Privacy policy

Who we are

GoodMorning is operated by Good Morning Co LLC (“we”, “us”, or “our”). We provide weekly Meta Ads performance reports to marketers, agencies, and ecommerce operators. You can reach us at support@goodmorningco.com, or by post at the address below.

Information we collect

When you create an account and connect a Meta Ads account, we collect and store:

• Account information: your email address and an encrypted password (managed by Supabase Auth).
• Business information: your brand name, website URL, vertical, and logo (pulled from Brandfetch if you use the automatic option).
• Meta Ads data: with your explicit permission via Facebook Login for Business, we access your Meta Ads account to pull performance metrics (spend, impressions, clicks, conversions, ROAS, CTR, CVR, frequency) at the campaign, ad set, and ad level. We store a long-lived access token to refresh this data weekly.
• Shopify order data: with your permission, we connect to your Shopify store via OAuth to read your order history — order totals, order dates, and an anonymous numeric customer identifier — so we can calculate revenue, customer lifetime value, and customer acquisition cost. We do not access your customers' names, email addresses, phone numbers, or physical addresses, and we never write to your store.
• Klaviyo account data: with your permission, we connect to Klaviyo via OAuth using read-only scopes (accounts:read, campaigns:read, flows:read, forms:read, lists:read, segments:read, and metrics:read). We access your Klaviyo account name and ID, your campaign and flow performance (sends, opens, clicks, revenue attributed to each), sign-up form performance, aggregate list and segment subscriber counts, and aggregate metric totals such as subscribes, unsubscribes, bounces, and spam complaints. We store the OAuth access and refresh tokens so we can refresh this data on your schedule. We do not request or access your Klaviyo profiles — we never read your subscribers' email addresses, phone numbers, names, or custom properties, only counts and totals — and we never write to your Klaviyo account. Disconnecting Klaviyo in Settings revokes our OAuth grant with Klaviyo, which uninstalls GoodMorning from your Klaviyo account.
• Google Ads and Google Analytics data: with your permission, we connect via Google OAuth to read campaign performance and website analytics metrics for the properties and accounts you select.
• Billing information: payment information is collected and stored by Stripe. We only retain your Stripe customer ID and subscription status.

Legal bases for processing (UK/EU GDPR)

If you are in the UK or the EU, we rely on the following Article 6(1) legal bases. Each purpose is listed with the basis we rely on for it:

Where we rely on legitimate interests, we have balanced those interests against your rights and you may object at any time by emailing support@goodmorningco.com. Where we rely on consent, you may withdraw it at any time without affecting processing carried out before withdrawal. We do not use your data for automated decision-making that produces legal or similarly significant effects.

How we use your information

We use the data you provide to:

• Generate your weekly performance report, including the PDF, email, and dashboard views.
• Run diagnostic analysis on your ad account performance and deliver recommendations.
• Process your subscription and payment via Stripe.
• Send you service emails (weekly reports, billing notifications).

In-app support chat

When you message us through the support chat in your dashboard, we store your messages along with your account email so we can respond and improve our help content. To operate the chat, we share these messages with two service providers acting on our behalf: Slack (Slack Technologies, LLC), which routes your message to our support team, and Resend (Resend, Inc.), which delivers our email replies when you are offline. We keep support conversations for as long as your account is active and delete them when your account is deleted.

We no longer keep a benchmark dataset

Until August 2026 we wrote an anonymized weekly snapshot of your aggregate metrics to a cross-customer benchmark dataset, and retained it even after an account was deleted. We have stopped writing it and deleted the dataset entirely. Nothing about your account is pooled with other customers, and a deletion request now leaves behind no performance data of any kind.

