Privacy Policy

1. Data controller

2. Data we collect

• Account: name, email, password (hashed), preferences
• Shopify store: orders, products, customers, metrics (via OAuth — Shopify does not bill our subscription)
• Advertising: spend and performance data from Meta, TikTok, Google and Klaviyo (if connected)
• Store orders: amount, products, date and, for shipping, city, postal code and country. The buyer's email, name and phone number are encrypted at rest; no street name or street number is requested from Shopify, and no payment method is stored.
• IP address: the visitor's IP address is recorded with each measurement event, and the buyer's IP address is received from Shopify with the order. It is used for fraud detection, to exclude the merchant's internal traffic and to match conversions on ad platforms. Raw events are deleted after 90 days. The browser fingerprint described below, for its part, only uses a truncated IP address, with its last octet removed.
• Payment: Shopify subscription ID and subscription status — no card numbers are stored on our side. An identifier from an earlier payment, if one remains, is kept until that contract is closed.
• Support: messages sent through the contact form or the chat
• Analytics: anonymized or pseudonymized events (PostHog), if you accept analytics cookies

2.1 Security

Customer PII (email, name, phone) and API tokens (Shopify, Meta, etc.) are encrypted at rest (AES-256-GCM). Email lookups use cryptographic hashes, with no plaintext index.

2.2 Browser fingerprint

On our customers' stores, our measurement script may compute a technical browser fingerprint: a value derived from device characteristics (graphics rendering, screen resolution, time zone, language, platform). It is used solely to recognize a visitor whose cookies have been cleared, so that the same visit is not counted twice. The merchant is the controller for the processing carried out on their store.

• Refusal honored: if the visitor or the merchant's banner refuses tracking (ppp.consentPii(false) or Consent Mode ad_user_data: denied), the fingerprint is neither computed nor sent. The event may be recorded without an identifier for the store's statistics, but nothing is sent to ad platforms (Meta, TikTok, Google): neither the event nor the purchase that follows. A purchase is only sent to an ad platform if the visitor's marketing consent was recorded on the browser that paid, at the time of payment (within the 24 hours preceding it): older consent, or consent given on another device, is not enough. A refusal given during a visit is recorded (only the browser identifier and the date, nothing else) so that it is respected at the time of purchase; measurement and advertising cookies are then deleted.
• Page engagement: scroll depth (25, 50, 75, 100%) and clicks on buttons and links are measured anonymously, with no cookie, no visitor identifier, no IP address and no URL parameters, either with analytics consent or through anonymous audience measurement when the merchant has enabled it. They are never sent to ad platforms and are kept for 90 days.
• Shopify store: the pixel waits for Shopify's Customer Privacy API. Until marketing is accepted, nothing is sent to ad platforms, and the email, phone number, IP address and fingerprint are not collected for them. If analytics tracking is also refused, no visitor cookie is set. In the European Economic Area, the United Kingdom and Switzerland, only a choice expressed by the visitor counts: the consent that Shopify applies by default when the store does not display a banner does not constitute consent, and nothing is tracked in that case. Visitor cookies (identifier, landing campaign) expire no later than 13 months after the first visit, with no extension beyond that; without marketing consent, no ad click identifier (fbclid, gclid, ttclid…) is kept, whether in these cookies, in the events sent or in the recorded page URL.
• Opt-out of the sale or sharing of data ("Do not sell" button or Global Privacy Control signal, which Shopify applies): in the United States, Meta and TikTok only receive the event under "limited use" (Limited Data Use), and only in the states where they offer it; elsewhere, and for Google, nothing is sent to them. Outside the United States, this opt-out counts as a refusal of marketing: nothing is sent to ad platforms.
• Outside Shopify (manual installation): no API provides the visitor's region or choice, so the European rule applies everywhere. Nothing is tracked and no visitor cookie is set until the merchant's banner has passed on consent: ppp.consent(true) for analytics, ppp.consentPii(true) for marketing (or Consent Mode ad_user_data: granted). This choice is stored in the _ppp_consent cookie for subsequent pages.
• Probabilistic signal: it links a session; on its own, it never identifies a person.
• Storage: only as a derived value. Raw characteristics are never stored.
• Retention: 13 months maximum, then automatic deletion. Browsing sessions, for their part, are deleted after 90 days.
• Erasure: a deletion request erases the fingerprint and all associated identity links, together with the other data. These links include, hashed, the browser identifier Shopify attaches to checkout events (with analytics consent) and the _kx parameter of a Klaviyo email link: with marketing consent, it is sent to the merchant's Klaviyo account to find the profile, then only its hash is kept. With a verified tracking domain, the visitor identifier is also set again by our server (the _ppp_vid cookie, out of reach of scripts), under the same conditions and for the same duration.

