Privacy Policy

Definitions:

• We use any of the terms “we”, “us”, and “our” to refer to Feedoptimise ®™, a trading name of 33Concept Ltd.
• We use any of the terms “platform” and "Feedoptimise" to refer to our website and services.
• We use the term ‘User’ to refer to the person or legal entity that registers for, accesses, or uses the Feedoptimise services.
• We use any of the terms “you”, “your” and “yours” to refer to the User who is reading this Privacy Notice and accessing our services.
• We use the term “browser” to refer to the software you are using to access Feedoptimise.
• We use the term “application” to refer to the part of the Feedoptimise identified by app. subdomain and connected services in most part available only to the registered User.
• We use the term “homepage” to refer to the part of the Feedoptimise identified by www. subdomain - the public homepage.
• We use the term “DPA“ to refer to Data Protection Act as defined by UK's GDPR (General Data Protection Regulation).

This privacy policy sets out how Feedoptimise ®™, trading name of 33Concept Ltd, uses and protects any information that a User provides when they access our website or related services we provide.

Feedoptimise takes the privacy rights of user information we may gather very seriously. We are committed to ensuring that your privacy is protected. Should we ask a User to provide certain information by which the User can be identified when using this website or related services, then the User can be assured that it will only be used in accordance with this privacy statement.

1. Intended users

   Feedoptimise is a data management tool intended for use by businesses and organisations. It is not intended for consumer purposes. The platform is not directed to, and we do not knowingly collect personal data from, individuals under the age of 16. Users must be of legal working age and, where acting on behalf of an organisation, authorised to bind that organisation to our Terms of Use.

   If you believe that an individual under the age of 16 has provided personal data to us, please contact privacy@feedoptimise.com and we will take appropriate steps to remove the relevant data.

2. Collected data

   In order to provide you with access to our platform as well as various services, we have to collect certain types of data. We have grouped it into four categories below:

   1. User settings

      This includes information such as your email address, name, and password as well as any settings created by a User while using our platform. We need it so can enable login functionality, show your name in changes history and know what accounts do you have access to as well as to provide the requested service. In order to maintain the functionality of our systems, we have to store this data for as long as you have an active User account with Feedoptimise or are not updating this data.

   2. Billing profile

      This includes information about your company that is needed to raise valid tax bills for the platform use, historical charges, and receipts. This data is required by law in order to raise a valid invoice for the services provided should you create your own account and set up a billing profile with Feedoptimise. This data can't be removed as it's required by the tax authorities and needed for bookkeeping.

   3. Changes history

      This includes your profile name, as well as information such as the actions you have taken with assets in your account, e.g., changing a feed name, setting up a new source, updating mapping, etc. We need this data to provide you with the ability to view and revert your changes. To maintain the revert functionality, we must store this data for a duration of two years from the date of the change, allowing you to have restore points available for that period.

   4. Access logs

      This includes data required for auditing access to our services as well as potential bugs and issues, information about your connection such as IP, user agent, requests to our platform, and its responses both of which are stripped out from confidential data before storing. This data allows us to keep improving our system and to be able to fix potential bugs or other issues. We may store this data for up to six months.

3. Data you provide to us

   The information you furnish us is utilised exclusively to enhance your integration channels and marketing initiatives. You retain complete control and ownership of this data. The Content submitted through the platform consists of product and catalogue data and is not intended to include personal data. Where any Content does contain personal data, you remain the controller of that data and are responsible for ensuring you have a lawful basis for providing it to us. We have categorised this information into three groups as outlined below:

   1. Sources and Overrides

      This encompasses the information you supply, primarily concerning your products, to facilitate integration with diverse marketing channels or to satisfy your internal requirements. This includes data analysis or conducting additional modifications. The scope of this data is not restricted solely to product attributes and may extend to other catalogue, inventory or campaign data necessary for these purposes. It is not intended to include personal data.

   2. Reporting Data

      This category encompasses a range of reporting services available for connection, designed to augment your feed optimisation initiatives. It does so by enabling the application of additional rules or filters, which are informed by the metrics available through these integrations.

      The data retrieved through these connections is item-level and campaign-level, for example product performance metrics, impressions, clicks, conversions, spend and similar aggregated measures, together with the product or campaign identifiers those metrics relate to. We do not retrieve user-level identifiers, cookie or client identifiers, device identifiers, IP addresses, or any other data relating to identifiable individuals. Reporting Data is used solely to inform the rules and filters you have configured within your account.

