Changeline privacy policy

Last updated: 7 October 2026

Changeline ("we") is a marketing change log: teams record the changes they make to ads, websites, tracking and CRM on a shared timeline. This page explains what personal data we handle and why. Questions or requests: contact@changeline.app.

Changeline is operated by REMA CONSULTORIA LTDA (CNPJ 66.917.571/0001-01), Av. Diário de Notícias, 400, Sala 705 – Cristal, Porto Alegre – RS, 90810-080, Brazil. Contact: contact@changeline.app.

What we collect

• Account data: your e-mail address. If you sign in with Google or Microsoft, also the name (and, with Google, the profile picture) they share with us.
• Content you add: projects, changes, tags, notes, links, and the e-mail addresses of people you invite to a project.
• Feedback you send: if you use the Feedback button, your message, the type you picked, any images or video you attach, the e-mail you give us (or your account e-mail when signed in), the page you were on, your browser and screen size. Attachments are kept in private storage that only we can open. We use this only to understand and answer your feedback.
• Activity history: who created or edited each change and when, so your team can see the edit history.
• Usage data: while you are signed in to the app, we count per day how many visits you make and for how many minutes you actively use it (time only counts while the app is open on screen and in use), and when you were last active. We also record your plan (for example Free) and any change to it. Only the Changeline administrator can see this data.
• Technical data: IP address, browser and device data in server and security logs kept by our hosting and authentication providers.
• Website and app analytics (Google Analytics): the pages you view, the buttons you use (for example "Start now"), where the visit came from (a search engine, an AI assistant, another site or a link), your approximate country, device and browser. In the app we also record events such as "project created" or "change logged" with a random account ID - never your e-mail, names, project names or anything you log. In the EU/EEA, the UK, Switzerland and Brazil, Google Analytics only sets cookies after you click Accept; without that it receives only signals without cookies (Google Consent Mode). You can change your choice at any time with the "Cookies" link at the bottom of the site.
• Browser storage and cookies: your sign-in session, your language and theme choices, the time of your last activity (used to count visits) and your cookie choice (cookie cl_consent). If you accept analytics cookies, Google Analytics sets _ga and _ga_*, and we set cl_ft (the first page and the kind of source that brought you to Changeline, for example "Google search" or "AI assistant"). We use no advertising cookies.

Why we use it

• To create your account, sign you in and send sign-in links (performance of our contract with you).
• To show your projects to you and to the people you share them with (contract).
• To keep the service secure and prevent abuse (legitimate interest).
• To understand how Changeline is used (how many people are active, how often and for how long) and improve it, and to manage your plan (legitimate interest; plans are also part of our contract with you).
• To measure how people find and use the website and app with Google Analytics (your consent where the law requires it; otherwise legitimate interest - you can refuse at any time).
• To answer you when you write to us. We do not sell your data and do not use it for advertising.

Who processes it for us

• Supabase - database and sign-in. Data is stored in the European Union (Ireland).
• Vercel - hosting of the website and app (global network).
• Google - only if you choose "Continue with Google".
• Microsoft - only if you choose "Continue with Microsoft".
• Cloudflare - domain name (DNS).
• Resend - sends us the feedback you submit by e-mail.
• Google Analytics (Google Ireland Ltd. / Google LLC) - website and app analytics as described above. Data is kept for 14 months.
• Google and Meta - only if you connect Google Ads or Meta Ads (see "Google Ads and Meta Ads integrations").
• Paddle (Paddle.com Market Ltd) - our reseller and Merchant of Record for paid plans: checkout, payment, invoices, sales tax and refunds. Paddle receives your payment details directly under its own privacy policy; we never see your full card number.
• Where a provider processes data outside your country, it does so under standard contractual clauses or an equivalent safeguard.

Google Ads and Meta Ads integrations

• Optional. Connecting Google Ads or Meta Ads is your choice. Only the owner or an editor of a project can connect one, by signing in with their own Google or Facebook account.
• Read-only. Changeline never creates, changes, pauses or deletes anything in your ad accounts. Our server only allows read requests.
• What we read from Google (scope https://www.googleapis.com/auth/adwords): the e-mail and ID of the Google account that connected; the list of ad accounts it can access (ID, name, currency, time zone); and the accounts' change history (change events): date and time, e-mail of the person who made the change, where it was made (interface, app, API, rules), the type and name of the item changed (campaign, ad group, ad, budget, keyword), and the values before and after.
• What we read from Meta (permission ads_read): the name and ID of the Facebook user; the list of ad accounts (ID, name, currency, time zone); the accounts' activity log: who changed what and when, with object names and values; and the names of campaigns and ad sets, only to identify the items changed.
• What we do not read: performance metrics, audiences, payment data or the content of ad creatives.
• How we use it: only to build the change timeline of the project you linked. We do not sell this data, do not use it for advertising and do not use it to train AI models. We share it with no one except the processors already listed in this policy (Supabase, for hosting, in the EU/Ireland). Nobody on our team reads it unless you authorise it, it is needed for security, or the law requires it.
• Security: access tokens are stored encrypted (Supabase Vault), never reach your browser and never appear in logs. The connection uses OAuth with state and PKCE.
• How long we keep it: the connection and its token stay until you disconnect. When you disconnect (Integrations → Disconnect), the token is revoked with Google or Meta and deleted. When you unlink an ad account, you choose whether to keep or delete the history already imported. Deleting the project or your Changeline account deletes everything. Sync logs are kept for 90 days.
• Revoke or delete: you can also revoke access at myaccount.google.com/permissions or in your Facebook settings (Business integrations). Step by step: Data deletion. To ask us to delete data, write to contact@changeline.app; we reply within 30 days.
• Google API Services User Data Policy: Changeline's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

How long we keep it

While your account is active. Usage data is kept per day while your account exists and is deleted together with it. If you ask us to delete your account, we delete your account data within 30 days. Content in projects owned by other people stays with those projects. Provider backups expire on their own schedule.

Your rights

Depending on where you live (for example under the GDPR in Europe or the LGPD in Brazil) you can ask to access, correct, export or delete your data, or object to how we use it. Write to contact@changeline.app. You can also complain to your data protection authority.

Children

Changeline is a work tool and is not meant for people under 16.

Changes to this policy

If we change this policy in a way that matters, we will update this page and tell account holders by e-mail before it applies.