Privacy
Policy.

Information we handle

Accounts and workspaces. We handle account names and email addresses, workspace and brand details, and member roles such as owner, brand partner, and viewer. We also keep information needed to sign in, manage invitations, and record workspace activity. If you choose Google sign-in when available, Google provides account identity information and Ledger handles provider-issued identifiers and authorization tokens for sign-in.

Contact inquiries. If you use our contact form, we collect your name, email, company if provided, what you are interested in, your message, and whether you opted in to product updates. A contact inquiry is kept separately from connected workspace data.

Connected marketing data. When an authorized workspace member enables a provider, Ledger can receive data from Amazon Selling Partner, Amazon Ads, Shopify, and Google Search Console. This may include account and profile identifiers, reports and performance metrics, orders and line item identifiers, monetary values, refunds, advertising results, search queries and pages, and technical observations from public web pages. The exact data depends on the provider and feature enabled.

Essential browser data. Sign-in uses session cookies. Ledger also stores a small number of workspace and walkthrough preferences in your browser so the app can remember your selected workspace and whether you completed its introduction.

Authentication and security records may include IP addresses, browser information such as user-agent strings, and session or sign-in activity. Ledger also uses an IP address in authentication rate limiting.

How we use it

We use this information to provide the workspace, connect and refresh enabled data sources, display reporting, prepare recommendations, manage access, protect the service, and respond to support or contact requests. Public site checks are limited to technical information available from the public web pages submitted for checking.

Steward currently prepares recommendations using deterministic, offline processing. It does not send workspace data to an external large language model. Recommendations are for review; the current recommendation mode does not make campaign changes automatically.

Connected accounts

A connection is enabled by an authorized account holder through the provider’s authorization flow. Ledger receives provider-issued authorization tokens and stores them encrypted; we do not ask for or store your provider account password. We use a connection only for the provider and features the workspace has enabled.

You can disconnect an integration in Ledger. This removes Ledger’s local credentials, but historical metrics and reports may remain in the workspace. You can also revoke authorization in the provider account directly. Some providers do not offer a reliable revocation operation to Ledger, so disconnecting here does not guarantee that the provider has revoked its authorization.

Who can access information

Workspace information is available to authorized workspace members according to their roles and to operational administrators who need access to operate or support Ledger. We use service providers to run parts of the service, including Cloudflare for hosting, storage, and bot defenses; Resend for configured email delivery; and the external provider APIs selected by a workspace. Information is shared with those providers as needed for their service to work. If configured, Resend may receive contact inquiry details to send an inquiry notification to Ledger.

Ledger does not sell or rent connected workspace data.

Retention and deletion

Workspace reports, metrics, technical crawl evidence, recommendations, approvals, and audit events remain while the brand workspace is active. An authorized owner can download the available workspace export. An owner can delete a brand when another workspace remains available. Deletion removes its workspace data and credentials; Ledger retains a minimal platform audit record that identifies the actor and workspace, including the deleted brand’s name and slug.

Disconnecting a provider removes local credentials, while historical metrics may remain until the brand is deleted. Account information and contact inquiries are stored separately and remain until a deletion request is addressed; there is no automatic deletion schedule for those records. If deleting a brand would leave you without an available workspace, contact us to request deletion.

Your choices and requests

Workspace owners can manage member access, disconnect providers, and download the available workspace export. Owners can delete a brand when another workspace remains available; if it is the last available workspace, contact us to request deletion. You can decline optional marketing updates on the contact form; that choice does not affect a request for a response to your inquiry.

To ask to access, correct, or delete personal information, email kurtis.lloyd@ledger-marketing.com. We may ask for information to verify a request and will respond through that address.

Security

We use reasonable technical and organizational measures intended to protect information, including encrypted storage for provider credentials and access controls for workspace data. No online service can guarantee that every transmission or stored record will always be secure.