Privacy Policy

Last updated: 18 September 2026

Margo (“we”, “us”) is a profit-analytics dashboard for e-commerce businesses, available at margodash.com. This policy describes what data we collect, why, and how you can control it.

The data controller is Online Retail Denys Lebedovych, Wilcza 17, 00-548 Warszawa, Poland, NIP PL1133134131 (see company details).

Data we collect

• Account data: your email address and name, used for authentication and account management.
• Business data you import: orders, sales and cost figures that you upload or connect (files, CRM/marketplace APIs).
• Advertising statistics: read-only performance metrics (spend, impressions, clicks, conversions) from ad accounts you connect via official OAuth — Meta Ads, Google Ads. We never modify your campaigns.
• Instagram messaging metrics: if you connect an Instagram professional account, we receive webhook notifications about message events and store only daily counters (number of messages and unique conversations per day). We do not store message content or the identity of your customers beyond an opaque sender identifier used for same-day deduplication.

How we use data

Data is used solely to render your analytics dashboards (profit, margin, ROAS, conversation counts) inside your own account. We do not sell data, share it with third parties for advertising, or use it for purposes other than providing the service.

Storage and security

• Data is stored in the European Union (Supabase, AWS eu-central-1).
• API keys and OAuth tokens are stored encrypted in an isolated vault and are never exposed to the browser.
• Access is isolated per organization with row-level security.

Data from Meta Platforms

Where we receive data via Meta APIs (Meta Ads insights, Instagram messaging webhooks), we use it only as described above, retain it only as long as your account or connection exists, and delete it upon disconnection or account deletion. See Data Deletion for instructions.

Data from Google APIs

Margo requests the following Google user data, only after you grant consent:

• Sign in with Google (openid, email, profile): your email address and name, used only to create and authenticate your Margo account.
• Google Ads (https://www.googleapis.com/auth/adwords): the list of Google Ads accounts you can access (ID, name, currency, time zone) so you can pick which one to connect, and daily campaign statistics for the connected accounts — campaign name and ID, cost, conversions and conversion value. Margo only reads reports; it never creates, edits, pauses or removes campaigns, budgets, bids or any other Google Ads entity.

Google Ads statistics are stored as daily aggregates in your organization's workspace and shown only to you and the users you invite, on your profit, ROAS and ad-performance dashboards. The OAuth refresh token is stored encrypted and used only by our servers to fetch those reports. We do not sell Google user data, do not share it with third parties except the infrastructure providers that host the service (Supabase, Vercel, Railway), do not use it for advertising, and do not use it to train generalized AI or machine-learning models. Our staff do not read it unless you ask us to for support, it is needed for security or to comply with law.

Margo's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

You can revoke access at any time by removing the connection on the Integrations page (this deletes the stored token and the data received from Google Ads) or at myaccount.google.com/permissions.

Requests from public authorities

If a public authority requests personal data we hold, including data received from Meta Platforms, we:

• review the legality of the request and disclose nothing without a valid legal basis;
• challenge the request where we consider it unlawful, overbroad or disproportionate;
• disclose only the minimum data strictly necessary to comply;
• document every request, our response, the legal reasoning and the parties involved.

Where the law allows, we notify the affected customer before disclosing their data.

Your rights

You can export or delete your data at any time: disconnect any integration on the Integrations page, or delete your entire account on the Account page (“Delete account”). Deletion is permanent and removes all imported data, metrics and stored credentials.

Contact

Online Retail Denys Lebedovych, Wilcza 17, 00-548 Warszawa, Poland.
Questions about this policy: contact@margodash.com, +48 736 205 638.