Privacy Policy

1. Who we are

The 314 (the-314.com) is a revenue recovery platform that helps businesses identify, understand and re-engage their website visitors. This policy explains what data we collect, how we use it, and your rights.

314 is a trading name of 314 Labs LLC, 222 North City, San Marcos, CA 92078, USA. 314 Labs LLC is the data controller for the personal data described in this policy.

If you have any questions, reach us at sasha@the-314.com or +1 442 339 8836.

2. What we collect

From our customers (you, the business using The 314):

• Account info: name, email, company, billing details.
• Usage data: how you use the dashboard, features accessed, support requests.

From visitors to our customers’ websites (via the 314 snippet):

• Device and browser metadata (user agent, screen size, language, timezone).
• Referrer, UTM parameters, pages visited, session duration, scroll and interaction events.
• Identity data voluntarily submitted through forms (email, name, phone), and identity data resolved from email-link clicks.
• A first-party identifier stored in localStorage to recognize returning visitors.
• Ad click and ad-tag identifiers. When a visitor arrives from an ad, the ad platform adds an identifier of that click to the page address (Meta’s fbclid, Google’s gclid and its related parameters, Microsoft’s msclkid, TikTok’s ttclid); we keep it with the visit. Where the website also runs Meta’s pixel or Google’s tag, the snippet reads the first-party cookies those tags keep on that website and keeps them with the visit too: _fbc, _gcl_aw, _gcl_gb and _gcl_dc, which carry the ad click, and _fbp and _ga, which identify the browser to those tags across visits, whether or not it came from an ad. The snippet only reads them: it never sets, extends or changes a cookie of an ad platform. Our customer uses these identifiers to see which ad a visit came from.

From the systems our customers connect (a Shopify store, Stripe, a Meta or Google Ads account, Google Search Console, a Google Business Profile, booking and invoicing tools):

• Customer records: name, email, phone, tags, and whether the person has agreed to email or SMS marketing.
• Commerce records: orders, payments, refunds, shipping and delivery status, returns, invoices and started checkouts, with the billing and shipping addresses those records carry.
• Advertising records, from a connected Meta (Facebook) ad account: the name of the person who connected it, the ad accounts they can reach, and, for the ad accounts the customer chose, their campaigns, ad sets and ads: their names, whether each is on or paused and whether it is delivering, their settings (budgets and schedules, who an ad set is shown to and where, what it optimises for, what an ad tracks), what each ad shows (its texts, pictures, button and link), the changes made to those settings in Meta (what changed and when we noticed it, not who made the change), and each one’s daily spend, impressions, clicks and results as Meta reports them. We use the access to read these records and, only when a 314 user presses the button for it in 314, to pause or resume a campaign, ad set or ad or to change its daily budget; each change made through 314 is kept in 314 with the 314 user who asked for it and when. We do not create, edit or delete ads in any other way, and we do not receive that person’s email address, password, friends or posts. Where an ad is published from a Facebook Page, we read what the ad shows from that Page (its post, pictures, text and link) and nothing else of the Page.
• Advertising records, from a connected Google Ads account: the name and email of the Google account that connected it, the ad accounts it can reach, and, for the ad accounts the customer chose, their campaigns, ad groups, asset groups and ads: their names, whether each is on or paused and whether it is serving, their settings (budgets, bidding, schedules, locations and languages, keywords, audiences by name, linked assets such as sitelinks), what each ad shows (its texts, pictures, videos and links), and each one’s daily spend, impressions, clicks and conversions as Google reports them. We also read the ad account’s own log of edits: what was changed, when, and the email address of the Google account that made the change, so that the customer can see who changed a campaign. We use the access only to read; we do not change campaigns, and we do not receive that person’s password or the contents of their Google account.
• Search records, from a connected Google Search Console property: the name and email of the Google account that connected it, and the website’s search performance — queries, pages, countries, clicks, impressions and position — with whether its pages are indexed.
• Business listing records, from a connected Google Business Profile: the name and email of the Google account that connected it, the business locations it manages, and, for the location the customer chose, what the listing says (name, categories, address, phone, hours, description, photos and posts), its reviews with the name and picture each reviewer shows publicly on Google and the replies to them, and how often the listing was seen and acted on in Google Search and Maps. With this access we also publish what the customer has written, approved, or asked the 314 assistant to make (in 314 or in a connected AI client, as section 6 describes): an edit to the listing, a post, a reply to a review.

We receive this data only after the customer connects the system and approves the access it asks for, and only for that customer’s own account. For a Shopify store this is the 314 app for Shopify: it reads the store’s data and never writes to the store. Payment records carry what the payment provider exposes — the card brand and its last four digits; we never receive a full card number.

We do not collect sensitive personal data (health, financial account numbers, government IDs) and we do not knowingly collect data from children under 16.

3. How we use it

• To operate the service our customers pay for: identify visitors, score intent, trigger recovery campaigns.
• To enrich profiles with publicly available business information (company, role).
• To communicate with customers about their account, billing, and product updates.
• To improve reliability, security and performance.

Data from a connected system is used only to provide the service to the customer who connected it. It is never combined across customers or shared between them.

We do not sell personal data. We do not use it to train third-party AI models.

