How Audiohook collects, uses, discloses and retains personal information. Version 1.0, effective October 12, 2026.
Version 1.0 · Effective October 12, 2026
This Privacy Policy explains how Audiohook Corporation, a Delaware corporation (“Audiohook,” “we,” “us”), collects, uses, discloses and retains personal information. It applies to our website, to the Audiohook advertising platform, to the data we receive from commerce platform accounts that our customers connect, and to the advertising we deliver on our customers’ behalf.
Audiohook operates a performance advertising platform for audio inventory. Our direct customers are businesses that advertise through the platform. We also process limited data about the customers of those businesses — the people who hear an advertisement and later make a purchase — in order to measure whether the advertising worked. This policy is written for three audiences: our advertiser customers, the merchants whose commerce accounts are connected to our platform, and individuals whose data we process in the course of delivering and measuring advertising.
We deliver audio advertising across podcasts, digital and streaming audio, broadcast radio and synthesised audio inventory; we produce and optimize advertising creative; and we measure whether an advertisement led to a purchase or other action our customer defines. Measurement is the reason we access commerce data. Where a customer connects a commerce platform account, we use order-level information from that account to determine whether an order followed an advertisement we served, and to calculate what the customer owes us.
We collect the information a customer provides to open and operate an account: business name and address, the names, business email addresses and telephone numbers of the people who use the account, authentication credentials, and billing information. Payment card details are collected and stored by our payment processor, not by us; we retain only the information needed to identify a payment method, such as the card brand and last four digits.
Where a customer connects a commerce platform account, we receive order-level information for attribution, measurement and billing. This includes order identifiers and timestamps; order totals, taxes, shipping, discounts and currency; payment, fulfilment, cancellation and refund status; line-item product information; the cart or checkout token; the landing page, which carries campaign parameters; visit information; transaction records; the country and state or province codes from the shipping address; and the store’s customer identifier, which lets us tell a repeat buyer from a new one without identifying the person.
We do not request, receive or store a customer’s name, email address, telephone number or billing address. From the shipping address we read only the country and state or province codes, and we do not read or store address lines, city, postal code or geolocation.
We use this information only to provide our services to the merchant whose account it came from, and only within the limits that merchant sets. We do not use it to train or improve any machine learning or artificial intelligence model, in identified, pseudonymous, anonymous, aggregated or derived form. We do not transfer it, or anything derived from it, to any third party except as section 7 describes. We do not use it for competitive benchmarking. We do not contact a merchant’s customers, and we do not use this information to build audiences or target individuals.
Our Shopify app, Audiohook Sales Sync, adds a web pixel, a checkout extension and a theme app embed to the merchant’s store. None of them shows anything to shoppers. With the shopper’s consent, they record a visitor identifier, a session identifier, the IP address, the browser user agent, a location derived from the IP address no finer than city, the pages visited and, on a purchase, the order identifier. They also add the visitor identifier, session identifier and a consent marker to the cart.
For each order that carries a Shopify customer identifier, including past orders imported when the store connects, we keep a customer record. It holds the Shopify customer identifier, whether the customer has purchased, the identifier of their first order and, with consent, their visitor and session identifiers. We keep the record even if the shopper declines tracking, but it then holds no visitor or session identifiers, and an order placed after the shopper declines clears them. The record expires two years after it is last updated, which is normally the customer’s last order.
When a merchant uninstalls the app, we delete the store’s order data and customer records when Shopify sends its data erasure request, and the store’s tracking events within thirty (30) days. When Shopify asks us to erase a shopper’s data, we delete that shopper’s customer record and tracking events. Backup and archive copies are deleted when they expire, within one hundred eighty (180) days, and are not restored to active use or otherwise used in the meantime.
When an advertisement is served we and our inventory partners process technical information associated with the request, which may include an IP address, a device or advertising identifier, coarse geographic location derived from the IP address, user agent and application information, and the publisher and content context in which the advertisement appeared. When a purchase or other action later occurs, our conversion tracking tag, installed by our customer on its own website or through our app on its connected store, transmits information that lets us match the action to the advertisement. Our customers are responsible for disclosing that tag on their own properties. We do not seek, and our customers agree not to send us, sensitive personal information or consumer health data.
On our own website we and our analytics providers use cookies and similar technologies to understand how the site is used, including pages viewed and referring source, and we collect information submitted through contact forms.
We use information to provide, operate, secure and improve the platform; to deliver, target, optimize and measure advertising; to determine which conversions are billable and to bill for them; to detect and prevent invalid, fraudulent or duplicative activity; to produce reporting for our customers; to provide support, including through the internal support view described in section 9; to communicate about accounts and services; and to comply with law and with the requirements of the platforms our services depend on. Where we process information on a customer’s behalf, we use it only for that customer and only as our agreement with that customer permits.
