Privacy for our Shopify app

Seller Profit Doctor for Shopify is an app a store installs from Shopify to see each order’s profit inside the Shopify admin. It works with the store’s business figures, never with its customers’ details. Everything in our Privacy policy about the website still applies; this page covers what is different for the app.

With read-only access (read_orders, read_products, read_inventory, read_shopify_payments_payouts, read_shopify_payments_accounts, read_customers), only these:

• Each order’s figures: its number, dates, sales channel (Shopify’s source name and the app the order came through, such as Online Store, Point of Sale or Shop), amounts, discounts, shipping charged, taxes, refunds (with the units refunded of each item), payments with the fees Shopify reports for them, and items (product and variant names, quantities, prices and each item’s cost from Shopify).
• The store’s settings: its currency, time zone and Shopify plan.
• If you connect Meta Ads, each order’s campaign tag: the utm_campaign, utm_source and utm_medium Shopify recorded on the visit that led to the order, so the app can tell which Meta campaign brought it. Never the pages visited, where the visit came from, or anything about who the buyer is.
• With Shopify Payments, the payout transactions tied to each order (the exact fee on each payment, and any chargeback with its fee).
• Each order’s customer ID in Shopify, which the app turns at once into a scrambled code and never keeps as it is.

The store chooses whether to allow the last two kinds (read_shopify_payments_payouts, read_shopify_payments_accounts, read_customers): the app asks for them from inside the app, works without them, and stops reading them if the store takes them back.

Who the store’s customers are: the app never asks Shopify for a customer’s name, email, phone number, address, notes or IP address.

The app’s access is read-only: it can’t change orders, products, prices or inventory, and it writes nothing to Shopify.

• The store: its Shopify address (such as yourstore.myshopify.com), the access Shopify granted, the dates the app was installed and uninstalled, and the access token and refresh token Shopify gives the app, which are encrypted before they are stored.
• For each order it brought in: the figures in section 2, each item’s SKU and weight, its product and variant IDs and the address of its small product picture on Shopify’s servers (the dashboard shows it next to the item), each payment’s method name, whether the order is a test and its payment status, and the profit worked out from them, with the order’s sales channel and the units refunded of each item. With Shopify Payments, the payout transactions in section 2, with their amounts and fees.
• A scrambled code for each order’s customer, never their name, email, phone or address, so repeat buyers can be counted.
• An erased customer’s scrambled code, only after Shopify has passed on a request to delete that customer’s data (section 10): the same scrambled code, with the store it is for and the date, and nothing else, so that a later read of the same orders from Shopify doesn’t add the customer back. It stays when the store uninstalls the app (so reinstalling it soon after can’t add the customer back) and is deleted when Shopify sends its request to erase the store’s data, or 13 months after that date, whichever comes first.
• A scrambled code for each order deleted at a customer’s request (section 10), made with a key only we hold, with the store it is for and the date, and nothing else: never the order number, so the list can’t be turned back into orders. It lets the app tell those orders apart when Shopify sends them again, so they aren’t brought back. It is kept and deleted like the erased customer’s code above.
• A customer’s request to see their data, only after Shopify has passed one on (section 10): Shopify’s request number, the same scrambled code, the order numbers Shopify lists, and when it came, is due, was downloaded and was marked as sent; never the customer’s name, email or phone, and no copy of an order. A request is deleted 30 days after you mark it as sent, or 60 days after its due date if it never is, and at once when you uninstall the app.
• The costs, bundles and shipping rules you enter or upload from a file (costs can carry a start date).
• The costs and settings you enter in the app: a cost per item, a shipping cost rule, a list of monthly costs with the names you give them, and the ad spend amounts you enter for each ad channel and month, and the fee settings you enter (a rate for a payment method, a handling fee per order, an agency percent on ad spend, the currency you enter costs in).
• The daily ad spend you upload from an ad platform’s export: for each day and channel, the amount and its currency, never the file, its campaign names or any other column.
• What your supplier charged for each order in a supplier file you upload: the product cost, the supplier’s shipping when the file gives it, how many supplier orders were added up and the currency converted from, never the file, the supplier’s order numbers or any other column.
• If you connect Meta Ads: the access Meta gives the app when you approve it (read-only: the ads_read permission only), kept encrypted and never shown; the Meta user number of the person who approved it, only to act on Meta’s deletion and removal requests; the ad accounts you share (their names, numbers, currencies, time zones and statuses, and which you chose to count); and, for each counted account and day, what Meta charged, and per campaign its name and number, spend, impressions, clicks and the number and value of purchases Meta reports, for up to 13 months like your orders. Never your ads, audiences, pages or anything about the people who saw an ad. To show profit per campaign, the app also keeps, with each order, the campaign tag Shopify recorded on the visit that led to it (its utm_campaign, utm_source and utm_medium, read with the order access the app already has); never the pages visited or where the visit came from. The tag goes with its order, and is cleared from every order when you disconnect. The app reads your ad spend only; it never creates, changes, pauses or pays for anything on Meta. Disconnecting deletes the access and every Meta figure at once; removing the app in your Facebook settings deletes the access at once, and a data deletion request there deletes the figures too, with a confirmation code you can check.
• If you turn on email reports or alerts: the email addresses you enter (up to 3), whether and when each was confirmed and when its last confirmation email was sent, your choices, and a log of which emails went out (when, what kind, to how many addresses; never the email’s contents). An address you add gets one confirmation email and nothing else until someone there confirms it; if you remove it and add it again, it gets a new one at most once in 7 days. Every email, the confirmation too, has a stop link. An address never confirmed is deleted 30 days after its last confirmation email; pressing the stop link in any email, or removing the address in Settings, deletes it at once; and the log is kept 60 days. These are your own or your staff’s addresses, never your customers’, and the emails hold your store’s figures, order numbers and product names, nothing about a buyer.
• For every store together, without any address: when someone presses a stop link, a scrambled code of their address (made with a key only we hold, so it can’t be turned back into the address) goes on a list, so that no store can add the address again and nothing more is sent to it. The list keeps only the code, why it is there and the date, for as long as the app runs; if that person writes to us, we take their code off. So that one person can’t be sent many confirmation emails by many stores (at most 2 a day and 5 a week), the same kind of code is kept with the time of each confirmation email for 8 days. Uninstalling the app doesn’t delete either, since they keep a person’s request, not a store’s data.
• Shopify’s delivery IDs: for each message Shopify sends the app (such as “the app was uninstalled”), its ID, its kind and the store, never its contents, for 7 days, so a message Shopify sends twice is handled once.
• The app’s progress: where the import of orders stands, whether the welcome steps were dismissed, and, for a few minutes at a time, whether the store’s plan is active.

