Open the app
Legal

Privacy Policy

Last updated October 30, 2026. Applies to Shoptician at shoptician.com and app.shoptician.com, and to app.onlinelabs.io until it moves there.

Draft. Under review before final publication.

Who we are

Shoptician is an app from Online Labs. It is run by Dan Kabakov, trading as Online Labs. Dan is an individual entrepreneur based in Georgia. Contact: dan@onlinelabs.io.

What the app does

Shoptician audits Google Ads accounts for ecommerce stores. You connect your account. The app reads your data and scores it. It never changes your account.

Data we collect

  • Account data. Your email, name, role and company if you add them.
  • Business profile. One per Google Ads account. Site URL, feed URL, vertical, brand terms, competitor domains, shipping countries, main language, store type, catalog size, order value, ROAS goal, ad spend, gross margin, monthly store orders and peak months. Only what you type in.
  • Google Ads data. Campaign settings, keywords, search terms, ads, assets, audiences, conversion setup and performance numbers. Also the names and IDs of the accounts your Google login can see.
  • Google Ads user list. The app reads the emails of the people who can access your Ads account. It uses them for one check: does an admin have an email on your store's domain. It keeps only counts, whether that match exists and the part before the @ of shared inboxes like info@. Full emails are not stored.
  • Google account email. Read once during sign-in to confirm the connection works.
  • Merchant Center data. Only if you connect it. The list of your accounts, account issues and product statuses.
  • GA4 data. Only if you connect it. The list of your properties and counts of add to cart, checkout, purchase and lead events by channel.
  • Audit results. Scores, findings, your self-check answers and the share links you create.
  • Usage events. Signup, verification, connection and completed runs, with timestamps. Also which shoptician.com link brought you, if any.

How we access Google data

  • Google Ads. Google asks for the Google Ads scope. That scope allows read and write access. This app only sends read requests. It never creates, edits, pauses or deletes anything.
  • Merchant Center. Google has no read-only scope for it. The scope we ask for allows read and write. The app only reads.
  • GA4. Read-only scope.

Google API Services: Limited Use

Shoptician's and Online Labs' use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

  • We use Google user data only to provide and improve the audit features you see in the app.
  • We do not sell Google user data.
  • We do not use Google user data for advertising, including retargeting or personalized ads.
  • We do not use Google user data to train general AI models.
  • No person reads your Google user data unless you agree to it first, or when it is needed for security or to follow the law. The free review below is how you agree.
  • We only transfer Google user data to the service providers listed below, and only to run the features you use.

Free review by Dan

A report page has a button: "Send my report to Dan for a free review". Next to it is this sentence: "I agree that Dan Kabakov can see this report, keep my details in his CRM and email me about it." Nothing is sent until you click it. When you click it:

  • A read-only share link is made for that one report. You can revoke it any time in Settings.
  • Dan gets one email through Brevo. It holds your email, name, role, company, the account name, the result band, the account's Google Ads spend over the last 30 days, the top 3 failed checks and the link.
  • We store your agreement: which report, when, the link and the exact sentence.
  • The same details go to Online Labs' HubSpot account as a contact, a company and a deal, so Dan can follow up. The company record uses your store's domain from the business profile, or your email domain.
  • Dan may email you about that report. He sees nothing else.

Anonymous statistics

We may publish statistics across many audits. Examples are how often a check passes or the median score by spend band. Each figure comes from at least 50 accounts. It never names you, your store, your account or your campaigns. No single account can be picked out of it. Accounts that Online Labs manages for its own clients are left out. Nobody reads a single report to make these figures.

Service providers and what each receives

  • Cloudflare. Hosting, the database and token storage. At signup the domain of your email address goes to Cloudflare's DNS service to check that it receives mail.
  • Brevo. Sends your sign-in codes by email. It receives your email address and the code. It also sends the free review email to Dan, only when you ask for it.
  • HubSpot. Only when you ask for the free review. It receives your email, name, role, company, store domain, the account name, the result band, the 30 day ad spend, the top 3 failed checks and the share link.
  • Anthropic (Claude). Writes the plain summary of each report. It receives the check results with their details. Those can include campaign names, keyword and search term text, audience list names, conversion numbers, spend, Merchant Center issue titles and GA4 event counts. For the tools it also receives the account name. For AI Visibility it also gets a shopping question about your store, like the other AI engines below.
  • OpenAI, Google Gemini and Perplexity. Only for AI Visibility, and only for the engines we have turned on for the beta. Each one receives a shopping question built from your homepage topic. Gemini also receives your homepage address, title, headings and up to about 7,000 characters of its visible text. No Google Ads data goes to any of them.
  • SerpAPI. Only for Competitor Shopping. It receives your top 3 search terms by spend.
  • Google PageSpeed Insights. Receives the addresses of your top 3 landing pages to test their speed.
  • Google Fonts. Loads the app fonts. Google sees your IP address when fonts load.

Pages we load from your store

To check tags, consent, speed, trust signals and links, the app loads public pages directly:

  • Your homepage and your top 3 landing pages by spend. The user agent is a mobile Chrome browser on Android.
  • Your Google Tag Manager container script, when your page uses one.
  • Up to 6 sitelink addresses, to see if they work.
  • For AI Visibility: your site address with a desktop Chrome user agent and again with the GPTBot user agent, plus robots.txt and llms.txt with the user agent ShopticianBot.
  • For Feed Health: your product feed URL with a Googlebot user agent.

Where your data is stored

Everything is stored on Cloudflare. Reports and your profile live in a Cloudflare D1 database. Google access tokens live in Cloudflare Workers KV, separate from your reports. Data is sent over HTTPS.

What stays in your browser

  • Local storage keeps your sign-in session id, your theme choice and the Google Ads account you last picked. Session storage keeps a short id of the shoptician.com link you came from, until you sign in or close the tab.
  • While you connect Google, a short sign-in cookie proves the connection started in your browser. It lasts at most 10 minutes. The app sets no tracking cookies.

Emails from us

We send sign-in codes. We may also email you about your results or about Online Labs services, the company behind Shoptician. These emails use your email address and signup details only. They never use your Google user data, unless you asked for the free review. You can opt out any time by replying to any email.

How long we keep data

  • Your profile, reports and answers stay until you delete your account.
  • Google tokens stay until you disconnect Google or delete your account.
  • Sign-in sessions expire after 30 days.
  • Sign-in codes expire after 15 minutes.
  • Rate limit counters expire after 24 hours.
  • Cached account numbers expire after 30 minutes.
  • Free review details sent to HubSpot stay there after you delete your account in the app. Email dan@onlinelabs.io and Dan deletes them.
  • Cloudflare keeps restore points of the database for up to 30 days. Data you delete leaves the app right away. It can stay in those restore points for up to 30 more days, then it is gone.

Your controls

  • Export. Settings, then Data and privacy, then Export my data. You get a JSON file of everything we store about you.
  • Disconnect Google. Revokes access at Google and deletes the stored tokens. You can also remove access at myaccount.google.com/permissions.
  • Revoke share links. From the report or from Settings.
  • Delete your account. Settings, then Data and privacy, then Delete my account. It deletes your profile, business profiles, reports, answers, share links, review requests, events, tokens and sessions in the app right away. Restore points follow within 30 days.

You can also email dan@onlinelabs.io to ask for access, correction or deletion.

Share links

A share link lets anyone with the link read one report. It does not show your other reports. You can revoke it any time.

Children

The app is for businesses. It is not meant for anyone under 18.

Changes

We will post changes on this page and update the date above. Big changes get an email.