We disclose information to service providers that host, secure, process or support our platform. Our infrastructure service providers are Amazon Web Services and Cloudflare. Each is bound by contract to process data only on our instructions and to protect it. A current list of service providers is published at audiohook.com/subprocessors, and we notify customers of additions in advance as the Data Processing Addendum provides.
We disclose information at our customer’s direction — for example where a customer exports a report, schedules recurring delivery to a recipient it chooses, or configures a transfer to an affiliate network. The customer is responsible for those recipients. Transfers of data derived from a connected commerce account are restricted, and we will not make them without the relevant merchant’s consent.
We disclose information where required by law or legal process, to protect our rights or the safety of others, and in connection with a merger, acquisition or sale of assets, in which case the recipient remains bound by this policy or gives notice of any change.
We do not sell personal information, and we do not share personal information for cross-context behavioural advertising, as those terms are defined by the California Consumer Privacy Act, and we have not done so in the preceding twelve months.
We produce advertising creative, including audio generated from text. Where a voice, likeness or performance of an identifiable individual is used or replicated, the party supplying it is responsible for obtaining the consents that applicable law requires, and we require evidence of those consents. We do not create a synthetic replica of an identifiable person’s voice without documented consent.
Our personnel can view a customer’s account through an internal support view in order to provide support, investigate suspected misuse, or meet a legal obligation. Access is limited to personnel with a business need, requires authentication, and is logged.
We retain information for as long as needed for the purpose for which it was collected and then delete or de-identify it. Data received from a connected commerce account is deleted within thirty (30) days of the account being disconnected, of our ceasing to require it, of termination, or of a valid deletion request, whichever occurs first, except where a law requires us to keep it. Shopify customer records expire as section 4A describes. Backup and archive copies are deleted when they expire, within one hundred eighty (180) days, and are not restored to active use or otherwise used in the meantime. Otherwise: advertiser account records are retained for the term of the relationship plus seven (7) years; invoices and payment records for seven (7) years; conversion records for up to four (4) years; advertising delivery logs for thirteen (13) months; and website analytics data for twenty-six (26) months.
We encrypt personal information in transit and at rest, restrict access to personnel with a business need, authenticate and log access, and test our controls periodically. No system is perfectly secure, and we do not represent that ours is. Where we become aware of a security incident affecting personal information we process for a customer, we notify that customer without undue delay and in any event within seventy-two (72) hours, and we meet any shorter notification period a platform we depend on requires.
Depending on where you live, you may have the right to know what personal information we hold about you and how we use and disclose it, to obtain a copy of it, to correct it, to delete it, to opt out of its sale, sharing or use for targeted advertising or profiling, and to be free from discrimination for exercising those rights. We do not sell or share personal information as the California Consumer Privacy Act defines those terms, and we do not process sensitive personal information. Where another right applies to information we hold as a business, you may exercise it as described below. We honour browser-based opt-out preference signals, such as Global Privacy Control, as a request to opt out where the law requires it.
Where we process information on behalf of one of our customers, we will refer your request to that customer and assist them in responding. To make a request, or to ask a question about this policy, email privacy@audiohook.com. We will verify your request before acting on it, using information we already hold. You may use an authorised agent, who must provide your signed permission, and we may ask you to verify your identity directly. If we decline your request, you may appeal by replying to our decision with the subject line “Appeal”; we will respond within the period the law requires, and if we deny the appeal you may contact your state attorney general.
If you are a merchant whose commerce account is connected to our platform and you wish your data deleted, disconnecting the application begins the thirty-day deletion process described in section 10.
Our services are directed to businesses. We do not knowingly collect personal information from children under sixteen (16), and we do not knowingly deliver advertising directed to children. If we learn that we have collected such information we will delete it.
We may change this policy. Each version carries a version number and an effective date. The current version is published here; superseded versions are retained with their effective and sunset dates and are available on request. Where a change is material we will give notice through our website or platform before it takes effect.
Audiohook Corporation, 3632 N Wolf Creek Dr, Eden, Utah 84310. Email: privacy@audiohook.com.
Audiohook operates a Google Analytics 4 (GA4) Connector application (project ID: ga4-connector-463816) that allows clients to authorize Audiohook to read data from their Google Analytics accounts. This feature is used to support Audiohook's pre-credit approval service, which uses website performance signals to inform lending-related decisions on behalf of the authenticated client.
When a client connects their Google Analytics account, Audiohook may access the following types of Google user data:
Audiohook accesses this data exclusively through the Google Analytics Data API and the Google Analytics Admin API, using OAuth 2.0 authorization granted by the client. Audiohook does not access any raw user-level data, personally identifiable information, or data outside the scope of the permissions explicitly granted by the client.
Audiohook's access to and use of Google user data obtained via Google APIs is governed by the following practices:
If you have questions about how Audiohook accesses or handles your Google Analytics data, please contact privacy@audiohook.com.