Each order the app brought in, with its scrambled customer code and its payout transactions, is kept 13 months from the order’s date, so a month can be compared with the same month a year before, and then deleted by a daily job, even while the app stays installed.

Uploaded daily ad spend is kept the same 13 months from its day, and you can undo your latest upload at any time. An exact shipping cost or supplier cost you upload for an order goes with that order. The other costs and settings you enter stay until you change them or uninstall the app.

In our database, which Neon hosts in the United States; the app runs on Vercel (both are in section 3 of our Privacy policy and on our Service providers page, with every other company that handles data for us). Tokens and the messages Shopify sends the app are never put in our logs.

Resend, which sends our website’s emails, sends the app’s email reports and alerts. Open and click tracking are a setting on our Resend sending account, which we keep off, so Resend doesn’t record whether an email is opened or its links are clicked; our emails add no tracking pixel and no tracked links of their own.

The app inside your Shopify admin sets no cookies and keeps nothing in your browser. Its dashboard at app.sellerprofitdoctor.com signs you in from your Shopify admin (no password of ours, no store address to type) and keeps you signed in with a cookie holding a random value; we keep only a scrambled copy, with the store it is for, and delete it when it ends (after half a day without use, a week at most, at sign-out or on uninstall). While you’re signed out, a second cookie remembers for up to 30 minutes which dashboard page you asked for. The window that connects Meta Ads uses two short cookies of its own, for at most 15 minutes, to check Meta's answer comes back to it. The cookie policy has the details.

Shopify tells us, and we delete the tokens, every order and payout transaction the app brought in, customers’ requests to see their data, and the costs and settings you entered, at once, with the email addresses, choices and send log for email reports and alerts, and every AI connection with its log (section 13), and a Meta Ads connection with its access and every Meta figure (section 5). We keep only the store’s address, the dates it installed and uninstalled, and the scrambled codes of any deleted customer and their deleted orders (section 10), until Shopify sends its request to erase the store’s data; then we delete those too. Shopify’s delivery IDs go after 7 days, and the codes kept for every store together (section 5) stay, since they hold no store’s data.

When Shopify passes on a customer’s request to delete their data, we delete the orders tied to that customer from the app: every order that carries their scrambled code and every order Shopify lists, with the payout transactions, shipping costs and supplier costs kept for those orders. They are no longer counted in your profit history.

When it passes on a customer’s request to see their data, the app keeps the request (section 5) and shows it in the app’s Settings, under Customer data requests, with the day it is due (30 days after it came); the Summary shows a line while one is open. There you can download what the app holds for that customer and send it to them. That is the orders Shopify listed and any order that carries their scrambled code: each order’s number, dates, totals, items, refunds, payments and sales channel, its payout transactions, and whether their code and orders were deleted at their request. It holds no name, email, phone or address for them. You send the file to the customer yourself, then mark the request as sent.

Shopify may still send those orders and that customer afterwards, so we keep the deleted scrambled code alone, and a scrambled code of each deleted order, with the store and the date (section 5). The app doesn’t bring those orders back and doesn’t write that code on any order again. An order the customer places later is counted, without their code, so they aren’t counted as a repeat buyer.

The app’s charges are billed by Shopify, on the store’s Shopify bill. We never see a card.

We never sell the app’s data, share it for advertising or use it for anything but showing you your store’s profit: in the app, or, when you connect one, through an AI tool you chose (section 13).

AI connections are off until you turn them on in Settings. If you turn them on and approve an AI tool such as Claude or ChatGPT, that tool can read your store’s profit figures, order numbers, product names and costs, and ad spend, for the store you approved only, read-only: it can’t change anything in the app or in your store. It is shared with that tool only because you asked: each tool needs your approval on our own page, signed in to your store. It never receives anything about your buyers: we don’t hold names, emails, phones or addresses, and repeat-buyer figures are counts only.

The AI tool’s company is not our service provider: you choose it, and what it does with your conversation is covered by your account with it. We never use your data to train AI.

What we keep: each connection (which tool, when you approved it and last used it) and its sign-in tokens, only as scrambled copies; an access token works 60 minutes and a connection lasts at most 90 days before the tool asks you again. We log each request (time, which tool, how long it took; never your figures or what was asked) for 30 days, and you see the latest in Settings. Disconnect any tool in Settings at any time, or turn AI connections off to disconnect every one at once; uninstalling the app disconnects every tool and deletes the log.

When the app starts to read or keep something new, or keeps it for a different time, we change this page first, post it with a new date and say at the top of the page what changed. Our Privacy policy’s section 11 applies here too.

To see or delete what the app holds before you uninstall, email support@sellerprofitdoctor.com. To report a security problem, email security@sellerprofitdoctor.com. Gomorra Labs LLC, a Wyoming limited liability company, runs Seller Profit Doctor and its Shopify app.