Data handling
Privacy policy
DataLab is an operator-managed commerce reporting tool for authorized business use. This policy describes the data used by the workspace, the reasons for processing it and how to contact the operator.
1. Data that may be processed
- Account authorization and identity: connected source identifiers, granted permissions, connection status, and an operator's Google sign-in identity and email. OAuth credentials are processed to maintain authorized connections.
- Google user data: authorized Google Ads account and campaign reporting, including identifiers, names, currency, timezone, spend, impressions, clicks and available conversion metrics.
- Other connected sources: authorized Meta advertising data, Shopify order, item, discount and refund data, and Impact partner, action and invoice data. Source records may include customer contact, billing or shipping details where those fields are made available and authorized.
- Operations: import dates, run outcomes, errors, audit records and ordinary hosting/security logs. This public site may generate request metadata such as IP addresses and browser information through its hosting provider.
2. Why the data is used
Data is used to import and reconcile records, produce internal business reporting, investigate incomplete or failed imports, and send reports to designated recipients. Customer email fields may be used to distinguish internal orders from external business activity. An authorization grant is not permission for unrelated uses.
Google user data is used for the reporting features described here. It is not sold, used for advertising targeting, or used to train generalized AI or machine-learning models. DataLab follows the Google API Services User Data Policy, including its Limited Use requirements, when using or transferring Google user data.
3. Storage and access
The private application and its data are hosted in Google Cloud. BigQuery stores imported and derived records; Firestore holds operational control records; Secret Manager holds connection credentials. Access is controlled by application roles and cloud permissions. The public information site does not connect to those data stores or expose the private application's API.
These controls reduce risk, but no service can guarantee that credentials will remain valid indefinitely or that every security incident can be prevented.
4. Service providers and disclosure
Google Cloud processes data for hosting, storage and operations. The configured email delivery provider processes report content and recipient details to deliver reports. Cloudflare hosts this public information site. Reports are made available to designated recipients and authorized operators, not to the public.
Data may also be disclosed when required by law or to address a security incident. Data is not sold or shared for another party's independent advertising purposes. Any materially different future use requires an updated disclosure and any necessary authorization.
5. Retention and deletion
Imported records are retained for authorized reporting, historical analysis, reconciliation and operational needs. Some raw records are retained to support reproducibility; temporary processing data follows the relevant pipeline's cleanup rules. There is no single fixed retention period covering every connected source.
Disconnecting a source or revoking OAuth access stops the connection from obtaining new data once the change takes effect; it does not automatically erase records already imported. Contact the operator to request disconnection, access review, correction or deletion. Requests are handled according to the requesting party's authority and applicable business or legal retention requirements. There is no automatic deletion deadline promised on this page.
6. Authorization and your choices
You can revoke DataLab's Google authorization in your Google Account connections settings. Other sources provide their own access-management controls. Revocation may interrupt scheduled imports; the operator can help identify affected connections without asking you to send tokens by email.
Contact mincum@163.com for data or authorization requests. Do not include passwords, access tokens, client secrets, or customer records in an initial request.
7. Public-site cookies and changes
The supplied public pages contain no advertising pixels, analytics scripts, forms or application cookies. Hosting providers may process ordinary security and delivery logs. The private console and identity provider have separate sign-in behavior.
This policy may be updated as the tool changes. Material changes to data use will be disclosed, and the date on this page will be updated.