How we share your information

We do not sell your personal information. We only share data with:

• Service providers that help us operate GoodMorning: Supabase (database and auth), Vercel (hosting), Stripe (payments), Resend (email delivery), Loops (lifecycle and marketing email), beehiiv (our newsletter — it receives your email address and nothing else), Slack (support-chat routing), Anthropic (the AI that writes your recaps, creative briefs and brand analysis), and Brandfetch (brand asset lookup).
• What Anthropic receives: to generate your daily recap, weekly report summary and creative briefs, we send your performance figures and brand details to Anthropic's API. Under Anthropic's commercial terms, it may not train its models on that content. We do not send it your email address, your customers' personal details, or any Klaviyo subscriber data.
• The platforms you connect, to read the data you authorize: Meta, Google (Google Ads and Google Analytics), Shopify, and Klaviyo. We read from these platforms; we do not send them your data.
• Analytics and advertising on our marketing pages: Google and Meta receive standard website visitor data from goodmorningco.com. This is separate from the platforms above and is described in its own section below. No data from inside your account is included.
• Conversion measurement: when you sign up or subscribe we send Meta a scrambled (hashed) version of your email address and the type of action you took, so we can tell which of our own ads worked. Never your business data. Subject to your consent choice, as described below.
• Legal requirements: if required by law, subpoena, or to protect our rights.

Analytics and advertising on this website

On our public marketing pages we use Google Analytics 4 and the Meta Pixel to understand how visitors find us and to measure and target our own advertising. These tools collect standard web data such as your IP address, browser and device information, the pages you view, and the site or ad that referred you, and share it with Google and Meta respectively.

These tools run on our marketing pages only. They are not loaded on the dashboard, onboarding, billing or admin areas, and your ad account performance, your customers and your revenue are never sent to them.

Separately, when you take a significant action — submitting your email, creating an account, connecting an ad account, or subscribing — we tell Meta from our own servers that the action happened, so we can measure which of our ads actually work. We identify you to Meta by a scrambled (hashed) version of your email address, never the address itself, and we send the fact that the action happened rather than anything about your business. If you are in the UK, EEA or Switzerland we do this only if you accepted above; if you declined, or we have no record of your choice, we send nothing at all.

If you are in the UK, the EEA or Switzerland, neither of these loads until you say yes. We ask once, in a banner at the bottom of the page, and “Decline” is exactly as easy as “Accept”. Until you accept, the Meta Pixel is not loaded at all and Google Analytics is instructed to store nothing. If you decline we do not ask again. To change your mind either way, clear this site's cookies and you will be asked afresh.

Elsewhere in the world these tools load on page view, which the law in those places permits. Wherever you are, you can also limit them through your browser's cookie settings, Google's Analytics opt-out add-on, or your Meta ad preferences.

Where your data goes — international transfers

Good Morning Co LLC is a United States company, and the providers listed above are US-based or store data in the United States. So if you are in the UK or the EU, using GoodMorning means your data is transferred out of the UK/EEA to the United States.

We rely on the following safeguards under Chapter V of the GDPR, rather than on your consent:

• EU-US Data Privacy Framework certification, where the provider holds it — this covers Vercel, Stripe, Resend, Google and Meta, and Stripe additionally holds the UK Extension and the Swiss-US framework.
• Standard Contractual Clauses (the European Commission's 2021 clauses, Module 2, controller-to-processor), with the UK International Data Transfer Addendum where the UK GDPR applies. These are incorporated into our data processing agreement with each provider — including Supabase, which holds the database itself, and Anthropic, which generates your recaps.

We assess every provider before it receives any of your data, and re-check it at least annually: whether it holds a current independent security audit, whether it offers processor terms meeting Article 28, whether a lawful transfer mechanism is in place, and whether it is receiving the minimum data its job requires. A provider that fails is either sent less or not used.

Data retention

If your account is closed because it went dormant rather than because you asked us to close it, we keep your email address on our mailing list so we can tell you when something changes. Every one of those emails has an unsubscribe link, and unsubscribing removes you immediately. If you ask us to delete your account, your email address goes too — that is the difference between the two.

We retain your account data for as long as your account is active. Meta Ads performance data is retained at daily granularity for the lifetime of your account to enable historical trend analysis and long-term benchmarking. Generated weekly reports and PDFs are also retained for the lifetime of your account.

Klaviyo data is retained at daily granularity for the lifetime of your account so we can show lifecycle trends over time. It is aggregate only — campaign, flow, form, list, segment, and metric totals — and contains no subscriber personal data. Disconnecting Klaviyo revokes our access and stops all future pulls; the aggregate history already pulled is erased when your account is deleted.

