Norma Media ("we", "our", "us"), operated by Lusitanian Heritage LLC, a limited liability company registered in the State of Florida, United States (542 Washington Avenue, 39, Miami Beach, FL 33139), is a performance marketing agency specialised in Google Ads for eCommerce and Dropshipping businesses. Your privacy is important to us. This policy explains what data we collect, why we collect it, and how we protect it.
This policy applies to clients of Norma Media who use our reporting dashboard at norma-media.com. Where a client connects their Shopify store, we also process data about that store's orders. We never read the names, email addresses, phone numbers or street addresses of our clients' own customers — section 6 sets out exactly what we access and what we do not.
1. How Our Service Works
When a client engages Norma Media to manage their Google Ads campaigns, their Google Ads account is linked to our Google Ads Manager Account (MCC). This is the standard model for Google Ads agencies and is approved by Google.
Through this MCC relationship, we use the Google Ads API with our own agency-level credentials to retrieve campaign performance data. Clients do not need to share passwords or perform an OAuth flow — access is managed through the MCC link approved during onboarding.
Our dashboard presents this data to clients in a clear, controlled interface. This is particularly important because accounts managed under an MCC may have restricted visibility in the native Google Ads interface; our dashboard ensures clients have full transparency into their key metrics.
2. Data We Collect
We collect the following categories of data:
- Account data: name and email address provided during account creation on our platform.
- Google Ads performance data: campaign metrics including impressions, clicks, spend, conversions, ROAS, CPC, and breakdowns by device, age range, gender, and geography. This data is retrieved via the Google Ads API using our MCC credentials.
- Shopify store data: where you connect a Shopify store, aggregated sales figures and order records. Section 6 sets these out field by field, including what we deliberately do not read.
- Usage data: standard server logs including IP address, browser type, operating system, pages visited, and access times — used for security and performance monitoring only.
- Session cookies: essential cookies required for authentication. See the Cookies section below.
3. How We Use Your Data
We use your data exclusively to:
- Display your Google Ads campaign performance metrics in your personal dashboard.
- Provide transparency into campaigns managed by Norma Media on your behalf.
- Send account-related transactional emails (account activation, password reset).
- Maintain the security and integrity of our platform.
- Comply with legal obligations.
We do not sell, rent, or share your personal data or Google Ads data with any third parties for marketing or advertising purposes.
4. Restricted Use of Google Ads Data
Data retrieved through the Google Ads API is used solely to power your reporting dashboard. We explicitly prohibit and do not engage in any of the following:
- Using Google Ads data to serve advertisements, including retargeting or personalised advertising.
- Transferring or selling Google Ads data to advertising platforms, data brokers, or resellers.
- Using Google Ads data for credit assessment, lending decisions, or any financial determination.
- Allowing human access to your Google Ads data except when you have explicitly requested support, when required for security or legal compliance, or when data is fully anonymised and aggregated for internal analysis.
Our use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
5. Google Ads API Usage
Our platform uses the Google Ads API to retrieve campaign data for accounts managed under our MCC. Access is performed using Norma Media's own agency credentials — no client-side OAuth authorisation is required. All data retrieved is used solely to power the client reporting dashboard and for no other purpose.
You may revoke our access to your Google Ads account at any time by removing the MCC link from within your Google Ads account settings. Upon revocation, we will no longer be able to retrieve your campaign data.
Our use of the Google Ads API is subject to the Google Ads API Terms of Service and the Google Privacy Policy.
6. Shopify Store Data
Clients may connect their Shopify store so that we can report real revenue and attribute it to Google Ads campaigns. This section sets out exactly what we access.
What we read
- Sales reports— net sales aggregated by day and by order referrer, read through Shopify's ShopifyQL reporting API. These are the same figures you see in your own Shopify Analytics.
- Orders — order number, dates, order status, order and refund totals, currency, shipping country, the products and quantities in each order, and the UTM parameters and landing pages of the visits that preceded the purchase.
