No method of transmission or storage is 100% secure, but we take reasonable technical and organizational measures to protect your data.
15. Children
The Service is intended for business use by advertising and marketing agencies and their staff and clients. It is not directed to children, and we do not knowingly collect personal data from children.
16. Changes to This Policy
We may update this Privacy Policy from time to time. If we make material changes, we will update the "Last updated" date above and, where appropriate, notify account holders directly.
17. Governing Law
This Policy is governed by the laws of the State of Israel, without regard to its conflict-of-laws principles.
18. Contact
Ranel Shulman
shulman.digital@gmail.com