Privacy Policy

Who we are

StoreInsights is a profit-analytics dashboard for merchants who sell on Shopify and advertise on Meta. The service is operated by [legal entity — to confirm], registered at [registered address — to confirm].

For anything in this policy, the contact point is [email protected]. We have not appointed a Data Protection Officer; at our size, one is not required, and requests go straight to the people running the service.

Two different roles

This matters more than it sounds, because it decides who is responsible for what.

• For your account with us — your email address, your organisation, your settings — we are the controller. We decide what to collect and why, and this policy is our disclosure.
• For the data we read from your Shopify store and your Meta ad account — your orders, your ad metrics, and any personal data about your customers contained in them — we act as a processor on your behalf. You are the controller of your customers' data; we only process it to produce your dashboard, on your instructions, and we never use it for our own purposes.

Concretely: if one of your customers asks what happened to their data, that request goes to you, and we will help you answer it. We will never contact your customers ourselves.

What we store, and why

Your account

• Your email address and, if you provide it, your name.
• Authentication data (a password hash or the identifiers from the sign-in method you used) and session data.
• Your organisation, its members, and any invitations you send to teammates.
• Your product settings: cost of goods per product variant, shipping rates per country, and your target thresholds.

Purpose: giving you an account and computing your figures. Legal basis: performance of our contract with you (GDPR Article 6(1)(b)).

Your store connections

• Your Shopify shop domain and the ad account you select on Meta.
• The OAuth access tokens both platforms issue. They are held server-side, used only by our sync jobs, and never saved in your browser.

Your orders, as pulled from Shopify

We do not copy the whole Shopify order. For each order in the synced window we keep a reduced record: the order id and number, the creation date, the destination country code, the line items (product and variant identifiers, SKU, title, quantity, price), the gross and net amounts, discounts, the payment and fulfilment status, and the UTM campaign, source and medium the order arrived with.

That record is also cached in your own browser, so the dashboard stays fast between syncs. Clearing it from the settings screen removes the local copy.

We must also tell you this: the customer email address recorded on the order is currently kept in that record — which means it is held on our side and in that browser cache too. It is not displayed anywhere in the dashboard, is not used in any calculation, and is never used to contact anyone. We regard it as data we do not need, and removing it from what we store is on our list — we would rather say so here than let you discover it.

We do not store customer names, postal addresses, phone numbers or payment details. We never receive card numbers: payment is handled entirely by Shopify and its payment providers.

Your Meta advertising metrics

• Identifiers and names of your ad accounts, campaigns, ad sets and ads.
• Daily spend, impressions, clicks, and the conversions Meta attributes to them.

These are aggregated advertising statistics. StoreInsights operates no tracking pixel of its own, builds no profiles of the people who see your ads, and reads no audience or targeting data.

This website

The marketing site you are reading sets no cookies and runs no analytics or session-recording script. A Microsoft Clarity tag used to load here without asking your consent; it has been removed.

Two things are still fetched from third parties to render these pages, and doing so exposes your IP address and browser to them: the typeface, from Google Fonts, and the icon set, from Cloudflare's cdnjs. Our hosting provider also keeps standard server logs, including IP addresses, for security and troubleshooting. Legal basis: our legitimate interest in serving and protecting the site (Article 6(1)(f)).

The demo

The public demo at app.storeinsights.co/?demo=1 runs on a dataset generated in your own browser. It needs no account, sends nothing to us, and stores nothing on our servers. The sample data stays in your browser's local storage until you clear it from the settings screen.

What we do not do

• We do not sell, rent or share your data, or your customers' data, with anyone.
• We do not use your data to train machine-learning models.
• We do not run advertising or profiling on our own account.
• We do not write to your store or your ad account. Our access is read-only.
• We do not make automated decisions with legal or similarly significant effects about anyone.

Who else touches the data

We keep the list short on purpose. It will change as the product is built, and this page is updated when it does.

Provider	What for	Where
DigitalOcean	Hosting of this website and of the application	[EU region — to confirm]
[back-end and database provider — to confirm]	Database, authentication, scheduled data syncs	[to confirm]
Google Fonts, Cloudflare (cdnjs)	Typeface and icons for this website only; they receive your IP address	Global CDN

Shopify and Meta are not sub-processors of ours. They are your own accounts, and we read from them because you authorised us to. Their handling of your data is governed by your agreements with them.

We aim to keep the data we control inside the European Union. Where a provider processes data outside the EU, that transfer relies on the European Commission's Standard Contractual Clauses or an adequacy decision. [to confirm once the back-end migration is settled]

How long we keep it

• Order and advertising data: for as long as your account is active, so your history stays comparable year over year.
• When you disconnect a store or uninstall the app: its access tokens are revoked immediately and its cached data is deleted within 30 days.
• When you close your account: everything associated with it is deleted within 30 days, backups included on their own rotation.
• Server logs: kept for a short period for security purposes, then discarded.

You do not have to wait for any of that. Ask, and we delete.

Security

Access tokens for Shopify and Meta are used server-side only, and your browser never stores one. Traffic is served over TLS. Access to production data is limited to the people who operate the service.

Being straight with you: StoreInsights is a young product in beta. We hold no SOC 2, ISO 27001 or equivalent certification, and we do not claim one. If a breach affects your data, we will tell you and the relevant supervisory authority, without hiding behind a delay.

Your rights

If you are in the EU or the UK, the GDPR gives you the right to ask us to:

• confirm what personal data we hold about you, and give you a copy (access);
• correct anything inaccurate (rectification);
• delete it (erasure);
• restrict how we use it, or object to a use based on our legitimate interests;
• hand it over in a portable, machine-readable format;
• withdraw a consent you gave, at any time, without that affecting what came before.

Write to [email protected]. We answer within one month, and we do not charge for it. We may need to check that the request really comes from you before acting on it.

If a request concerns one of your customers rather than you, we act as your processor: send it to us and we will carry out the deletion or the export, but the answer to your customer comes from you as the controller.

You also have the right to lodge a complaint with a data protection supervisory authority in the country where you live or work. We would rather you told us first, but that right is yours either way.

Children

StoreInsights is a business tool sold to merchants. It is not directed at children and we do not knowingly create accounts for anyone under 16.

Changes to this policy

The product is being built, so this page will change. The date at the top always reflects the current version, and we will notify account holders by email before a change that materially affects them takes effect.

Contact

Privacy questions and requests: [email protected]. Anything else: see the contact page.