Privacy Policy

1. Overview

This policy explains what data ProfitUp accesses, why, where it is kept, how long, and your rights. The controller of account data is Summitcore LLC. For store and ad data you connect, you (the merchant) are the controller and ProfitUp acts as your processor.

2. Data we access and why

Source	Data	Purpose
Your ProfitUp account	Name, email, password (stored only as a salted hash), sign-in timestamps	Sign-in, security, service emails (e.g. email verification)
Shopify — orders	Order number, dates, currency, financial status, subtotal, discounts, shipping, taxes, refunds, transaction fees and gateway names, line items (SKU, product/variant title, quantity, price)	Calculate revenue, refunds, fees and profit per order, product and store
Shopify — products	Variant SKU and title, product title, inventory unit cost	Cost of goods (COGS)
Shopify — payouts	Shopify Payments payout dates, status and net amounts	Cash-flow report
Meta (Facebook / Instagram) Ads	Ad accounts, campaigns, ad sets, ads, budgets, status, daily spend and results (impressions, clicks, purchases, conversion value), account billing summary and spending limit, Pages and posts you choose for an ad	Ad spend in profit; Ads Manager features you use
Costs you enter or import	Product costs, shipping, handling, custom costs, CSV files	Profit calculation
Live chat	Messages you send and an anonymous chat cookie	Answer support requests

Customer personal data. ProfitUp does not request or store Shopify customer personal information: we do not fetch customer names, emails, phone numbers or addresses, and we do not use the Shopify customers API. Order records are kept only with financial and product fields needed for profit. If this ever changes, this policy will be updated first and we will only request the minimum required.

3. What we don't do

• We do not sell or rent data, and do not share it for third-party advertising.
• We do not use your store or ad data to build profiles of your customers.
• We do not show your data to other ProfitUp users; each account's data is kept separate.

4. Storage and security

Data is stored on servers operated by our hosting provider (a cloud/VPS infrastructure provider acting as our sub-processor). Connection secrets (API tokens) are kept only on the server, never sent to the browser and shown only masked. Traffic is encrypted with HTTPS. Access is limited to what is needed to run the service. Backups are kept for 14 days.

5. Sub-processors

• Hosting / infrastructure provider — application and database hosting.
• Transactional email provider — sending account emails (e.g. verification).
• Shopify and Meta — the platforms you connect (data is fetched from them under your authorisation).
• Exchange-rate source (European Central Bank via Frankfurter) — public FX rates only, no personal data.

A current list is available on request at support@profitup.io.

6. Retention and deletion

• While connected: synced data is kept so reports can cover past periods.
• Shopify app uninstalled: on Shopify's app/uninstalled notification we remove that shop's connection (tokens) and its synced orders, line items and payouts. On Shopify's shop/redact request (sent 48 hours after uninstall) any remaining shop data is deleted.
• Customer data requests: we respond to Shopify customers/data_request and customers/redact requests. Because we store no customer personal data, there is normally nothing to export or erase; each request is logged with ids only.
• Meta disconnected: the access token is deleted; you can ask us to delete synced ad data.
• Account deleted: your account and its data are deleted from live systems, and from backups within 14 days.
• Chat: you can delete your chat history from the chat window ("forget me").

7. Your rights (GDPR, UK GDPR, CCPA/CPRA)

Depending on where you live you can ask to access, correct, delete or export your data, object to or restrict processing, and withdraw consent. California residents have the right to know, delete and correct, and to not be discriminated against for exercising these rights; we do not sell or share personal information as defined by the CCPA. Where we process data for a merchant, we will pass requests to that merchant. Contact support@profitup.io; we reply within 30 days. You may also complain to your local data-protection authority.

8. Cookies

We use only essential cookies: a sign-in session cookie, a demo-session cookie and an anonymous live-chat cookie. Your light/dark preference is saved in your browser's local storage. We do not use advertising or tracking cookies.

9. International transfers

Data may be processed outside your country. Where required we rely on appropriate safeguards such as Standard Contractual Clauses.

10. Children

ProfitUp is a business tool and is not directed at children under 16.

11. Changes and contact

We will post changes here and update the date above. Contact: Summitcore LLC · support@profitup.io · live chat.