3. Purposes of processing

• Providing the dashboard and profitability calculations
• Billing and subscription management through Shopify (store invoice)
• Customer support and product improvement
• Analytics and technical diagnostics (with consent for PostHog)
• Transactional emails (confirmation, alerts, waitlist)

4. Legal bases (GDPR)

• Performance of a contract — providing the SaaS subscribed to
• Legitimate interests — security, service improvement, support
• Consent — analytics cookies (PostHog), waitlist newsletter
• Legal obligation — retention of invoices for accounting purposes

5. Retention period

Account data: for as long as the account is active, then deletion or anonymization according to your plan and settings (configurable retention — see Dashboard → Settings). Billing data: statutory period (10 years). Account deletion handled by our team (erasure request, deletion by the administrator): the email address and the deletion date are kept for 5 years (civil limitation period, Article 2224 of the French Civil Code) to evidence that the deletion was carried out, then erased. A deletion made from your account leaves no trace of it. Technical logs and Sentry: limited period according to our retention settings.

6. Processors

Data is shared only to provide the service:

• Shopify — payments and subscriptions (the subscription is added to the store's Shopify invoice)
• Stripe — retention and closing of earlier subscriptions that are still active. No new subscriptions are opened there.
• Resend — transactional emails
• OVHcloud (OVH SAS, servers in Canada) — application hosting
• Sentry — error monitoring (technical data, no intentional PII)
• PostHog — product analytics (with consent)
• Shopify, Meta, TikTok, Google, Klaviyo — APIs you connect (OAuth). These platforms are also recipients of conversion data when a pixel is configured: see section 6.1.
• Cloudflare R2 — encrypted database backups
• Upstash — rate limiting and caching (no PII)

6.1 Disclosure to ad platforms (Conversion APIs)

When a merchant sets up an ad platform pixel, conversions measured on their store are sent from our server to the platform concerned — Meta, TikTok or Google — so that it can attribute the sale to its advertising. This transfer leaves our infrastructure, so it deserves a precise description.

• Hashed with SHA-256 before sending, so never readable by the ad platform in plain text: email, phone, first name, last name, city, region, postal code, country; for Meta, also date of birth and gender when the Shopify customer record contains them.
• Google (GA4) exception: city, region, postal code and country are sent in plain text, as Google's format requires; email, phone, first name and last name remain hashed.
• Sent in plain text: the IP address and the browser user agent. The specifications of these APIs require them in this form for matching — they cannot be hashed.
• Also sent: ad click identifiers (fbclid, gclid, ttclid, etc.), visitor identifier, amount, currency, products and order number. If the merchant enables it, the purchase sent to Meta also carries ProfitPilotPro's reading of the order: margin tier and percentage, acquisition channel, presence of a Meta click (no additional personal data).
• Condition: on a Shopify store, the email, phone, IP address and click identifiers are only sent if marketing is accepted (Shopify banner, or explicit refusal by the merchant); in the EEA, the United Kingdom and Switzerland, only after consent has been expressed. Outside this banner, they are sent as long as no refusal has been sent: the merchant must therefore refuse by default until consent is given.

6.1a Sending to Klaviyo (if the merchant enables it)

A merchant who has connected Klaviyo can enable sending two events: a visitor identified on the store, and a checkout started (for their abandoned cart emails). Disabled by default.

• Sent: the email address in plain text (Klaviyo requires it to find the profile), the phone number if known, and for a checkout: the items, amount, currency and the link to the store's cart. The Shopify checkout recovery link is never sent.
• Condition: only for a visitor whose marketing consent has been recorded. A refusal, or no choice at all, blocks sending.

6.2 Transfers outside the European Union

The application and its database are hosted on servers located in Canada by OVHcloud (OVH SAS). PostHog (EU hosting) remains within the European Union. Other processors are established in the United States or may process data there: Stripe (earlier subscriptions), Sentry, Cloudflare (R2 backups), Resend and, when you connect them, Meta, Google, TikTok and Klaviyo.

These transfers rely on the European Commission's standard contractual clauses, included in each provider's data processing agreement, or on an adequacy decision where the provider offers one.

7. Your rights

Access, rectification, erasure, restriction, portability, objection — contact contact@profitpilotpro.fr.

You may lodge a complaint with the CNIL (cnil.fr), the French supervisory authority. Meta Login deletion: callback /api/auth/meta/data-deletion. A customer access request forwarded by Shopify is emailed to the store's merchant, together with the file we hold. An erasure request removes the customer record, the shipping address, the IP address and the associated browsing traces.

8. Cookies and trackers

Full details, including the list of cookies our tracker sets on a merchant's store: Cookie Policy.

• Essential: NextAuth session, CSRF security — no consent required
• Analytics: PostHog (EU) — only after acceptance via the banner
• Affiliate: pp_aff_ref cookie (60 days) if you arrive through a partner link — same acceptance, not before
• Marketing: no advertising/retargeting cookies on profitpilotpro.fr

Manage your preferences: cookie banner, Dashboard → Settings → Security, or your browser settings.

9. Complaints

Complaints: contact@profitpilotpro.fr. KALMIE SASU is in the process of registering with an approved consumer mediator. Full contact details will be published here once registration is confirmed. In the meantime, please contact us at contact@profitpilotpro.fr with any complaint.

10. Contact

contact@profitpilotpro.fr