   3. Google APIs

      Where you choose to connect your Feedoptimise account to Google services (for example, Google Merchant Center, Google Ads, or Google Analytics), Feedoptimise retrieves data from those services on your behalf to support the features and integrations you have configured. The connection is initiated and authorised by you, and the data retrieved is limited to what is required to deliver the requested functionality.

      The data retrieved through these connections is item-level and campaign-level, for example product performance metrics, disapprovals, impressions, clicks and cost data. We do not retrieve user-level identifiers, cookie or client identifiers, or any data relating to identifiable individuals.

      Feedoptimise's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically:

      • We use data received from Google APIs only to provide and improve user-facing features you have configured or requested.
      • We do not use data received from Google APIs to train, fine-tune, or otherwise improve AI models, whether our own or those of third parties.
      • Where you configure a feature that involves transmitting data received from Google APIs to a third party (for example, including a Google metric as an attribute in a feed exported to a marketing channel, or invoking an AI-assisted action or the AI Feed Agent that processes Google API data), the relevant data is transmitted only to the destination you have configured and only to deliver the feature you have requested. Such transfers are permitted under the Limited Use requirements as part of providing user-facing functionality, and are handled in accordance with the applicable sub-clauses in the Third-party sharing section of this Privacy Policy.

4. Lawful basis for processing

   Where UK or EU GDPR applies, we rely on the following lawful bases under Article 6 to process personal data:

   1. Performance of a contract (Article 6(1)(b)). The majority of our processing is carried out to provide the Feedoptimise services you have signed up for, including creating and administering your account, providing platform access, delivering the features and integrations you have configured, and providing related support.
   2. Compliance with a legal obligation (Article 6(1)(c)). Certain processing is required to comply with statutory obligations to which we are subject, in particular the retention of billing, invoicing, and accounting records for tax purposes.
   3. Legitimate interests (Article 6(1)(f)). We process limited data, such as access logs and diagnostic information, where necessary for the legitimate interests of operating, securing, monitoring, and improving the platform and our public website, as well as for fraud prevention and protecting our infrastructure. We carry out a balancing assessment to ensure these interests are not overridden by your rights and freedoms.

   Feedoptimise services are provided on a business-to-business basis. We do not rely on consent as the primary lawful basis for processing personal data, except in respect of optional features or non-essential cookies, where consent is obtained separately and can be withdrawn at any time.

5. Data security

   We follow industry-standard practices and maintain technical and organisational security measures covering the collection, storage, and disclosure of personal data, in order to protect it against unauthorised access, alteration, disclosure, or destruction, and to comply with relevant UK and EU data protection laws.

   Personal data you provide to us is stored on infrastructure we operate on Google Cloud Platform. Connections between your browser and our platform are encrypted in transit using TLS, and data is encrypted at rest using AES-256 encryption applied at the infrastructure layer by our cloud provider. Access to systems containing personal data is restricted to authorised personnel on a need-to-know basis and is logged for audit purposes.

   Sensitive credentials that you provide to us to enable connections to your systems or third-party services (for example, FTP and SFTP passwords, API keys, and similar access tokens) are additionally encrypted at the application layer using AES-256-CBC before being written to our database. This means that, in addition to the infrastructure-level encryption described above, your credentials are stored in an encrypted form that requires application-managed keys to decrypt.

   Where we have issued you a password (or you have chosen one) that enables access to certain parts of our platform, you are responsible for keeping that password confidential and must not share it with anyone. Passwords are not stored in plain form. They are hashed using current industry-standard algorithms before being stored.

   To strengthen account security, we offer two-factor authentication (2FA) using a time-based one-time password (TOTP) authenticator app. 2FA is available to all Users and can be enabled at any time from your account settings. We strongly recommend enabling 2FA, particularly for accounts with administrative permissions or access to sensitive integrations.

   No method of transmission or storage is completely secure. While we use commercially reasonable measures to protect your data, we cannot guarantee absolute security. In the event of a personal data breach affecting your information, we will notify you and any relevant supervisory authority where required by applicable law and within the timeframes prescribed by UK and EU GDPR.

   We also process certain data for the purposes of operating the platform securely and protecting it from abuse. This includes monitoring access logs and authentication events to detect and respond to unauthorised access attempts, brute-force login attempts, and other suspicious activity; applying rate limits and automated controls to prevent misuse of the platform and its APIs; and recording changes made within accounts in our standard change history for audit and forensic purposes. This processing is carried out on the basis of our legitimate interests in maintaining the security, integrity, and availability of the service, as described in the Lawful basis for processing section.

