Privacy policy

Who we are

Oasis is an analytics product for ecommerce brands, made by Highgage Media LLC, a company registered in Wyoming, United States ("we", "us"). This policy explains what personal data we handle, why, and the choices you have. It covers this website and the Oasis app.

Questions about privacy, or a request about your data: email hello@oasisapp.io.

Our two roles

For our own customers and visitors, we decide how your data is used, so we're the controller. That's you if you visit this site, sign up, or use Oasis as a member of a brand's or agency's team.

For a brand's store data, the brand is the controller and we process it on its behalf. That's the data Oasis reads from the brand's Shopify store and the platforms it connects, and what the Oasis pixel records on its store. If you shopped with a brand that uses Oasis, the brand's own privacy policy applies, and the brand is the first place to ask about your data. We help brands answer those requests.

What we collect

When you visit this website

• Your cookie choice, kept in your browser.
• If you accept cookies: Meta's advertising cookies, which tell Meta which pages you saw so we can measure our ads and show them to the right people. See Cookies.
• Our network provider, Cloudflare, handles every request to the site, including your IP address and browser details, to deliver the pages and keep the site safe.

When you sign up and use Oasis

• Your name, work email and password. We store the password only as a one-way hash, never as you typed it.
• The sign-in codes we email you, and the date and time you sign in.
• Your store's address and the accounts you connect.
• Billing details. Stripe takes your card; we never see or store the full card number.
• What you tell us when you email us.

Store data, processed for brands

• From Shopify: orders, refunds, products, stock and costs, and the brand's customers: names, email addresses, phone numbers, and billing and shipping addresses.
• From Meta, Google and TikTok: ad spend, campaigns, ads and their results.
• From Klaviyo: email and SMS results, and list and segment sizes.
• From Loop: subscriptions and their status.
• From the Oasis pixel, once a brand switches it on in its store: the pages a shopper visits, carts, checkouts and purchases; ad click IDs from Google and Meta; campaign tags (UTMs); the page they came from; their browser; a one-way hash of their IP address; and a random ID kept in their browser so visits can be linked to an order. Once a shopper buys, their email address is linked to that ID.

Explore shows ads that brands publish in Meta's and TikTok's public ad libraries. It holds no personal data about shoppers.

How we use it

• To run Oasis: bringing a brand's sales, ads and costs together, and crediting each order to the ads that led to it.
• To send a brand's purchases to Meta through the Conversions API, when the brand switches that on, so its ads are measured accurately.
• To sign you in, keep accounts secure and stop misuse.
• To bill you and keep the records the law requires.
• To answer you, and to tell you about changes to Oasis or your account.
• With your consent, to measure our own ads on Meta.

We don't sell personal data. We don't use a brand's store data for anyone but that brand, or to advertise to its shoppers. We don't use data from Google's services to train AI models.

Our legal basis

Under UK and EU data protection law, we rely on:

• Contract: to give you the Oasis account you signed up for.
• Legitimate interests: to keep Oasis secure and working well, and to answer you. We weigh these against your rights.
• Consent: for advertising cookies. You can change your mind any time with Cookie settings at the foot of every page.
• Legal obligation: for billing and tax records.

For store data, we act on the brand's instructions under our agreement with it.

AI apps

You can connect an AI app, such as Claude or ChatGPT, to your Oasis account. When you do, the app can read your brand's Oasis data when you ask it to, and only what your login can see. The AI provider handles that data under your own agreement with them, so check their terms. You can disconnect an app any time in Oasis.

Who we share it with

We use a few providers to run Oasis. Each one handles data only to do its job for us:

Data also goes to Meta when a brand switches on the Conversions API (into the brand's own Meta account), and when you accept advertising cookies on this site. We share data if the law requires it, and if Oasis is ever sold or merged, it moves to the new owner under this policy.

International transfers

Oasis runs on servers in Germany. Some of our providers handle data in other countries, including the United States. Where data leaves the UK or the European Economic Area, we rely on protections the law recognises, such as the European Commission's Standard Contractual Clauses (with the UK's addendum) or the EU-US Data Privacy Framework.

How long we keep it

• Your account: while it's open. When you close it, we delete it, except what the law makes us keep.
• A brand's store data: while the brand uses Oasis, then deleted within 90 days of the account closing or the Shopify app being removed. When Shopify passes on a shopper's request to delete their data, we delete it within 30 days.
• Pixel visits: 90 days. After that we keep only each order's summary: where the order came from and which campaigns helped it.
• System logs: 30 days.
• Backups: 7 days.
• Billing records: as long as tax law requires.
• Your cookie choice: 6 months, then we ask again.

Your rights

You can ask us for a copy of your data, to correct it, to delete it, to move it to another service, or to stop or limit how we use it. Where we rely on your consent, you can withdraw it any time. Email hello@oasisapp.io and we'll reply within a month.

If you shopped with a brand that uses Oasis, ask the brand first; we'll help it answer you. In the UK you can complain to the Information Commissioner's Office (ico.org.uk), and in the EU to your local data protection authority, though we'd like the chance to put things right first.

Security

Data travels encrypted between your browser, our servers and the platforms Oasis connects to. Passwords are stored only as one-way hashes. Each brand's data is separated from every other brand's. Only named staff can reach the servers, with keys rather than passwords.

Cookies

This website uses one item that's needed for it to work, and advertising cookies only if you accept them:

When you sign in to Oasis, the app sets a cookie that keeps you signed in. It's needed for the app to work.

Change your choice any time with Cookie settings. If your browser sends a Global Privacy Control signal, we treat it as a no.

Children

Oasis is for businesses and isn't meant for anyone under 16. We don't knowingly collect their data.

Changes

When we change this policy, we'll update this page and the date at the top. If the change matters, we'll email account holders before it takes effect.