Custodian privacy policy

Who is responsible

Custodian (also called Custodian AI or Custodian Commerce) is operated by Adrien Belhomme, France. For questions about your personal data or to exercise your rights, contact adrien@custodiancommerce.com. This policy covers the Custodian application and its Meta, TikTok, Pinterest, Google Ads and Merchant Center integrations. A merchant using Custodian remains responsible for the customer data they provide and for their own storefront privacy notice.

Data we process and why

We process workspace identity and access information, merchant-provided business and product details, content, media, messages and instructions to provide the features you use. Where you use commerce or messaging features, this can include customer, order and correspondence data supplied by your business. Technical request and security information is used to operate and protect the service.

On the public Custodian website, the Meta Pixel loads automatically. It records page views and named funnel steps, such as starting the store flow, viewing a generated preview and completing account registration, together with campaign parameters and basic device or browser information. We do not send product text, uploaded files or photos to Meta. The account email is sent only in hashed form (SHA-256), and only once advertising is allowed as described below. A refusal through the Cookies link does not stop the Meta Pixel.

Custodian also sends the same journey steps through its own advertising pixels for Google Ads (including YouTube, Search, Display, Discover and Gmail), Pinterest, Snapchat, X, Reddit, LinkedIn and Microsoft Advertising. In the European Economic Area, the United Kingdom, Switzerland and Québec, and whenever we cannot tell where you are, they wait until you select Allow. Elsewhere they are on by default until you decline. We estimate your country, and in Canada your province, from your network address, which we do not keep. When active, Custodian keeps the click identifier of the ad that brought you (such as gclid, ttclid or msclkid) in a first-party cookie named cust_ck for up to 90 days. Account registration, trial, plan and first payment are also sent from our servers to the networks you allowed, with the same event identifier as your browser so each is counted once; these server copies may include your hashed email, hashed name and billing country, your IP address and browser, and the networks' own cookies (such as _fbp, _ttp, _scid or _epik). Where your choice is asked first and you have not given it, only the Meta Pixel and its limited server copy run among these pixels. Google Analytics and its linked Google Ads audiences follow the same rule; when we cannot tell where you are, Google's own setting still enables them by default for visitors it locates in the United States, unless they decline. A refusal, or the Global Privacy Control signal of your browser, stops the other advertising pixels.

When TikTok measurement is active, the TikTok Pixel records page views and the same named journey steps, including store creation, account registration, trial, checkout and a Stripe-confirmed payment. It may receive limited step, plan, currency and payment-value parameters plus browser and campaign information. Our event parameters do not include your product text, uploaded files, photos or account email. Automatic Advanced Matching is enabled for this Pixel: TikTok may detect identifiers in forms or page content, such as email, phone number, name, location or account ID, hash them in your browser and receive them to match events with TikTok users for attribution, optimization and advertising audiences. The Pixel follows the same regional rule: it waits for Allow where your choice is asked first and is on by default elsewhere until you decline. You can change your choice through the Cookies link at the bottom of the landing page.

When you connect Meta, we process the account identifiers and permissions returned by Meta, the Pages and advertising accounts you can access, their names and identifiers, and access tokens. Depending on your selected feature, we process post text, links and media; campaign, ad set, ad and pixel identifiers; targeting and budget settings; publication receipts; and advertising performance data such as spend, impressions and clicks.

If you connect TikTok through Custodian, we process the account information and permissions TikTok returns, together with the media, captions, privacy choices, publication instructions, status and identifiers needed to upload a post as a draft or publish a post you have approved. We use this information only to provide the TikTok feature you choose. Connecting TikTok does not itself publish content.

If you connect a Pinterest business account, we receive the OAuth authorization, the permissions you grant, access and refresh tokens, your Pinterest account identifier and username, and the names and identifiers of your own boards. To publish the Pins of your marketing plan, we send Pinterest the product image, title, description, destination link to your store and the board you selected, and we keep the resulting Pin identifier, its publication status and the aggregate results of those Pins (such as impressions, saves and outbound clicks) to show you what they bring. We only access the boards and Pins of the Pinterest account you connected; we do not read other Pinners' data. Connecting Pinterest does not itself publish a Pin: Pins are published only for products and a schedule you approved, and you can pause publishing or disconnect at any time. We do not sell Pinterest data, use it for advertising outside the feature you use, or use it to train AI models.

