starship / search / adroll-retargeting

Audit report

AdRoll Ads & Retargeting

Broad accessReach : moderateSensitive Access

by AdRoll · Marketing · Shopify App Store

Marketing

Risk level

Broad access

Executive summary

Reach more shoppers with automated Web, Mobile & Social Ads

Key insights

◆Publisher NextRoll (parent of AdRoll) holds SOC2 Type 2 and follows GDPR/CCPA/IAB TCF frameworks.
◆Privacy policy explicitly discloses use of LLMs and AI/ML for ad bidding and chatbots.
◆Primary publisher domain adroll.com serves HTTPS with HSTS (max-age=604800; includeSubDomains; preload) and a frame-ancestors CSP.
◆No confirmed public breach attributed to AdRoll/NextRoll; one historical CVE relates to a WordPress AdRoll for WooCommerce plugin, not the Shopify integration.

Top findings

No critical or high findings detected.

Synthesis

Analysis summary

Reach more shoppers with automated Web, Mobile & Social Ads

Key insights

◆Publisher NextRoll (parent of AdRoll) holds SOC2 Type 2 and follows GDPR/CCPA/IAB TCF frameworks.
◆Privacy policy explicitly discloses use of LLMs and AI/ML for ad bidding and chatbots.
◆Primary publisher domain adroll.com serves HTTPS with HSTS (max-age=604800; includeSubDomains; preload) and a frame-ancestors CSP.
◆No confirmed public breach attributed to AdRoll/NextRoll; one historical CVE relates to a WordPress AdRoll for WooCommerce plugin, not the Shopify integration.
◆Heavy ad-tech data-sharing model: numerous named sub-processors (LiveRamp, Bombora, Experian, Eyeota, ad exchanges, SSPs).

Detections

Findings (4)

Risks detected through static, network, and policy analysis.

Extensive third-party data sharing for ad targeting

Medium

NextRoll privacy policy names a broad list of sub-processors and data partners (LiveRamp, Bombora, Experian, Eyeota, ad exchanges, supply-side platforms) and uses LLMs/AI chatbots. This expands data flow surface beyond the merchant's own perimeter.

Evidence

https://www.nextroll.com/privacy

Cross-border data transfers to the United States

Medium

Personal data collected via the app may be transferred to and processed in the United States, requiring merchants outside the US (especially EU/UK) to validate SCCs/UK IDTA.

Evidence

https://www.nextroll.com/privacy

Long retention windows for advertising identifiers

Low

Cookies / mobile identifiers retained 13 months from last device access; browsing history 12 months; hashed emails 12 months. Acceptable for ad-tech but worth surfacing to merchants in privacy notices.

Evidence

https://www.nextroll.com/privacy

Shopify App Store listing deprecation history

Info

Shopify previously announced AdRoll was no longer supported on App Store listings due to low usage; merchants should confirm the listing is currently active and supported before installing.

Evidence

https://shopify.dev/changelog/adroll-is-no-longer-supported-on-shopify-app-store-listings

This section is available to signed-in users

Get started

Permissions

OAuth scopes requested

These are the access permissions this app asks for during install. The sensitivity column reflects PII exposure and merchant impact.

Scope	Sensitivity	Why we flag it
`read_products`	Low	Inferred for dynamic product ads / catalog ingestion (scope block not exposed on listing page).
`read_orders`	High	Inferred for conversion tracking and ROAS attribution.
`read_customers`	High	Inferred for audience segmentation and hashed-email matching to ad networks.

read_products

Low

Inferred for dynamic product ads / catalog ingestion (scope block not exposed on listing page).

read_orders

High

Inferred for conversion tracking and ROAS attribution.

read_customers

High

Inferred for audience segmentation and hashed-email matching to ad networks.

Where data goes

Data flow

Destinations and sub-processors detected from network analysis and policy review.

adroll.com

US · Ad serving, retargeting, conversion tracking

Declared

nextroll.com

US · Parent platform / data processing

Declared

Sub-processors

LiveRampBomboraExperianEyeotaAd exchangesSupply-side platformsEmail service providersSocial media providersData hosting providersChatbot service providersFraud prevention servicesViewability reporting services

Data residency: US

This section is available to signed-in users

Get started

This section is available to signed-in users

Get started

Attack surface

Network surface

Primary domain: adroll.com
TLS grade: A
HSTS: Enabled
CSP: Enabled

HSTS max-age=604800 includeSubDomains preload; CSP limited to frame-ancestors directive (no script-src/default-src enforced via header at root).

Posture

Compliance & certifications

GDPR webhooks Pass

SOC 2 Type II Pass

ISO 27001 Fail

PCI DSS Fail

SOC2 Type 2 (Security & Privacy) audited; GDPR + CCPA addressed; IAB TCF participant. ISO27001 / PCI DSS / HIPAA not stated.

Track record

Publisher reputation

Publisher: AdRoll
Verified Shopify Partner: No
Years active: 0
Other apps: 0

Past incidents

No past incidents on record.

LLM exposure

AI / LLM usage

LLM providers

Data shared with providers

AI/ML used for ad bidding and chatbot interactions; specific LLM providers not disclosed.

Retention policy

Bidding requests retained 7 days; chatbot data falls under general privacy retention windows.