Privacy policy
Last updated 4 September 2026
1. Who we are
DeckStory is operated by George Ife-Alabi, trading as DeckStory, a sole professional operating under an Expo City Dubai freelance permit, number FLP-00137, with the profession stated as Data Science and Analytics Freelancer. DeckStory is based in Dubai, United Arab Emirates.
DeckStory is not a limited company. The data controller is George Ife-Alabi personally.
For any question about this policy, or about data we hold, contact hello@deckstory.app. We aim to respond within five working days.
2. What DeckStory does
DeckStory connects to a merchant's own analytics and advertising accounts, reads performance data from them, combines that data with targets, objectives and a marketing calendar the merchant supplies, and produces a slide deck delivered by email on a regular schedule.
It is a reporting tool. It does not advertise, does not market to a merchant's customers, and does not build audiences or profiles.
3. What data we process
Aggregated performance metrics from the platforms a merchant chooses to connect. These may include Shopify, Google Analytics 4, Microsoft Clarity, Klaviyo, Meta Ads and Google Ads.
Aggregated means totals and averages across a whole store or a whole campaign. Examples of what we read: total sessions in a week, total revenue, overall conversion rate, total advertising spend, campaign click-through rate, email open rate, average scroll depth.
Merchant-supplied context. Targets, objectives and key results, and marketing calendar entries such as campaign names and launch dates.
Contact details of merchant staff. Name and work email address, used to deliver the deck and to provide support.
Product references. Product titles and product image URLs. Images are referenced directly from the Shopify content delivery network at the point the deck is viewed. We do not copy or store product images.
4. What we never process
This list is deliberate and we hold ourselves to it:
- Customer names, email addresses, postal addresses or phone numbers
- Individual order records
- Individual customer profiles or lifetime value records
- Payment card details or any payment instrument data
- Raw, event-level analytics data
- Individual session recordings or heatmaps identifying a person
Where a connected platform offers both aggregated and individual-level data, we request only the aggregated endpoints. In the case of Microsoft Clarity, we read aggregated behaviour metrics and do not access individual session recordings.
5. Our lawful basis
For the limited personal data we handle, which is the contact details of merchant staff:
- Performance of a contract, to deliver the service the merchant has asked for
- Legitimate interests, for support, security and improving the service
The aggregated performance metrics that form the substance of a deck are not personal data.
6. Where data is stored
On Google Cloud Platform, in the europe-west2 region, which is located in London, United Kingdom.
7. Sub-processors
We use the following third parties to deliver the service:
| Sub-processor | Purpose | Location |
|---|---|---|
| Google Cloud Platform | Hosting, storage, processing | United Kingdom (London) |
| Anthropic | Generating written commentary on aggregated metrics | United States |
| Resend | Sending the finished deck by email | United States |
On the transfer to Anthropic. Only aggregated metrics and merchant-supplied context are sent. No customer personal data, no order-level records and no raw event data are ever sent, because we do not hold them. The transfer is made under Standard Contractual Clauses or the UK International Data Transfer Agreement. We use Anthropic's commercial API, under which submitted data is not used to train models.
On the transfer to Resend. Resend receives the recipient's name and email address and the contents of the deck email. This data is stored in the United States. Selecting a European sending region changes only where mail is dispatched from, not where it is stored. The transfer is made under the Standard Contractual Clauses in Resend's data processing addendum, supported by Resend's certification under the EU-US Data Privacy Framework and its UK Extension. Resend retains message content and delivery logs for thirty days, and deletes remaining data within ninety days of account closure.
We will update this list before adding any new sub-processor.
8. Information received from Google APIs
DeckStory's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
Specifically, data obtained through the Google Analytics Data API and the Google Ads API is used solely to produce reporting for the merchant who authorised that access. It is not transferred to any third party except the sub-processors named above, is not used for advertising, is not sold, and is not used to build advertising audiences or profiles.
9. Information received from Meta
Data obtained through the Meta Marketing API is used solely to produce reporting for the merchant who authorised that access. It is not sold, not shared for advertising purposes, and not used to create or enrich audiences.
10. How long we keep data
Aggregated metrics are retained while a merchant's account is active and for twelve months afterwards, so that year-on-year comparisons remain possible.
On written request to hello@deckstory.app we will delete a merchant's data within thirty days, other than anything we are required to keep by law.
A merchant can disconnect any connected platform at any time, which stops all further collection from that platform immediately.
11. Your rights
Where we hold personal data about you, you have the right to ask for a copy of it, to have it corrected, to have it deleted, to object to our processing of it, and to receive it in a portable format.
Write to hello@deckstory.app. We will respond within one month.
If you are in the United Kingdom and are unhappy with our response, you may complain to the Information Commissioner's Office at ico.org.uk.
12. Cookies
The DeckStory website sets no analytics or tracking cookies and runs no third-party analytics. Fonts are served from this site rather than from a third-party font service. Our hosting provider may set strictly necessary cookies for security and to distinguish automated traffic. These are exempt from consent requirements.
13. Security
Access to connected platforms is by authorised token. Tokens are stored encrypted. Data is encrypted in transit and at rest. Access to production systems is limited to George Ife-Alabi.
14. Changes to this policy
We will update this page when the service changes and revise the date at the top. Material changes will be communicated to active clients by email.
15. Contact
George Ife-Alabi, trading as DeckStory
Expo City Dubai freelance permit FLP-00137
Dubai, United Arab Emirates