Last updated 23 September 2026

Privacy Policy

Canopy is an automated growth platform for Shopify stores. This policy explains what data we access, why, where it goes, and the control you keep over it. In plain English — the same way the app is written.

1 Who we are

Canopy is operated by BRND Labs Limited, a company registered in England & Wales, no. 09599940, at MB21, More Secure, Houndmills Road, Basingstoke, RG21 6YU ("Canopy", "we", "us"). For anything in this policy, reach us at hello@canopyapp.co. Where UK/EU data protection law applies, we are the data controller for the account data described below and a processor for the store data we handle on your behalf.

2 The data we access, and why

Canopy only accesses what you authorise when you install the app and connect a platform. We access it to build your P&L, surface findings, and — only when you approve — make the change.

From your Shopify store

Orders, products, customers and inventory — to compute real profit, margins, CAC and LTV.
Themes and files — to audit your storefront and, on approval, write changes such as image alt text or a draft theme.

From the platforms you connect

Meta Ads & Google Ads — spend and performance for your P&L, and, on your approval, budget or campaign changes.
Klaviyo — email and SMS performance, and drafts we build for your approval. Canopy never sends on its own.
Slack (optional) — outbound notifications only; it can never reach a customer or read a message.

Meta business data

When you connect Meta, Canopy uses your authorisation to list the ad accounts available to you and read performance for the accounts you select. This includes account and campaign identifiers, ad creative, spend, impressions, clicks and purchase conversions. We use this information for your store’s profit reporting, ad performance analysis and growth recommendations. Where you use an available ad-management feature, Canopy uses the connection to carry out the campaign or budget action you authorise. Access depends on the permissions you grant and the features available to your account.

Meta credentials are stored encrypted. Disconnecting Meta in Canopy’s Connections screen clears those stored credentials and account selections. Historical reporting is retained; disconnecting is not a request to delete all historical data. You can also remove Canopy from your Facebook Business Integrations settings to withdraw its authorisation at Meta.

Google user data

When you connect Google Ads, Canopy reads the performance and spend of the Google Ads account you select — your own account — through the Google Ads API, and uses it for one purpose: the profit analytics and findings we build for your store. If you also connect Google Drive from the Assets panel, Canopy reads only the folder you choose and the folders inside it, read-only: file names, Google's own thumbnails, and the photo details Drive already holds, so your assets can be listed and tagged. The files stay in Drive — we don't copy them into Canopy. Your Google credentials are encrypted at rest, as in section 3, and everything we derive from them is kept isolated to your store. We never sell Google user data, never use it for advertising, and never share it with anyone beyond the service providers in section 5, who process it only to deliver the feature you are using. Canopy's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

We ask only for the access a feature needs, and we tell you what each connection is for before you grant it. Read scopes power the analytics; any write happens solely with your explicit, per-action approval.

3 What we store

The computed P&L, metrics, cohorts and findings we generate for your store.
A record of every action Canopy proposed or executed (the activity log), including whether a safety rule stopped it.
A synced mirror of the store records above, so the app is fast and works when a platform is briefly down.
Your settings, targets and plan.
Platform credentials, encrypted at rest (AES-256-GCM). They are never shown again after you enter them, and never written to logs.

Every store's data is isolated from every other store (multi-tenant separation by store).

4 What we never do

We never sell your data, or share it for anyone else's advertising.
We never share it with third parties except the platforms you yourself connect, and the service providers below who help us run Canopy.
We never contact your customers. Email and SMS go out only through your own Klaviyo, only after your typed confirmation.

5 Service providers (sub-processors)

We use a small set of providers to run the platform. They process store data only to deliver the features you use, under their own security and privacy commitments.

Provider	Purpose
Shopify	The store you install Canopy on; the source of your commerce data.
Meta, Google, Klaviyo	The ad and email platforms you connect, for analytics and approved actions.
Railway	Hosting and the Postgres database where your data lives.
Anthropic (Claude)	Powers the strategist and checks — the analysis behind findings and plans.
Google (Gemini)	Generates ad-creative images when you use that feature.