Data received from Google. 314’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In practice: what we receive from a Google Ads account, a Search Console property or a Business Profile is used only to show it to the customer who connected it and to let that customer’s 314 assistant work with it. We do not use it for advertising of our own, we do not sell it, we do not use it to train general-purpose AI models, and we do not transfer it to anyone except the service providers needed to run those features (section 5), or where the law requires it. Our staff do not read it unless the customer asks us to look at specific data, it is needed for security (such as investigating abuse) or to comply with the law, or it has been aggregated and anonymized for the internal operation of the service.

4. Legal basis (GDPR)

For customers: we process data to perform our contract with you and for our legitimate interest in running the service.

For visitors tracked via our customers’ sites, and for the people in the systems our customers connect (such as the shoppers of a connected Shopify store): the customer is the data controller and is responsible for obtaining consent where required by local law (GDPR, CCPA, ePrivacy). We act as a data processor.

5. Sharing

We share data only with service providers strictly needed to deliver The 314: hosting, analytics of our own product, email delivery, SMS delivery, payment processing, and the AI model providers that power the 314 assistant (see section 6). All providers are bound by data processing agreements.

We may disclose information if required by law or to protect rights, safety, or property.

We will not share mobile information with third parties or affiliates for promotional or marketing purposes. Text messaging originator opt-in data and consent are never shared with any third party, other than the messaging providers strictly required to deliver the message.

6. AI assistant and connectors

The 314 includes an AI assistant that reads your project’s data to answer questions, draft segments, emails, popups, landing pages and SMS, and propose automations. To do this we send the data the assistant works on to AI model providers acting as our service providers — Anthropic (the assistant itself and the review of drafted content) and Google (image generation and search inside your own notes). They process it only to provide the service to us, under data processing agreements, and — as section 3 says — not to train their models.

Connecting 314 to an AI client of your own (Claude, ChatGPT or another client that supports the Model Context Protocol) is optional and per account. When you connect one, the questions you ask in that client and the data the assistant reads to answer them are handled by that client’s provider under their terms and privacy policy, not ours; we receive only the tool requests the client sends us and answer them. The consent screen shown when you connect says exactly what the client may do — read your data, or read it and also create and edit marketing assets — and you choose. Anything new the assistant creates lands as a draft for your approval; an edit you ask for on something already live takes effect at once, as it does in the 314 chat.

You can see every connected client and disconnect it at any time under Settings → Integrations → Claude / MCP → Connections in your account. Disconnecting revokes the client’s access immediately; it does not delete data the client’s provider may have retained on their side. See how to connect an AI assistant.

7. Mobile numbers & SMS

If you are an account holder and choose to receive SMS notifications, we collect your mobile number and a record of your consent (the timestamp and where it was given). We use the number only to send the account notifications you opted in to, and to respond to HELP requests.

Your mobile number is shared only with the messaging carrier and our messaging provider for the sole purpose of delivering those messages. It is not sold, rented, or shared with anyone for their own marketing, and it is not used to build advertising audiences.

You can withdraw consent at any time by replying STOP to any message or by turning SMS notifications off in your account settings. We keep a record of opt-outs so that we do not message a number that has unsubscribed.

8. Retention

Visitor data, and the data received from the systems our customers connect, is retained for as long as our customer’s account is active, plus up to 90 days after cancellation for backup and audit. Customers can request earlier deletion at any time.

Connected systems. Disconnecting a system — Shopify, Stripe, a Meta or Google Ads account, Google Search Console, a Google Business Profile, a booking or an invoicing tool — stops the flow of data at once, and the access credentials we held for that system are erased in the same step. The records already received stay in the customer’s account under the rule above until the customer deletes them, asks us to, or closes the account.

Connected Shopify stores follow that rule and go one step further. Uninstalling the 314 app from the store is a disconnect, so the flow stops and the store’s credentials are erased that moment. When Shopify sends its shop redaction request, 48 hours after the uninstall, we also delete what a disconnect leaves behind: the record of the connection with the store’s own details, and every Shopify record we archived from it. The customer profiles and timelines already built from those records stay in the merchant’s 314 account under the rule above, and the merchant can delete any of them at any time.

When a store forwards a shopper’s erasure request through Shopify, we delete that shopper’s profile, timeline and archived records for that store, with no action needed from the merchant. When a store forwards a shopper’s request for their data, we notify the store owner, who answers it; we provide the export on request.

9. Your rights

Depending on your jurisdiction you may have the right to access, correct, export or delete your personal data, and to object to or restrict processing. To exercise these rights, email sasha@the-314.com. We respond within 30 days. The steps for deleting an account, a connected system’s data or a single profile are on the Data deletion page.

If you are a customer of a business that uses 314 — for example a shopper of a connected Shopify store — that business decides how your data is used, so the quickest route is to ask them; a request they pass on to us, or one Shopify sends on their behalf, is carried out as described in section 8. You can also write to us directly and we will route it to the right business.

10. Security

Data is encrypted in transit (TLS) and at rest. Access to production systems is restricted and logged. We run regular security reviews and follow standard industry practices.

11. International transfers

Our infrastructure may be located outside your country of residence. Where required, we rely on Standard Contractual Clauses and equivalent safeguards for transfers.

12. Changes

We may update this policy from time to time. Material changes will be announced by email or in-product notice before taking effect.