Shopify order data is deleted immediately when you disconnect your Shopify store from Settings, and again automatically within 48 hours if you uninstall the app directly from your Shopify admin. You can request deletion of your data at any time by emailing support@goodmorningco.com. When you request deletion, we erase your account and associated data, send you a confirmation that the deletion was completed, and retain only (a) billing records held by our payment processor as required by tax law, and (b) a minimal record evidencing the deletion, which we delete after seven years.

Your rights

You can disconnect any connected platform — Meta Ads, Google, Shopify, or Klaviyo — at any time from Settings, which revokes our access and stops all future data pulls. For Shopify this also immediately erases your stored order history, and for Klaviyo it revokes our OAuth grant with Klaviyo so GoodMorning is uninstalled from your Klaviyo account.

If you are in the UK or EU you have the following rights. They are free to exercise, and we will respond within one month.

• Access (Article 15) — a copy of the personal data we hold about you. You do not have to ask: go to Settings → Account → Your data and download it yourself, at any time.
• Portability (Article 20) — that same download is machine-readable JSON, so you can take it elsewhere.
• Rectification (Article 16) — correction of anything inaccurate. Most of it you can edit yourself in Settings; email us for the rest.
• Erasure (Article 17) — deletion of your account and data, from Settings or by email.
• Restriction (Article 18) — you can ask us to stop processing your data while a complaint or a correction is being resolved, rather than delete it.
• Objection (Article 21) — you can object to anything we do on the basis of legitimate interests, including our newsletter.
• Withdrawing consent (Article 7) — where we rely on consent, you can withdraw it at any time. For our marketing pages' analytics and advertising cookies, clear your cookies for this site and you will be asked again.
• Complaint — you can complain to your local supervisory authority (in the UK, the Information Commissioner's Office) at any time, and you do not have to come to us first.

If you are in California, you have the right to know what we collect, to request deletion, and not to be discriminated against for exercising either. We do not sell personal information and we do not share it for cross-context behavioural advertising.

Security

We use industry-standard security practices including encrypted connections (HTTPS/TLS), row-level security on the database, encrypted password storage, and secure token handling. No system is perfectly secure, but we take your data protection seriously.

Meta Platform compliance

GoodMorning uses the Meta Marketing API and Facebook Login for Business in accordance with Meta's Platform Terms and Developer Policies. We only access the data you explicitly authorize. You can revoke our access at any time from your Facebook Business Settings.

Google API Services compliance

GoodMorning's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. When you connect a Google account (such as Google Ads or Google Analytics), we access only the data you explicitly authorize, use it solely to provide reporting and recommendations to you inside GoodMorning, and never sell it, use it for advertising, or allow humans to read it except with your consent, for security purposes, or as required by law. You can revoke our access at any time from your Google account permissions or by disconnecting the integration in your GoodMorning settings.

Shopify Platform compliance

GoodMorning connects to Shopify using OAuth with read-only access to your store's orders. We request only the minimum scope needed to power your dashboard analytics — order totals, dates, and an anonymous customer identifier — and never request access to your customers' names, emails, phone numbers, or addresses. You can disconnect your Shopify store at any time from Settings, which immediately revokes our access and erases your stored order history.

Klaviyo Platform compliance

GoodMorning connects to Klaviyo using OAuth 2.0 with PKCE and requests only read-only scopes. We use Klaviyo data solely to produce reporting and recommendations for you inside GoodMorning: we never sell it, never share it with other customers, and never use it to train models. We deliberately do not request the profiles:read scope, so we cannot read your subscribers' personal details. When you disconnect Klaviyo from Settings — or cancel or delete your GoodMorning account — we revoke the OAuth token with Klaviyo, which removes the GoodMorning app from your Klaviyo account. You can also remove it yourself at any time from Settings → Integrations in Klaviyo.

Changes to this policy

We may update this privacy policy from time to time. When we do, we will update the “Last updated” date at the top of this page. Significant changes will be communicated via email.

Contact

Questions about this privacy policy? Email support@goodmorningco.com, or write to us at: