Privacy policy
Last updated 24 October 2026
1. Who we are
DeckStory is operated by Forest Ocean DWC-LLC, a company licensed in the Dubai South free zone, licence number 15293. Our registered address is Business Centre, 3rd Floor, Building A3, Business Park, Dubai South, Dubai - UAE.
The data controller is Forest Ocean DWC-LLC.
For any question about this policy, or about data we hold, contact hello@deckstory.app. We aim to respond within five working days.
2. What DeckStory does
DeckStory connects to a merchant's own Shopify store and, if the merchant chooses, their Google Analytics property. It reads performance data from them and shows it in the merchant's own DeckStory reporting: the app and, once released, a weekly slide deck.
It is a reporting tool. It does not advertise, does not market to a merchant's customers, and does not build audiences or profiles.
3. What data we process
Aggregated performance metrics from the platforms a merchant chooses to connect: Shopify and Google Analytics 4.
Aggregated means totals and averages for a whole store, by day and by traffic channel or source, never for an individual person. Examples of what we keep: total sessions in a week and on each day, sessions by traffic channel, gross and net sales, number of orders, average order value, total refunds, and units sold and in stock for each product.
Contact details of merchant staff. Name and work email address, used to provide support.
Product references. Product titles and product image URLs. Images are referenced directly from the Shopify content delivery network at the point the reporting is viewed. We do not copy or store product images.
4. What we never process
This list is deliberate and we hold ourselves to it:
- Customer names, email addresses, postal addresses or phone numbers
- Individual customer profiles or lifetime value records
- Payment card details or any payment instrument data
- Raw, event-level analytics data
- Individual session recordings or heatmaps identifying a person
Shopify orders are read, never stored. To calculate the totals in section 3, DeckStory reads the store's orders through Shopify's API: each order's amounts, discounts, refunds, products and quantities, and whether it is the customer's first order. It uses them only to calculate the week's totals and never stores an individual order record. It does not read customers' names, contact details or addresses, and holds no Shopify permission to read customer records.
Google Analytics is read only through aggregated reports (section 8).
5. Our lawful basis
For the limited personal data we handle, which is the contact details of merchant staff:
- Performance of a contract, to deliver the service the merchant has asked for
- Legitimate interests, for support, security and improving the service
The aggregated performance metrics that form the substance of our reporting are not personal data.
6. Where data is stored
On Google Cloud Platform, in the europe-west2 region, which is located in London, United Kingdom.
7. Sub-processors
We use the following third parties to deliver the service:
| Sub-processor | Purpose | Location |
|---|---|---|
| Google Cloud Platform | Hosting, storage, processing | United Kingdom (London) |
| Sentry | Error monitoring | Germany (European Union) |
On Sentry. When part of DeckStory fails, Sentry receives a report of the error so that we can fix it: what failed, where in our code, the web address path involved and an internal store number. It receives no Google user data, no access tokens and no customer personal data. We set it to send no IP addresses, cookies, request bodies or query strings.
We will update this list before adding any new sub-processor.
8. Information received from Google APIs
When a merchant connects Google Analytics, DeckStory asks Google for one permission: read-only access to Google Analytics, which Google shows as "See and download your Google Analytics data". We do not ask for the merchant's Google profile, their email address or access to any other Google service.
Google user data we access
- An access credential. When the merchant grants access, Google gives us a long-lived token. We encrypt it with a key held in Google Cloud Key Management Service and store it in Google Cloud Secret Manager. We use it only to get short-lived access tokens from Google, and we never store those.
- The list of Google Analytics accounts and properties the merchant's Google account can see: account names, property names and property IDs. We show this list once so the merchant can choose a property. We do not keep it.
- The chosen property's ID, name and reporting time zone, so we know which property to read and which days its figures cover.
- Aggregated report figures for the chosen property for
each reporting period, normally one week:
- totals for the period: sessions, active users, total users, new users, engaged sessions, engagement rate, engagement time, page and screen views, ecommerce purchases and purchase revenue, with the property's currency;
- the same totals for each day of the period;
- sessions, engaged sessions, active users, purchases and revenue for each default channel group, for example Organic Search, Direct or Paid Social;
- the same figures for each traffic source and medium, for example "google / organic". We keep the 25 largest and add the rest together into one total;
- Google's own notes on each report, saying whether its figures were sampled, thresholded or grouped.
Every figure is a total that Google has already aggregated across many visitors.
How we use it
- To produce reporting for the merchant who connected the account. The figures are shown in the merchant's own DeckStory reporting (the Google Analytics panel on the DeckStory app's home page, and the weekly deck once released) and compared with the week before.
- To keep the connection working. We use the stored credential to get access tokens. If Google tells us access has been removed, we mark the connection as needing to be connected again and stop reading.
We use Google user data for nothing else.
What we don't do
- We do not access event-level, session-level or user-level data, user or client identifiers, or any data about a particular person.
- We do not write to Google Analytics. Our access is read-only: we never change settings, properties, events, audiences or conversions.
- We do not use Google user data for advertising, retargeting, or building audiences or profiles.
- We do not sell Google user data.
- We do not transfer Google user data to anyone except Google Cloud Platform, our hosting provider named in section 7, and only to provide the service. The exception is where the law requires it.
- We do not use Google user data to train AI or machine learning models, our own or anyone else's.
- No person at DeckStory reads Google user data unless the merchant asks us to (for example, for support), it is needed for security, or the law requires it.
Removing access
A merchant can remove DeckStory's access at any time at myaccount.google.com/permissions, or by uninstalling DeckStory, which stops collection at once. Section 9 says when the credential is revoked and the data erased.
DeckStory's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
9. How long we keep data
We keep a store's data while DeckStory is installed. When a merchant uninstalls DeckStory, we delete the store's Shopify access token at once, and Shopify sends us an erasure request 48 hours later. When it arrives we revoke the Google Analytics credential at Google and delete it, then delete everything else we hold for that store: its Shopify and Google Analytics figures, its connections, its collection jobs, the store record, and the merchant's account if no other store uses it. If the merchant reinstalls DeckStory before then, nothing is erased.
Our database backups are kept for seven days, so erased data is gone from them within seven days of the erasure.
A merchant can stop all further collection from Google Analytics at any time by removing DeckStory's access at myaccount.google.com/permissions, or by uninstalling DeckStory. Uninstalling also stops collection from Shopify.
On written request to hello@deckstory.app we will delete a merchant's data within thirty days, other than anything we are required to keep by law.
10. Your rights
Where we hold personal data about you, you have the right to ask for a copy of it, to have it corrected, to have it deleted, to object to our processing of it, and to receive it in a portable format.
Write to hello@deckstory.app. We will respond within one month.
If you are in the United Kingdom and are unhappy with our response, you may complain to the Information Commissioner's Office at ico.org.uk.
11. Cookies
The DeckStory website sets no analytics or tracking cookies and runs no third-party analytics. Fonts are served from this site rather than from a third-party font service. Our hosting provider may set strictly necessary cookies for security and to distinguish automated traffic. These are exempt from consent requirements.
12. Security
Access to connected platforms is by authorised token. Tokens are stored encrypted. Data is encrypted in transit and at rest. Access to production systems is limited to George Ife-Alabi.
13. Changes to this policy
We will update this page when the service changes and revise the date at the top. Material changes will be communicated to active clients by email.
14. Contact
Forest Ocean DWC-LLC, trading as DeckStory
Dubai South free zone licence 15293
Business Centre, 3rd Floor, Building A3, Business Park, Dubai South, Dubai - UAE