Privacy Policy

This Privacy Policy explains how CodLite ("CodLite", "we", "us") handles data across the CodLite dashboard, API, mobile apps and this website (codlite.com) — what we collect, why, who we share it with, and the control you have. By using CodLite you agree to this policy. If you don't agree, please don't use the service.

CodLite is an operations platform for Cash-on-Delivery e-commerce sellers. For the personal data of your end customers that you process inside CodLite — order names, phone numbers, delivery addresses — you are the data controller and CodLite is your processor: we handle that data only on your instructions and under our agreement with you.

1. Information we collect

Personal data

Your name, email, password (stored only as a hash), organization name, country and preferred language. If you subscribe to a paid plan, billing details are handled directly by our payment provider — we never store full card numbers.

Business data you enter or import

Orders, leads, products, expeditions, cash-reconciliation records, ad-spend entries and the contact details of your end customers. This is the operational data CodLite exists to manage.

Data from services you connect

When you link a storefront (e.g. Shopify, WooCommerce, YouCan, LightFunnels), an advertising account (Meta / Facebook Ads, TikTok Ads), a carrier or a spreadsheet, we access only the specific data those connections return, using the scopes you authorize. See section 4 for the platform-specific detail.

Usage & device data

IP address, device and browser type, timestamps and the actions you take in the app — used to keep the service secure, diagnose problems and improve it.

Cookies

We use essential cookies only, described in our Cookies Policy. We do not use advertising or cross-site tracking cookies on this website.

2. How we use your information

• To provide, maintain and secure the CodLite service and its features.
• To sync your orders, ad spend and cash so your dashboard reflects reality.
• To authenticate you, prevent fraud and abuse, and enforce our terms.
• To send you service, security and (if you opt in) product emails.
• To meet legal, tax and accounting obligations.

We do not sell your data, we do not share it with data brokers, and we do not use data obtained from a connected advertising platform for any purpose other than showing it back to you inside your own CodLite account.

3. Legal bases (where GDPR applies)

We process data under one or more of these bases: performance of our contract with you, your consent (for optional integrations and marketing), our legitimate interests in running and securing the service, and legal obligation where the law requires it. You can withdraw consent at any time by disconnecting the relevant integration or contacting us.

4. Platform data — Meta (Facebook) & TikTok

CodLite can connect to your advertising accounts so your daily ad spend appears next to your revenue. This section describes exactly what we access and how we handle it, in line with the Meta Platform Terms, Meta Developer Policies and the TikTok Developer / Marketing API terms.

Meta (Facebook) Ads

• When you connect Meta, you authorize CodLite to read your ad accounts and their spend and performance insights (read-only scopes such as ads_read and read_insights).
• We use this data only to display and reconcile your ad spend inside your CodLite account.
• We do not post on your behalf, create or edit campaigns, access your personal profile, your friends, or your organic content.
• We never transfer Meta Platform Data to third parties except the infrastructure sub-processors listed in section 5, and never to data brokers.

TikTok Ads

• When you connect TikTok, you authorize CodLite to read your advertiser accounts and their spend and reporting data through the TikTok Business / Marketing API, using read-only scopes.
• We use this data only to display and reconcile your ad spend inside CodLite.
• We do not post content, manage campaigns, or access personal TikTok profile data.

You can revoke either connection at any time from CodLite settings or from the platform's own app settings, and you can request deletion of the data we hold — see section 9 and our Data Deletion page.

5. How we share information & sub-processors

We share data only with vendors that help us run the service, under contracts that require them to protect it, and where the law requires disclosure. Current categories of sub-processor:

• Hosting & storage — Hetzner (European data centres).
• Payments — our payment provider, which handles card data directly.
• Transactional email — our email delivery provider.
• Services you connect — storefronts, advertising platforms and carriers you choose to link.

We may also disclose data if required by law, or to protect the rights, safety and property of CodLite, our users or the public. An up-to-date sub-processor list is available on request from contact@codlite.com.

6. Links to other websites

CodLite links to and integrates with third-party services that have their own privacy policies. We are not responsible for their practices; we encourage you to review the policy of any service you connect or visit.

7. Data retention

We keep your data for as long as your account is active. Data pulled from a connected advertising platform is refreshed on sync and retained only while the connection is active and for a short reconciliation window afterwards. When you disconnect an integration or close your account, we delete or anonymize the associated data within 30 days, except where we must keep records to meet a legal, tax or fraud-prevention obligation.

8. International data transfers

We primarily process data in the EU (Hetzner). Where data is transferred to a country without an adequacy decision, we rely on appropriate safeguards such as Standard Contractual Clauses.

9. Your privacy rights

EU / UK (GDPR)

You have the right to access, correct, export, restrict or object to processing of, and delete your personal data, and to lodge a complaint with your local supervisory authority.

California (CCPA/CPRA)

You have the right to know what personal information we collect, to request deletion, to correct it, and to opt out of "sale" or "sharing" — note that CodLite does not sell or share personal information as those terms are defined. We will not discriminate against you for exercising any right.

How to exercise your rights

To exercise any right, or to have data we obtained from Meta or TikTok deleted, follow the steps on our Data Deletion page or email contact@codlite.com. We verify your identity and respond within 30 days.

10. Security

CodLite stores data on European infrastructure with encryption in transit, access controls, hashed passwords and daily backups. No system is perfectly secure, but we work continuously to protect your data and will notify you of a breach as required by law.

11. Children's privacy

CodLite is a business tool and is not directed to anyone under 18. We do not knowingly collect data from children; if we learn we have, we will delete it.

12. Changes to this policy

We may update this policy as the product evolves. We will change the effective date above and, for material changes, notify you in-app or by email.

13. Contact

Questions about privacy or this policy? Email contact@codlite.com.