- Catalogue — product and collection names and identifiers.
What we do not read
We do not read or store the names, email addresses, phone numbers or street addresses of your customers. We do not collect their IP addresses, geolocation, browser or device information. We place no pixel, script or cookie on your storefront — everything is read server to server through Shopify's Admin API.
Shopify's permission screen lists every category a permission is capable of reaching, which is broader than what an application actually requests. The list above is what ours queries.
Why we need it
Revenue figures let us report the real return on advertising spend instead of relying on Google's own attribution. UTM parameters and landing pages let us attribute an order to the campaign that produced it. The shipping country is used for geographic segmentation of campaigns.
Shopify's reporting API requires what Shopify calls "Level 2" protected customer data access, which is defined by reference to customer name, address, phone and email fields. That requirement applies to the reporting API as a whole rather than to individual fields. We request it for that reason alone, and do not read those fields.
How long we keep it
Order records are deleted 24 months after the order date. If you uninstall the application, your store credentials are deleted immediately, and your order, collection and campaign-mapping data is deleted when Shopify sends us the corresponding deletion request — and in any case within seven days of the uninstall.
9. Security
We implement industry-standard security measures including 128-bit SSL encrypted connections (HTTPS), hashed passwords, and restricted access controls. API credentials and access tokens, including those for connected Shopify stores, are encrypted at rest with AES-256-GCM and are never exposed in client-side code or logs. Access by our staff to connected store data is recorded in an access log. Advertiser data is maintained in a secure environment consistent with enterprise security standards. Only authorised Norma Media personnel have access to production systems.
10. Data Retention
We retain your account data for as long as your account is active or as needed to provide our services. Google Ads performance data is retrieved in real time and may be cached temporarily to improve dashboard performance. Shopify order records are deleted 24 months after the order date. Store credentials are deleted the moment the application is uninstalled, and the remaining store data within seven days of that uninstall. Upon account deletion or service termination, all associated personal data is removed within 30 days.
11. Legal Basis for Processing (GDPR)
If you are located in the European Economic Area, we process your personal data on the following legal bases:
- Performance of a contract: processing your account data and retrieving Google Ads campaign data is necessary to deliver the reporting service you have contracted us to provide.
- Legitimate interest: collecting usage data (server logs, IP addresses) to maintain the security, stability, and performance of our platform.
- Legal obligation: processing data where required to comply with applicable laws, regulations, or legal proceedings.
12. International Data Transfers
Your data may be stored and processed in the European Union or other countries where our hosting providers operate, including the United States. By using our platform, you consent to the transfer of your data to these locations. We ensure that any such transfers are subject to appropriate safeguards in accordance with applicable data protection law.
13. Children's Privacy
Our Platform is not directed at individuals under the age of 18. We do not knowingly collect personal data from children. If we become aware that we have inadvertently collected personal data from a person under 18, we will take steps to delete that information as soon as possible. If you believe a minor has provided us with personal data, please contact us at info@norma-media.com.
14. Your Rights (GDPR)
If you are located in the European Economic Area, you have the right to:
- Access the personal data we hold about you (Subject Access Request).
- Request correction of inaccurate data.
- Request deletion of your data ("right to be forgotten").
- Object to or restrict processing of your data.
- Request a portable copy of your data.
To exercise any of these rights, contact us at info@norma-media.com. When composing your request, please include "Privacy Request" in the subject line and the email address associated with your account.
15. Links to Other Websites
Our platform may contain links to external websites. These sites are not subject to this Privacy Policy. We recommend reviewing the privacy policy of any external site you visit.
16. Changes to This Policy
We may update this policy from time to time. We will notify you of significant changes by email or by posting a notice in your dashboard. Continued use of the platform after changes constitutes acceptance of the updated policy.
17. Contact
For questions about this policy or to make a data request, contact us at: info@norma-media.com