If you connect Google, we receive the OAuth authorization, granted Google Ads and Merchant Center scopes, access and refresh tokens, and the identifiers of the Google Ads and Merchant Center accounts directly accessible to the connected Google user. Tokens are encrypted before storage and associated only with the relevant Custodian workspace. Account discovery is read-only: connecting Google does not create or change a campaign, alter a budget, spend advertising funds, or create or modify a product listing. If you later request a Merchant Center action, Custodian uses the authorization only to perform that requested action for the selected workspace.

These data let you select your business assets, prepare content, confirm publication, create or manage authorized advertising workflows, verify results and consult performance. Connecting an account does not itself publish content or start an advertisement. The paused-ad review composer creates objects in PAUSED status and cannot activate delivery.

Following your journey in the app

To fix what gets stuck, Custodian keeps what its server does for you: the pages and actions requested (the address without identifiers, the result and its duration), the steps of your store’s build, the emails sent to you, the payment steps, your plan’s limits and the errors. This logging relies on our legitimate interest in providing a service that works and keeping it secure; you can object by writing to us.

Once you are signed in to the app, what only your browser sees (the screens you open, your clicks, the waits, the error messages shown, network cuts) is sent to Custodian, and the screen is recorded: every field is hidden, as is what you write in a text area and private areas (messages, customers, orders); never what you type, never your payments. Turn it off at any time in Settings › My account › See where things get stuck, entirely or for the screen only; what the browser had sent is then deleted.

Before an account exists, on the home page, /start and the opening of your store, Custodian measures each visit itself, without any outside analytics tool: the city, region and country read from the IP address in an offline database (IP Geolocation by DB-IP), the address itself never kept; the device, the browser or app and the screen; the time spent with the page shown, the sections and films seen, the buttons and links touched, the errors and the loading speed. A random identifier kept 13 months in your browser (local storage, not a cookie) recognizes a return visit. The screen of these pages is also recorded, every field and everything you type hidden, the photos you choose left out, payment pages never; these recordings are kept 30 days. Nothing of this runs on the stores of Custodian’s merchants. The Global Privacy Control signal of your browser stops the identifier and the recording. The advertising campaign a visit came from (the utm_source, utm_medium, utm_campaign, utm_content, utm_id and utm_term parameters of the link) is kept with the visit for our own statistics, with or without your consent, for 13 months; it is not sent to Meta or Google for that purpose, and the fbclid click identifier is not kept. The visits of one browser less than 30 minutes apart are counted under the first advertisement that brought it. If you accept the follow-up, the visit that brought you is linked to your account.

Durations: 3 months for requests, 6 months for other facts, 24 hours for a screen recording without incident and 30 days at most when there was one; for a visit before any account, 13 months for its measures and 30 days for its recording. Only the Custodian people who maintain the app can see it, and every look is logged (kept one year). These data stay in our database, with our hosting provider, and are sent to no third-party analytics tool. Everything is deleted with your account.

Legal grounds

We process data needed to provide the service you request on the basis of performance of that service contract. Our legitimate interests in service security, diagnosing failures and preventing misuse support necessary technical processing. Optional account connections require your authorization and can be disconnected. Where processing relies on consent, you may withdraw it. We may retain or disclose information where required by applicable law.

Service providers and recipients

Railway Corporation provides application hosting, PostgreSQL database hosting and object storage. The application and database deployment is in the Netherlands; Railway also operates in the United States. Authorized operators and service providers may process information as needed to operate, secure and support the service.

Meta, TikTok and Pinterest receive API requests and the content or advertising instructions you authorize for their respective services. Published posts and any advertisements you activate through an authorized workflow are subject to the settings and policies of the relevant platform. Revoking access in Custodian does not remove content already held by Meta, TikTok or Pinterest.

Meta Platforms Ireland Limited receives the public website page and funnel events described above for advertising measurement and attribution when the Pixel loads, without a prior opt-in on Custodian.

TikTok receives the website and journey events described above only after you allow TikTok measurement on Custodian.

