Molehill
Privacy policy
Molehill Analytics OÜ (registry code pending registration; Tallinn, Estonia; "Molehill", "we") provides marketing analytics for online stores. This policy explains what data we process, why, and your rights. Contact: [email protected].
1. Two roles
- For your account data (name, email, company details, login and billing information, support messages), Molehill is the data controller.
- For the store data you connect (orders, products, website analytics, advertising performance), Molehill is a data processor acting on your instructions under our Terms and the Data Processing Addendum in section 11. You remain the controller of that data and of any personal data of your customers it contains.
2. What we collect and where it comes from
| Data | Source | Why |
|---|---|---|
| Account data: name, email, company, password hash, billing details | You | Provide and bill the service, support, security |
| Orders, refunds, discounts, products, prices, inventory | Your Shopify or WooCommerce store, through the access you grant | Measure sales and the effect of marketing on them |
| Customer identifiers in order data (customer ID; email only if your platform includes it) | Your store | Tell new buyers from returning ones. We pseudonymise identifiers on import and never use them to contact your customers |
| Website analytics: sessions, sources, conversions, by day | Your Google Analytics 4 property, through a service account you add | Measure traffic and conversion |
| Advertising performance: spend, impressions, clicks, conversions, by campaign and day | Meta, Google Ads, TikTok, Amazon Ads, through the access you grant | Measure what each channel contributed |
| Email and SMS campaign performance | Klaviyo, through your API key | Measure the effect of your own channels |
| Storefront events (only when you enable the pixel): page views, product views, checkout steps, referrer, campaign parameters and click IDs | Your storefront, through the Molehill pixel | Attribute orders to the visit that led to them; see section 5 |
| Usage data: pages viewed in Molehill, features used, errors | Your use of the app | Improve the product, fix problems |
| Connection health: token validity, sync results, API errors | Our systems | Keep your connections working |
We do not collect payment card numbers; payments are handled by our payment provider, which has its own privacy policy.
3. What we do not do
- We do not sell data, share it with advertisers, or use 1 customer's data to benefit another customer's account.
- We do not send marketing to your customers and we do not build profiles of them.
- We do not use data obtained from Google APIs to develop, improve or train generalised AI or machine-learning models.
4. Google API Services and Meta Platform data
Molehill's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Data from Google Analytics and Google Ads is used only to provide and improve Molehill's reporting to the account that connected it. Data from Meta's Marketing API is used only to provide Molehill's reporting to the account that connected it and is handled according to Meta's Platform Terms.
5. Storefront pixel
If you enable it, Molehill places a small script on your storefront (on Shopify through Shopify's web pixel framework) that records page views, product views, checkout steps, the referrer, campaign parameters and advertising click IDs, and sends them to Molehill. It is used to attribute orders to the visit that led to them and to check that your other tracking works. It does not record names, email addresses, payment details or what visitors type. It follows your store's consent settings: where a visitor has not given consent, the events are not collected. You can turn the pixel off at any time in Settings.
6. Cookies on this website
This website (molehillapp.com) uses Google Analytics to count visits, only if you allow it in the banner. Until you do, no analytics cookie is set and no data is sent to Google. You can change your choice with the "Cookie settings" link in the footer. The app (app.molehillapp.com) uses only the cookies needed to keep you signed in.
7. Legal bases
Contract (providing the service), legitimate interests (security, product improvement, connection monitoring), legal obligation (accounting records), and consent where we ask for it (optional communications; the cookie banner on this site). For store data we act on your documented instructions.
8. Where data is processed and who helps us
Data is stored in the European Union. Sub-processors:
| Sub-processor | Purpose | Location |
|---|---|---|
| UpCloud Oy | Servers and storage | Finland (EU) |
| Cloudflare, Inc. | DNS, network security, email routing, hosting of this website | EU edge; US company certified under the EU-US Data Privacy Framework |
| Anthropic, PBC | Generating plain-language explanations from aggregated results; no customer-level personal data is sent | US, under standard contractual clauses |
| Google LLC / Google Ireland Ltd | Google Cloud project for API access; Google Analytics on this website (with your consent) | EU / US |
| Payment provider | Payments | EU / US |
| Email provider | Transactional email | EU |
We will update this list and inform account holders of material changes.
9. Retention
- Store, storefront and advertising data: for as long as your account is active. Deleted within 30 days after you disconnect a source or close your account; backups expire within 90 days.
- Account and billing records: 7 years, as Estonian accounting law requires, then deleted.
- Usage logs: 12 months.
10. Your rights
Access, correction, deletion, restriction, portability and objection under the GDPR; complaint to the Estonian Data Protection Inspectorate (aki.ee). For requests about your customers' data, we support you as processor: see Data deletion. Contact [email protected].
11. Security
Encryption in transit and at rest; access tokens and API keys stored encrypted and never shown again after entry; least-privilege read-only access requested from every platform; access limited to the people who operate the service, on named accounts with two-factor authentication; incident notification to affected accounts without undue delay.
12. Data Processing Addendum (summary)
Molehill processes store data only on the account holder's instructions, keeps it confidential, applies the security measures above, uses only the listed sub-processors, assists with data-subject requests, deletes or returns data at the end of the service, and makes information available to demonstrate compliance. The full DPA is available on request and forms part of the Terms.
13. Changes
We will post changes here and, for material changes, email account holders.