Troven Inc. ("Troven", "we", "us", or "our") is an Ontario corporation that operates software tools and services for authors, publishers, and businesses, including Troven Ads Optimizer (the "Service"), the website troven.ca, and the Optimizer's dedicated marketing and advertising landing site, kdpadoptimizer.com. This Privacy Policy explains how we collect, use, disclose, store, and protect personal information when you use the Service, visit our website, or deal with us, including when we connect to third-party advertising platforms such as Amazon Advertising on your behalf. It also applies to customers who purchase a managed version of the Service through third-party marketplaces such as Fiverr. Our Story Weaver product is covered by a separate Story Weaver Privacy Notice. We are subject to the Personal Information Protection and Electronic Documents Act (Canada) ("PIPEDA") and, where applicable, provincial privacy laws.
1. Information We Collect
We collect the following categories of information:
- Account information. Your name, email address, password (stored in hashed form), and business details you provide when you register.
- Advertising data. When you connect a third-party advertising account (such as Amazon Advertising) through its authorized API, we collect campaign names, structures, and settings; ad group, keyword, and target performance data (impressions, clicks, spend, sales); advertising cost metrics such as ACOS; and account and profile identifiers provided by the platform. We also store the authorization token the platform issues to us. We never receive your platform login credentials.
- Book and royalty information. Book titles, ASINs, list prices, royalty rates, and similar economic inputs you enter so the Service can calculate recommendations.
- Approval and execution records. When you approve a recommendation, or when we execute a change under a managed service order, we record your user ID, the recommendation, the exact change submitted to the advertising platform, the prior state of the affected item, the timestamp, and the platform's response.
- Terms acceptance records. When you accept our Terms of Service or this Privacy Policy, we record the document and version accepted (as a cryptographic hash of the text), the timestamp, and the IP address of the device used.
- Billing information. Our payment processor, Stripe, collects your payment card details directly. We receive your name, email, billing address, subscription tier, transaction history, and the last four digits and expiry of your card, but we do not store full card numbers.
- Managed service information. If you purchase a managed service order through a marketplace such as Fiverr, we receive your marketplace username, order details, and messages you send us through that platform.
- Communications. Emails, support requests, and feedback you send us.
- Technical and usage information. IP address, browser and device type, pages viewed, and actions taken within the Service, collected through server logs and cookies as described in Section 8. If you arrive at kdpadoptimizer.com through a Google Ads advertisement, we also collect the Google click identifier ("gclid") associated with that click, for the advertising measurement purpose described in Section 6.
2. How We Use Your Information
We use personal information for the following purposes:
- To provide the Service, including analyzing your advertising data, generating recommendations, and, when you approve a recommendation or place a managed service order, submitting changes to your advertising account on your behalf;
- To create and manage your account, process payments, and send transactional messages such as receipts, weekly summaries, and security notices;
- To keep a record of the changes you authorized and the terms you accepted, so that we and you can verify what was done and when;
- To secure the Service, prevent fraud and abuse, and enforce our Terms of Service;
- To measure the effectiveness of our advertising, by sending a single signup event to Meta Platforms and to Google Ads when a new account is created, as described in Section 6;
- To improve the Service, including by analyzing usage and, using data that has been aggregated and de-identified so that it no longer identifies you or your account, refining our recommendation models;
- To send you marketing messages about our products where you have consented, which you may withdraw at any time using the unsubscribe link in any message; and
- To comply with legal obligations and respond to lawful requests.
We do not sell or rent personal information, and we do not share your advertising data with third parties for their own marketing purposes. Recommendations are generated by automated analysis. A person at Troven reviews recommendations only where you have placed a managed service order. We use Amazon Advertising data only as permitted by Amazon's Ads API terms and data protection policies.
3. Consent
We collect, use, and disclose personal information with your consent, or as otherwise permitted or required by law. You give consent when you create an account and accept this Privacy Policy, when you connect an advertising account through its authorization flow, and when you place a managed service order. Consent for purposes that are necessary to provide the Service is a condition of using it. You may withdraw consent at any time by disconnecting your advertising account, closing your account, or contacting us, subject to legal or contractual restrictions and reasonable notice. Withdrawing consent may mean we can no longer provide the Service to you.
4. Safeguards and Where Your Data Is Stored
We protect personal information with physical, organizational, and technical safeguards appropriate to its sensitivity, including encryption in transit and at rest, encrypted storage of advertising platform tokens, access controls that limit access to personnel who need it to operate the Service, and logging of administrative access. No system is completely secure, and we cannot guarantee the security of information transmitted over the internet.
Our servers are hosted by DigitalOcean in its Toronto, Canada region. Personal information is nonetheless transmitted outside Canada in the ordinary course of providing the Service: to Amazon's regional Ads API endpoints in North America, Europe, and the Far East; to Stripe in the United States for payment processing; to SendGrid in the United States for email delivery; to Meta Platforms and to Google Ads in the United States for the signup measurement events described in Section 6; and to Google in the United States when fonts load in the Service. Information stored or processed outside Canada may be accessible to the courts, law enforcement, and national security authorities of those jurisdictions under their laws. We use contractual and other measures to require our service providers to protect your information to a standard comparable to this Privacy Policy.
5. Data Retention
We retain personal information only as long as necessary for the purposes described above, or as required by law. Our retention periods are:
- Account, advertising, and book data: for as long as your account is active. If you close your account or disconnect an advertising account, we delete or de-identify this data within thirty (30) days, except as set out below.
- Approval and execution records: seven (7) years from the date of the change. These records document the changes you authorized to your advertising account and are our evidence of what was done and when. We retain them even after your account is closed.
