Privacy Policy

Profytly is a Shopify application operated by Express RV International LLC, a limited liability company organised under the laws of the State of New Mexico, United States (New Mexico Business ID 7272839), with its registered address at 2201 Menaul Blvd NE, Ste A, Albuquerque, NM 87107, United States. We are the data controller for the account data of merchants who install the app, and a data processor for the store data we process on a merchant's behalf.

Privacy contact: profytly@gmail.com. General support: profytly@gmail.com.

We are established outside the European Union and offer this service to merchants inside it. The appointment of a representative in the Union under Article 27 GDPR is in progress and this page will name them as soon as it is complete. In the meantime, and afterwards, you can reach us directly on any data protection matter at profytly@gmail.com — we answer every request ourselves and do not route them through an intermediary.

The app requests the minimum read-only scopes that make the profit calculation possible. Nothing is written back to your store.

We do not request, read or store customer personal data. Customer names, email addresses, phone numbers, shipping and billing addresses, IP addresses and payment instrument details are not accessed by the app. Only the destination country of an order is used, and only in aggregate for country-level margin analysis.

We collect the following from you, as controller:

• Your .myshopify.com shop domain and store name, used to identify your account.
• The email address you contact us from, used only to answer you and to send the reports you enable.
• Data you enter yourself: cost overrides, recurring and one-off expenses, plan settings.
• Subscription and billing events received from Shopify — plan, amount, dates. We never see or store your card details; payment is handled entirely by Shopify.
• Basic security logs: timestamp and IP address of authentication attempts, kept to prevent abuse.

If you choose to connect Meta, Google Ads, TikTok or Snapchat, we use OAuth and request read-only advertising-insight permissions (for Meta, ads_read) solely to import your ad spend and campaign-level metrics into your own dashboard.

• What we read: ad account ID and name, currency, daily spend, impressions, clicks and platform-reported conversions, at campaign level.
• What we never read: your personal profile, friends, posts, messages, photos, audience lists or any end-user personal data.
• What we never do: post, comment, create or modify campaigns, or take any write action on your behalf. The connection is read-only in both intent and scope.
• Use limitation: platform data is used only to display your own analytics back to you. It is never sold, never shared with other merchants, never combined into benchmarks that could identify you, never used for advertising targeting, and never used to train machine-learning models.

Access and refresh tokens are encrypted at rest with AES-256. You can disconnect any platform at any time from the Ad platforms page inside the app; disconnecting deletes the stored tokens immediately. Meta users may also request deletion through the callback described on our data deletion page.

Our use of information received from Meta APIs adheres to the Meta Platform Terms and Developer Policies; our use of Google Ads API data adheres to the Google API Services User Data Policy, including its Limited Use requirements.

• Performance of a contract — processing store data to deliver the analytics you installed the app to receive, and to bill you for it.
• Legitimate interests — keeping the service secure, preventing abuse, and maintaining backups; balanced against your rights and limited to what is necessary.
• Consent — connecting an advertising platform, and receiving optional email reports. Withdrawable at any time, without affecting the rest of the service.
• Legal obligation — retaining invoicing records where tax law requires it.

Data is stored in the European Union (Fly.io, Frankfurt region). Backups are encrypted and stored with an object-storage provider, rotated on a 14-day retention window. Access tokens are encrypted at rest; the database is not publicly reachable.

International transfers. Data is hosted in the EU, but we are a company established in the United States, so our personnel access it from outside the EEA. That access is a restricted transfer under the GDPR and is covered by the European Commission's Standard Contractual Clauses (Decision 2021/914), with the supplementary measures set out in our Data Processing Addendum. For UK data the UK International Data Transfer Addendum applies. Transfers are limited to what operating and supporting the service requires; we do not relocate merchant data to the United States.

Access is limited to the personnel who operate the service, only when needed to fix a fault or answer a support request, and every back-office action is written to an append-only audit log. The full list of providers that process data on our behalf is on the sub-processors page, which is the list referred to by our Data Processing Addendum.

When you uninstall, Shopify sends the mandatory shop/redact webhook 48 hours later and we permanently delete everything associated with your shop. We also implement customers/data_request and customers/redact; because we hold no customer personal data, our response to those is a documented confirmation that there is nothing to disclose or erase.

To request deletion sooner, or deletion of advertising-platform data specifically, see the data deletion page or write to profytly@gmail.com. We action verified requests within 30 days and usually within 72 hours.

Under the GDPR you have the right to access, rectify, erase, restrict and object to processing, and to data portability. Under the CCPA/CPRA you have the right to know, to delete, to correct, and to opt out of sale or sharing — we do not sell or share personal information as those laws define it, and we do not process the personal information of minors.

Exercise any of these by writing to profytly@gmail.com. We do not charge for requests and will not discriminate against you for making one. If you are in the EEA or the UK and believe we have handled your data improperly, you may complain to the supervisory authority of the country where you live or work, or where the issue arose — being established outside the EU does not remove that right, and we will not object to a complaint being brought there.

All traffic is encrypted with TLS. Tokens and secrets are encrypted at rest. Embedded app requests are authenticated with Shopify session tokens and every webhook is HMAC-verified before processing. The back office is password-protected with rate limiting and exponential lockout, and no page is reachable without a valid session. We will notify affected merchants and, where legally required, the relevant supervisory authority within 72 hours of becoming aware of a personal data breach.

The service is a business tool sold to merchants and is not directed at anyone under 16. We do not knowingly collect data from children.

We do not make automated decisions producing legal or similarly significant effects about you. Your store data is not used to train machine-learning models, ours or anyone else's.

We may update this policy. Material changes are announced inside the app at least 14 days before taking effect, and the date at the top of this page always reflects the current version.

Privacy and data protection: profytly@gmail.com
Everything else: profytly@gmail.com
Postal: Express RV International LLC, 2201 Menaul Blvd NE, Ste A, Albuquerque, NM 87107, United States