Privacy policy
Last updated: on publication
This English version is provided for information only. In case of divergence, the French version prevails.
1. Who we are
The Laier platform and the laier.io website are published by RUWAD, a société par actions simplifiée with share capital of €1 000, registered with the Paris trade and companies register under number 945 188 605, registered office: 60 rue François Ier, 75008 Paris, France (“Laier”, “we”).
Laier is the controller for the data described in this policy: user account data, website browsing data, prospects and billing.
For the advertising and analytics data our customers connect to the platform (Google Ads, Google Analytics 4, Google Merchant Center, Meta Ads accounts) and for the data of the Shopify stores they connect, Laier acts as a processor within the meaning of Article 28 GDPR: that processing is governed by the data processing agreement published at laier.io/en/dpa and entered into with each customer, which prevails over this policy for such data.
Data protection contact: Sameh Mohamed, reachable at hello@laier.io.
2. What data we collect
- Account data: first name, last name, business email address, company, role, hashed password or OAuth identifier.
- Advertising platform connection data: OAuth tokens stored encrypted, identifiers and names of the connected advertising accounts. We never access your Google or Meta passwords.
- Synchronised advertising and analytics data: campaigns, budgets, performance metrics, product data, aggregated audience data — on behalf of our customers.
- Assistant interactions: conversations, generated reports, pinned items.
- Usage and technical data: action logs, IP address, browser type, pages viewed.
- Prospects: data submitted through our forms — first name, last name, business email, company.
No special category of data within the meaning of Article 9 GDPR is required for the service; please do not submit any through the assistant.
3. Purposes and legal bases
| Purpose | Legal basis (Art. 6 GDPR) |
|---|---|
| Creating and managing your account, providing the platform, connecting your advertising accounts, generating analyses and recommendations | Performance of the contract |
| Billing and accounting | Legal obligation |
| Security, abuse prevention, logging | Legitimate interest — securing the service |
| Product improvement (aggregated usage statistics) | Legitimate interest — improving the service |
| B2B prospecting and communications about our offering | Legitimate interest, with a simple and free right to object at any time |
| Newsletter and opt-in content | Consent, withdrawable at any time |
4. Recommendations and automated decisions
Laier uses artificial intelligence models to analyse your advertising data and formulate recommendations. No decision producing legal effects is taken on a solely automated basis within the meaning of Article 22 GDPR: every action on your advertising accounts is subject to your prior express approval.
Data sent to model providers is used solely to generate the requested response. It is not used to train artificial intelligence models, by Laier or by its providers.
5. Google data
When you connect a Google account — Google Ads, Google Analytics 4, Google Merchant Center — through OAuth:
- Access: Laier reads campaign, performance, analytics and product feed data from the accounts you explicitly choose to connect, and, once you approve an action, writes to execute it.
- Use: this data serves solely to provide the visible features of the platform. It is never sold, never used for advertising purposes by Laier, and never used to train AI models.
- Storage: OAuth tokens are encrypted at rest; synchronised data is hosted in the European Union; tokens are deleted as soon as the account is disconnected.
- Sharing: no Google data is transferred to third parties, apart from the technical processors mentioned in section 8, strictly as required to operate the service.
- Revocation: you may disconnect an account at any time from the platform, or revoke Laier’s access from your Google account security settings.
Laier’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
6. Meta data, Shopify data and deleting your data
When you connect a Meta Ads account, Laier accesses campaign and performance data for the accounts you authorise, under the same conditions of use, storage and sharing as described in section 5.
When you connect a Shopify store, Laier has read-only access to that store’s orders, products, inventory, discounts, marketing events and Shopify Payments payouts, in order to compute the margin and advertising return of your campaigns. Laier does not request your customers’ name, email address, phone number or postal address: an order is only linked to a Shopify customer ID. This data is never sold nor used to train AI models. Erasure requests that one of your customers sends through Shopify are carried out within 30 days; when the app is uninstalled, all of the store’s data is deleted upon Shopify’s erasure request, and within 30 days at the latest.
To delete your data: disconnect the relevant account from the platform settings — access tokens are deleted immediately and synchronised data within 30 days; or write to hello@laier.io specifying your account, with deletion confirmed within 30 days. Deleting your Laier account deletes all associated data within the same timeframe, save for statutory retention obligations.
7. Retention periods
| Data | Period |
|---|---|
| User account | Term of the contract + 30 days |
| OAuth tokens | Deleted as soon as the account is disconnected |
| Synchronised advertising data | Term of the contract + 30 days |
| Shopify store data (orders, products) | While the store is connected; deleted when the app is uninstalled, within 30 days at the latest |
| Assistant conversations | Lifetime of the account |
| Technical and security logs | 12 months |
| Billing records | 10 years (Art. L.123-22 French Commercial Code) |
| Prospects | 3 years from the last contact |
8. Processors and recipients
Your data is never sold. It is processed, strictly as required to operate the service, by technical providers acting on Laier’s behalf, in the following categories: hosting and database, artificial intelligence model providers, customer relationship and emailing tools, payment provider.
The detailed list of processors, their location and the applicable safeguards are provided on request at hello@laier.io and listed in the data processing agreement published at laier.io/en/dpa.
9. Transfers outside the European Union
Some providers are located in the United States. Transfers are framed by certification under the EU–US Data Privacy Framework or, failing that, by the European Commission’s standard contractual clauses, supplemented where appropriate by additional measures.
10. Security
Laier implements appropriate technical and organisational measures to protect your data: encryption of exchanges and access tokens, access control, per-customer data partitioning and logging.
11. Your rights
You have rights of access, rectification, erasure, restriction, portability and objection, the right to withdraw consent at any time, and the right to give post-mortem instructions. Exercise them at hello@laier.io — response within one month. You may lodge a complaint with the CNIL.
12. Cookies
The platform uses only strictly necessary cookies — session, authentication, preferences — exempt from consent. The laier.io marketing website does load analytics and advertising trackers through Google Tag Manager: audience measurement (Google Analytics) and advertising conversion measurement (Google Ads, Meta, LinkedIn, TikTok). These trackers are disabled by default and fire only after your explicit consent, collected through the Axeptio consent management platform, where refusing is as simple as accepting. You can change or withdraw your choice at any time from the widget displayed on the site.
13. Changes
In the event of a substantial change to this policy, account holders will be informed by email or through the platform at least 30 days before it takes effect.
14. Contact
hello@laier.io · RUWAD, 60 rue François Ier, 75008 Paris, France.