Privacy Policy — LanceRoom

Last updated: October 22, 2026

1. About This Policy

LanceRoom ("we", "us", "our") is an all-in-one platform for ecommerce agencies and solo operators (the OneMan Agency suite). It brings together, in one place:

• Ads analytics & reporting — connect your Meta ad accounts and view performance reporting (spend, impressions, ROAS, creative breakdowns, and related metrics).
• Social media management — plan, schedule, and publish content to your connected social accounts.
• SEO & content tools — audits, keyword work, and content creation for your websites.
• Website tools — ready-made Shopify sections, blocks, pages, and storefront installs applied to your own store at your instruction.
• AI-assisted features — recommendations and content help inside the above modules.

This policy explains what data we collect across all of these modules, why, and how we protect it.

2. Data We Collect

• Account data: When you request access and sign up, our authentication provider (Clerk) collects your name and email address and manages your password securely. We approve each account manually from a waitlist before sign-in is enabled.
• Platform connections (tokens & access): To use the modules, you connect your own accounts with your own credentials:
  • Meta ad accounts — you provide your own Meta access token. It is validated server-side against Meta, stored encrypted, and never sent to your browser.
  • Social accounts — you connect accounts (e.g., Facebook, Instagram, LinkedIn, X, TikTok, YouTube, Threads) through their official sign-in flows. The resulting access is stored securely and used only for the scheduling and publishing you set up.
  • Shopify stores — you provide a theme access token for your own store. It is stored encrypted and used only to install the items you select.
• Ad performance data: Metrics and creative details fetched from Meta using your token (e.g., spend, impressions, clicks, results, creative names and thumbnails). This data belongs to you; we display it back to you and to nobody else.
• Your content: Posts, captions, images, designs, articles, and other material you create, upload, schedule, or install through the platform — across your own brands and, where you manage them, your clients' brands.
• AI inputs: When you use an AI-assisted feature, the relevant content (for example, your ad metrics for recommendations) is sent to our AI provider (Google Gemini) to generate the output.
• Usage analytics: We use PostHog to understand how the platform is used (e.g., which features are opened) so we can improve it.
• Error reports: We use Sentry to capture technical errors (e.g., failed page loads) so we can fix them.
• Service email: We use Resend to send transactional emails (e.g., access approvals, security notices). We send no marketing emails without your consent.

3. How We Use Data

• To operate the platform and show you your own data.
• To carry out the actions you instruct — fetching your ad reports, publishing your scheduled posts, installing your selected store items, generating AI outputs.
• To authenticate you and keep your sessions secure.
• To improve the product using aggregated, non-identifying usage analytics.
• To communicate about your account and the service.

4. Data Sharing

We do not sell your personal data. We share data only:

• With the platforms you connect, using your own access, solely to perform the actions you request (Meta for ad data and publishing, social networks for your scheduled posts, Shopify for your installs).
• With service providers who help operate LanceRoom — Clerk (authentication), Cloudflare (hosting and database), Google Gemini (AI features), PostHog (analytics), Sentry (error tracking), Resend (email) — each under their own confidentiality and security obligations.
• When required by law.

We never share one customer's data, content, or tokens with another customer.

5. Data Storage & Security

• Connection tokens are encrypted at rest and are never transmitted to the browser; only the server touches them.
• All traffic uses HTTPS.
• Access to production data is restricted to authorized personnel.

6. Data Retention

We retain your data while your account is active. You may request deletion of your data at any time by contacting us; we will delete or anonymize it within 30 days, except where retention is required by law. Removing a connected account or store revokes our access immediately — we cannot read or act on that platform without your stored access. Content already published to your own social accounts or installed in your own store remains there under your control.

7. Your Rights

You may:

• Access, correct, or delete your personal data.
• Remove a connected Meta ad account, social account, or Shopify store at any time (this revokes our access to it).
• Withdraw consent for optional processing.

8. Third-Party Platforms

When you connect an account, that platform's own privacy policy also applies to data processed on its systems (Meta, each social network, Shopify). Clerk's privacy policy applies to your login data.

9. Cookies

We use strictly necessary cookies for sign-in sessions (via Clerk) and privacy-respecting analytics cookies (via PostHog). We do not use advertising cookies.

10. Changes

We may update this policy. Material changes will be communicated via the platform or email.

11. Contact

For privacy questions or requests: [email protected]