Where Canopy sends store data to an AI provider (Anthropic or Google) to produce a finding, plan or creative, it sends only what that task needs. These providers process it to return the result and do not use your data to train their models under our agreements.

6 Keeping it, and deleting it

We keep your data for as long as Canopy is installed and you have an account. When you uninstall, we stamp the account uninstalled and wipe your stored platform credentials. We honour Shopify's mandatory privacy webhooks — a customer-data request, a customer-redact, and a shop-redact — and delete the relevant data on request. To ask for deletion directly, email hello@canopyapp.co.

Request deletion of Meta-connected data

Email hello@canopyapp.co with the subject “Canopy data deletion” and your Shopify store domain. Tell us whether you want Meta-connected data or your entire Canopy account deleted. Do not send passwords or access tokens. We may ask you to confirm that you control the store before processing the request. We will confirm its scope and completion, and explain any records that must be retained for a legal obligation.

7 Your rights

Under UK/EU GDPR (and comparable laws) you can ask us to access, correct, export or delete your personal data, and to restrict or object to certain processing. We'll respond within the time the law allows. You may also complain to your data protection authority — in the UK, the ICO.

8 The marketing site & cookies

Our marketing site uses only what's needed to run and to understand basic, aggregate traffic. We don't run third-party advertising trackers on it.

9 Changes & contact

We'll post any material change here and update the date above. Questions, requests, or anything that feels off: hello@canopyapp.co.

Last updated 6 July 2026

Terms of Service

These terms govern your use of Canopy. The short version: Canopy proposes and, with your approval, performs growth work on your store — and you stay in control of every change.

1 The agreement

By installing or using Canopy you agree to these terms on behalf of your business. They're between you and BRND Labs Limited. If you don't agree, don't install the app.

2 What Canopy does

Canopy connects to your Shopify store and the ad and email platforms you choose, builds a real P&L, and proposes actions against a target you set. Canopy executes a change only with your explicit approval. Ad launches start paused; email sends require a typed confirmation; every executed change is logged and, where technically possible, reversible.

3 No guaranteed outcomes

Canopy is a tool that helps you run your store more profitably. It is not financial, tax or investment advice, and we make no guarantee of any specific revenue, profit, or performance result. Advertising and commerce outcomes depend on many factors outside our control. You are responsible for the decisions you approve.

4 Your responsibilities

Keep your connections valid and your account secure.
Review what Canopy proposes; you approve, and are responsible for, every action it takes.
Comply with the terms and policies of Shopify, Meta, Google and Klaviyo, and with the advertising, email and consumer laws that apply to you.
Make sure the data and creative you approve is accurate and lawful to use.

5 Billing

Canopy is a paid subscription billed through Shopify's billing system. Plans, prices and what each plan lets Canopy do are shown at sign-up. Founding Member pricing (50% off, locked for the life of the subscription, first 100 stores) applies where offered. We offer a 30-day money-back guarantee on your first payment. Charges recur every 30 days until you cancel; you can cancel any time by uninstalling.

6 Acceptable use

Don't use Canopy to break the law, infringe anyone's rights, send unlawful marketing, or attempt to disrupt, reverse-engineer or gain unauthorised access to the service. We may suspend accounts that do.

7 Intellectual property

We own Canopy — the software, models and content we provide. You own your store, your data, and the creative and campaigns produced for you. You grant us the limited licence to your data needed to run the service for you.

8 Disclaimers & liability

Canopy is provided "as is". To the fullest extent the law allows, we disclaim implied warranties, and our total liability for any claim is limited to the fees you paid us in the 12 months before it arose. We are not liable for indirect or consequential losses, including lost profits or ad spend on actions you approved. Nothing here limits liability that can't be limited by law.

9 Termination

You can stop using Canopy any time by uninstalling. We may suspend or end access for breach of these terms. On termination we handle your data as described in the Privacy Policy.

10 Governing law & changes

These terms are governed by the laws of England & Wales, and its courts have exclusive jurisdiction. We may update these terms and will post changes here with a new date; continued use means you accept them.

11 Contact

Questions about these terms: hello@canopyapp.co.