6. Third-party sharing

   We do not sell, rent, or trade your personal data. We share data with third parties only in the limited circumstances described below, and only to the extent necessary for the relevant purpose.

   1. User-initiated integrations

      When you choose to connect your account with a third-party marketing channel or external service (for example, publishing a product feed to Google Shopping, Meta, or a comparable channel), we transmit the relevant Content to that destination on your behalf. The data sent is limited to what is required to fulfil the integration you have configured and consists of product and catalogue data. You control which integrations are enabled and what Content is included.

   2. AI-assisted actions

      Feedoptimise offers ad-hoc AI-assisted actions that you can choose to use to enhance your feed optimisation work, for example by generating or refining product attributes. You retain full control over whether and how these actions are used:

      • You choose the AI provider and model (for example, OpenAI, Anthropic, Google Gemini, xAI Grok, or another supported provider).
      • You supply your own API key for the chosen provider, which means the contractual relationship for that AI processing is between you and the provider directly. The provider's terms of service, privacy policy, and data-use policies apply to data sent through your key.
      • You decide which Content is sent for processing, and when. AI processing is not enabled by default.

      When you trigger an AI-assisted action, Feedoptimise transmits only the Content required to perform the requested operation to the provider you have configured, using your API key. We do not pass your Content to AI providers other than the one you have selected, and we do not use your Content to train AI models.

   3. Feedoptimise-AI (self-hosted models)

      Feedoptimise also offers AI modifiers, such as the Feedoptimise-AI Prompt and the Feedoptimise-AI Image Prompt, that run on open-weight models hosted on infrastructure we operate directly. Unlike the AI-assisted actions described above, these features do not require your own API key, and your Content is not transmitted to any third-party AI provider.

      To protect your Content when using these features:

      • AI processing is not enabled by default. Content is processed only when you add a self-hosted AI modifier to a feed, and only the Content referenced in your configured prompt, including any image URLs you supply, is processed.
      • Images supplied to the Feedoptimise-AI Image Prompt are downloaded from the URLs you provide solely to perform the requested operation. Where images depict individuals, we do not use them to identify any individual or to perform facial recognition.
      • AI outputs are stored as part of your Content so that unchanged data does not need to be processed again, and are retained and deleted in the same way as your other Content.
      • We do not use your Content, including prompts, images and outputs, to train, fine-tune, or otherwise improve AI models, whether our own or those of third parties.

   4. AI Feed Agent

      The AI Feed Agent is an in-platform AI assistant that helps with audits, diagnostics, rule drafting, and routine feed operations. The AI Feed Agent is an opt-in feature that you must activate separately for your account before it can be used. It is not enabled by default. Unlike the ad-hoc AI-assisted actions described above, the AI Feed Agent runs on infrastructure that Feedoptimise contracts for directly. The AI providers supporting the AI Feed Agent act as our sub-processors and are listed in the Infrastructure and sub-processors section below.

      To protect your Content when using this feature:

      • We engage AI providers under enterprise API terms that prohibit the use of your Content to train, fine-tune, or otherwise improve the providers' models.
      • Only the Content required to perform the requested operation is transmitted to the provider, and only when you invoke the AI Feed Agent.
      • Destructive actions (such as forcing imports, syncing feeds, or blocking items) require explicit confirmation before they are executed. All changes initiated by the Agent are recorded in the standard change history.
      • We do not use your Content to train AI models, whether our own or those of third parties.

   5. Internal use of AI for customer support

      We use AI tools internally to assist our team in operating our customer support function. This includes proofreading and drafting replies to support tickets, summarising conversations, and analysing aggregated patterns in support interactions to help us identify trends and improve our service. AI does not autonomously communicate with you, and any reply you receive from our team has been reviewed and sent by a member of our staff.

      To protect your information when we use AI in this way:

      • We engage AI providers for this purpose under enterprise API terms that prohibit the use of your data to train, fine-tune, or otherwise improve the providers' models.
      • We do not use AI to make decisions about you that have legal or similarly significant effects.
      • The AI providers we engage for support operations are listed in the Infrastructure and sub-processors section.

      This processing is carried out on the basis of our legitimate interests in operating an efficient and high-quality support function, as described in the Lawful basis for processing section.