Google receives OAuth, Google Ads API and Merchant API requests when you choose to connect an account. We use Google user data only to provide the Google Ads or Merchant Center feature you request. We do not sell it, use it for advertising outside that feature, or use it to train generalized AI or machine-learning models. Our use of information received from Google APIs complies with the Google API Services User Data Policy, including the Limited Use requirements.

Other Custodian features use external providers when invoked: OpenRouter and the selected AI model providers, including OpenAI, process AI requests; Resend processes email delivery and receipt. Information included in prompts, business context or emails may be sent to those providers. The manual Meta post composer and paused-ad review composer do not require an AI generation or email delivery. Do not include unnecessary sensitive information in content or instructions.

Providers can process data outside France and the European Economic Area. Information about their processing and contractual transfer safeguards is available in Railway’s data processing terms, OpenRouter’s privacy policy, OpenAI’s privacy policy and Resend’s privacy policy. Contact us for information about the safeguards applicable to your use of Custodian.

Storage, security and retention

Meta, TikTok and Pinterest access tokens are encrypted before database storage and are not displayed in the application’s public pages. Workspace access is authenticated and scoped to the relevant workspace. No service can guarantee absolute security.

We keep workspace content, integration records and operation history while they are needed to provide your workspace and its requested features. The retention criteria are the continued use of the workspace, your deletion request, the need to resolve an operation or dispute, and applicable legal obligations. Disconnecting a social connection removes the stored access tokens for that project and cancels unsent previews; it does not erase publication history. Cancellation of a preview is not deletion of its stored content.

You can request deletion of stored content, integration data or your entire workspace using the process below. Any limited information retained for a legal obligation or an ongoing dispute will be explained in our response. Provider backup retention can differ from deletion in the active application; ask us for the details applicable to your request.

Your choices and rights

Subject to the applicable conditions, you can request access, correction, erasure, restriction or portability of your personal data, object to processing based on legitimate interests, or withdraw consent. Send your request to adrien@custodiancommerce.com. We may ask for proportionate information to verify that the request concerns your workspace; never send an access token or password.

See data deletion instructions for connection and workspace deletion. We respond to rights requests within the applicable legal time limit, normally one month. You may lodge a complaint with the French supervisory authority, CNIL, or your competent local authority.

Microsoft Clarity on the public website

Outside the European Economic Area, the United Kingdom, Switzerland and Québec, Microsoft Clarity collects clicks, scrolling and masked session replays on our public English and French landing pages by default, and may use the _clck and _clsk analytics cookies until you decline. In those regions, and whenever we cannot tell where you are, Clarity starts only after you select Allow. On visits identified as coming from the United States, declining keeps Clarity's cookies off but Clarity still records masked visits without analytics or advertising cookies. We use these recordings to understand usability problems. Clarity does not run in the Studio, chat, login, payment pages or merchant storefronts. Forms and their uploaded previews are masked. We do not send account identities to Clarity and keep its advertising storage denied. We estimate the visitor’s country from their network address; when it is unknown, Clarity waits for Allow. Refusing or withdrawing consent keeps Clarity’s cookies off in the United States and stops Clarity elsewhere. A Global Privacy Control signal stops Clarity everywhere. Change your cookie choice through the Cookies link. See Microsoft’s privacy statement.

Cookies and updates

Custodian uses session and language-preference cookies to authenticate access and remember presentation choices. The Meta Pixel can set measurement cookies such as _fbp and _fbc, and the TikTok Pixel can set measurement cookies such as _ttp. Google Analytics 4 receives named landing and signup steps, trial and Stripe-confirmed payment outcomes when the buyer returns to Custodian, plus campaign parameters. Google Analytics and Google advertising storage are enabled by default outside the European Economic Area, the United Kingdom, Switzerland and Québec, until you decline. In those regions, and whenever we cannot tell where you are, they stay denied until you select Allow (Google's own setting still enables them for visitors it locates in the United States). The Google tag may still send cookieless consent-mode signals when storage is denied. A browser Global Privacy Control signal keeps Google and the other advertising uses denied. You can change your choice at any time through the Cookies link at the bottom of the landing page. We do not send product descriptions, uploaded files, photos or account email addresses to Google Analytics. Connected services apply their own cookie and privacy policies on their sites. We update this page when the described processing changes; the date above identifies this version.