- Terms acceptance records: when your account is deleted, we remove your user ID and IP address from these records and retain only the document type, version hash, and timestamp, so that we can show what terms were in force without identifying you.
- Billing and tax records: seven (7) years, as required by Canadian tax law.
- Backups: data in encrypted backups is overwritten on a rolling basis within ninety (90) days.
6. Disclosure to Third Parties and Service Providers
We disclose personal information only in the following circumstances:
- Advertising platforms. When you approve a change, or we execute one under a managed service order, we transmit the change to your advertising platform (such as Amazon Advertising) through its API. Your use of that platform is governed by its own privacy policy and terms.
- Service providers. We use third-party providers to host the Service and our website (DigitalOcean, Toronto region), process payments (Stripe), and send email (SendGrid). They may access personal information only to perform services for us and are contractually required to protect it.
- Advertising measurement. When a new account is created, our server sends a single event to Meta Platforms through Meta's Conversions API, containing the IP address and browser user agent of the device used, so we can measure the effectiveness of our advertising campaigns. We do not send your name, email address, or advertising data to Meta, and we do not use a Meta pixel or any Meta cookies on our website. Separately, when a new account is created, our server sends a single event to Google Ads through Google's Data Manager API, containing a one-way, irreversible cryptographic hash of your email address, the Google click identifier associated with the advertisement that led to your visit (if any), and a signal confirming that you have consented to this measurement. Google compares the hashed value against its own hashed records of signed-in Google users to measure the effectiveness of our advertising; Google never receives your actual email address, only an irreversible hash of it. The Google tag that powers this measurement is installed on kdpadoptimizer.com, the Optimizer's dedicated marketing and advertising landing site, and sets a first-party cookie there (commonly named "_gcl_au") to store ad-click information used to link a later conversion back to the advertisement that produced it. This cookie is set only on kdpadoptimizer.com. We do not use a Google Ads pixel or any Google Ads cookies on troven.ca or within the Service itself (app.troven.ca).
- Marketplaces. If you purchase a managed service order through Fiverr or a similar platform, that platform receives the order and payment information needed to process your order under its own privacy policy.
- Legal requirements. We may disclose information where required by law, subpoena, or court order, or where we believe disclosure is necessary to protect our rights, your safety, or the safety of others.
- Business transactions. If Troven is involved in a merger, acquisition, financing, or sale of assets, personal information may be transferred as part of that transaction, subject to confidentiality and this Privacy Policy.
Troven is not responsible for the privacy practices of advertising platforms, marketplaces, or other third-party services you use.
7. Your Rights
You may disconnect any third-party account from the Service at any time, at which point we will stop collecting new data from that account. Subject to applicable law, you also have the right to:
- Request access to the personal information we hold about you
- Request correction of inaccurate personal information
- Request deletion of your data, subject to the retention periods in Section 5
- Withdraw consent for the collection, use, or disclosure of your personal information where that activity is based on consent
- Ask questions or make a complaint about our handling of your personal information
To exercise any of these rights, contact our Privacy Officer using the details in Section 13. We may need to verify your identity before acting on a request. We will respond within thirty (30) days, and we will explain any legal reason we cannot fulfil a request. If you are not satisfied with our response, you may contact the Office of the Privacy Commissioner of Canada. Residents of Quebec may also contact the Commission d'accès à l'information du Québec.
8. Cookies and Similar Technologies
We use cookies and similar technologies that are strictly necessary to operate the Service, such as keeping you signed in and protecting against fraud. We do not use any analytics or error-tracking tools on our website or in the Service. You can manage cookies through your browser settings; disabling strictly necessary cookies may prevent the Service from working. The Service loads fonts from Google Fonts; when a page loads in your browser, your IP address is sent to Google to deliver the font files, and Google's privacy policy applies to that processing. kdpadoptimizer.com uses a first-party Google Ads cookie to measure the effectiveness of our advertising, as described in Section 6. We do not use advertising or cross-site tracking cookies on troven.ca or within the Service (app.troven.ca).
9. International Users
The Service is operated from Ontario, Canada. If you access the Service from outside Canada, you consent to the transfer, storage, and processing of your information in Canada and in the countries described in Section 4. If you are located in the European Economic Area or the United Kingdom, we process your personal information on the basis of our contract with you, our legitimate interests in operating and securing the Service, your consent where required, and our legal obligations, and you may have additional rights under local law, which you can exercise by contacting us. We do not sell personal information. We do not share personal information as defined under United States state privacy laws, except that a limited signup event is sent to Meta (IP address and browser user agent) and to Google Ads (a one-way hash of your email address and, where available, the Google click identifier) for advertising measurement as described in Section 6.
10. Children's Privacy
The Service is not directed at individuals under the age of 18. We do not knowingly collect personal information from minors. If you believe a minor has provided us with personal information, please contact us and we will delete it within a reasonable time after verification.
11. Privacy Breaches
If we experience a breach of security safeguards involving your personal information that creates a real risk of significant harm to you, we will notify you and report the breach to the Office of the Privacy Commissioner of Canada as required by PIPEDA, and we keep records of all breaches of security safeguards.
12. Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes in our practices or applicable law. We will post the updated version with a new "Last updated" date. If the changes are material, we will notify you by email or within the Service before they take effect and ask you to accept the updated policy.
13. Contact Us and Accountability
Troven is responsible for personal information under its control and has designated a Privacy Officer who is accountable for our compliance with this Privacy Policy and applicable privacy law. If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact:
Troven Inc.
Attention: Privacy Officer, Michael Minogue
49 Kearney Street, Guelph, Ontario N1E 7B9, Canada
privacy@troven.ca