   6. MCP Server

      Feedoptimise provides a Model Context Protocol (MCP) server that allows you to connect your Feedoptimise account to MCP-compatible AI assistants, such as Anthropic Claude or OpenAI ChatGPT, in order to manage your account through conversation. The connection is initiated and authorised by you. The AI assistant you connect is operated by the third-party provider you have chosen, and data exchanged between Feedoptimise and that assistant is therefore subject to the provider's own terms of service and privacy policy.

      Where you choose to use this feature:

      • Authentication uses OAuth2 with scoped access tokens. Access is limited to the Feedoptimise accounts your user has permission to access, and each session operates against one selected account at a time.
      • Your existing role and permissions in Feedoptimise apply to all actions taken through MCP. If your role on an account is read-only, the connection is read-only on that account.
      • Destructive actions (such as forcing imports, syncing feeds, blocking items, or changing schedules) require explicit confirmation before they are executed. All changes made through MCP are recorded in the standard change history with an MCP tag and attributed to the authenticated user.
      • You can revoke the connection at any time from within Feedoptimise (Account, Credentials Hub) or from the connector settings of your AI assistant.

   7. Infrastructure and sub-processors

      The Feedoptimise platform is hosted on Google Cloud Platform (GCP), which acts as our primary infrastructure sub-processor. The GCP infrastructure on which the platform runs is located in the United States. We also engage additional service providers to deliver specific elements of the service, including:

      • Payment processors, to facilitate billing and accept payments in supported currencies.
      • AI providers, to power the AI Feed Agent feature for customers who have opted in, and to support our internal customer support operations as described in the Internal use of AI for customer support sub-clause. We currently engage OpenAI (ChatGPT), Anthropic (Claude) and Google (Gemini API) under enterprise API terms that prohibit the providers from using your Content or other personal data to train their models. We may add further AI providers over time and will update this list accordingly.

      All sub-processors are contractually required to maintain security and confidentiality obligations consistent with this Privacy Policy and applicable data protection laws, and to process data only on our documented instructions. We do not authorise sub-processors to use your Content for their own purposes, including AI model training.

      Our self-hosted AI models run on hardware operated by Feedoptimise and located on our own premises in the United Kingdom. Data transmitted between our platform and this infrastructure is encrypted in transit.

   8. Legal and regulatory disclosure

      We may disclose data where required to do so by applicable law, court order, or other legal process, or where necessary to establish or defend legal claims, or to protect the rights, property, or safety of Feedoptimise, our Users, or others.

   9. International transfers

      Because our infrastructure provider Google Cloud Platform operates from the United States, and certain AI sub-processors also process data outside the United Kingdom and the European Economic Area, personal data processed through the platform may be transferred outside the UK and EEA. Where this occurs, we rely on the safeguards required under UK and EU GDPR, including:

      • The provider's certification under the EU-U.S. Data Privacy Framework (DPF) and the UK Extension to the EU-U.S. DPF, where available;
      • Standard Contractual Clauses (SCCs) and the UK International Data Transfer Agreement, where applicable.

      These mechanisms ensure that data processed on US-based infrastructure or by US-based sub-processors remains subject to protections equivalent to those required under UK and EU data protection law. Further details on Google's compliance framework are available at policies.google.com/privacy/frameworks.

      Content processed by our self-hosted AI models is processed in the United Kingdom and is not transferred to any third-party AI provider.

7. Cookies

   Also known as browser cookies or tracking cookies, cookies are small, often encrypted text files, located in browser directories. They are used by us to help our Users navigate this website efficiently and perform certain functions. Please note that cookies can't harm your computer.

   1. How we use cookies

      We use cookies to remember that you are logged in to our platform. This includes session cookies used during active sessions, as well as persistent cookies when you choose to stay logged in beyond a single session or to provide additional functionality.

   2. Cookies we use

      Below is a list of all the cookies we use or may use, along with an explanation of their purposes. All of our cookies are first-party cookies.

      1. Cookies used by the app.feedoptimise.com

         Name	Purpose	Length
         _sess*	This is a session cookie, it is being removed when you close your browser and is required for the core platform functionality.	Session
         _at	This cookie works in tandem with the _sess* cookie and allows us to keep you logged in and is required for the core platform functionality. It is stored for up to 1h unless you are actively using our system at which point it's auto-renewed.	1 hour (auto-renewed with session)
         _rm*	This cookie is set when you choose to remember that you are logged in for up to 14 days.	14 days
         _2f*	This cookie is set when you enable 2-factor authentication and choose not to be asked about the 2-factor authentication code with each login but every 30 days.	30 days

         * matches any text, those cookie names contain a fixed prefix and are followed by a random set of characters.

      2. Cookies used by the www.feedoptimise.com

         Name	Purpose	Length
         fo_cc	A strictly necessary cookie that enables the homepage to remember your cookie consent choices, ensuring compliance with privacy regulations and maintaining your selected preferences across browsing sessions.	365 days
         _ga _ga_* _gcl_*	These cookies are used by Google Analytics to help us understand how visitors use our homepage, for example which pages are viewed, how many visitors are new and how sessions develop. We use this information in aggregate to improve the website. The cookies store a randomly generated identifier for your browser, and while they are active Google receives information such as your IP address and device details, which may be considered personal data under UK and EU GDPR. We do not use this data to identify you or to build individual profiles. Google may process this data outside the UK and EEA, relying on its certification under the EU-U.S. Data Privacy Framework. These cookies are disabled by default and are set only if you allow analytics cookies when visiting our homepage, www.feedoptimise.com. You can change your choice at any time through the cookie settings.	more info
         _gcl_ls	localStorage key used by Google's Conversion Linker to store ad click IDs (gclid) for Google Ads conversion tracking. Set only if Advertisement cookies are allowed.	Persistent
         fo_mc	Feedoptimise localStorage key tracking page views from Google Ads visitors. Set only if Advertisement cookies are allowed.	30 days

         * matches any text, those cookie names contain a fixed prefix and are followed by a random set of characters.

8. How to contact us

   Feedoptimise ®™ is a trading name of 33Concept Ltd, a Private Limited Company registered in the United Kingdom under company number 07286718. 33Concept Ltd is the data controller responsible for the personal data it processes in its own right, including the account, billing and platform usage data described in section 2, and the cookie data described in section 7. Where Content submitted through the platform contains personal data, you remain the controller of that data, as set out in section 3.

   If you have questions about this Privacy Policy, wish to exercise any of your data protection rights, or have any other privacy-related concerns, you can reach us through any of the channels below:

   • By email: privacy@feedoptimise.com
   • By web form: www.feedoptimise.com/contact

9. Your rights under UK and EU GDPR

   Where UK or EU General Data Protection Regulation (GDPR) law applies to the processing of your personal data, you have the following rights:

   1. Right of access (Article 15). You have the right to obtain confirmation of whether we process your personal data and, if so, to receive a copy of that data along with information about how it is processed.
   2. Right to rectification (Article 16). You have the right to ask us to correct personal data that is inaccurate or to complete personal data that is incomplete.
   3. Right to erasure (Article 17). You have the right to ask us to delete your personal data in certain circumstances, for example where the data is no longer necessary for the purpose for which it was originally collected. This right is not absolute and may not apply where we are required to retain the data to comply with a legal obligation, such as the retention of billing and accounting records for tax purposes.
   4. Right to restriction of processing (Article 18). You have the right to ask us to restrict the processing of your personal data in certain circumstances, for example where you contest the accuracy of the data or have objected to its processing.
   5. Right to data portability (Article 20). You have the right to receive the personal data you have provided to us in a structured, commonly used, and machine-readable format, and to transmit that data to another controller, where the processing is based on contract or consent and is carried out by automated means.
   6. Right to object (Article 21). You have the right to object to the processing of your personal data where the processing is based on our legitimate interests. Where we cannot demonstrate compelling legitimate grounds that override your interests, rights, and freedoms, we will stop processing your data on that basis.
   7. Right to withdraw consent (Article 7). Where the processing of your personal data is based on consent, you have the right to withdraw that consent at any time. Withdrawal does not affect the lawfulness of any processing carried out before consent was withdrawn.

   To exercise any of these rights, please contact us by email at privacy@feedoptimise.com or through our web form. We will respond to your request within the timeframes required under applicable law, normally within one month of receipt. We may need to verify your identity before acting on a request, and we may extend the response period in line with applicable law where a request is complex or where we have received a number of requests from you.

   You also have the right to lodge a complaint with a data protection supervisory authority. In the United Kingdom, this is the Information Commissioner's Office (ico.org.uk). If you are based in the European Economic Area, you may contact your local supervisory authority.

10. Privacy policy updates

    Please note that this Privacy Policy may change from time to time. We will not reduce your rights under this Privacy Policy without your explicit consent. We will post any Privacy Policy changes on this page and if the changes are significant, we will provide a more prominent notice (including, for certain services, email notification of Privacy Policy changes).