Profit Analyst Privacy Policy

• Orders (read only; the app never changes an order): order number and id, dates, status, currency, money amounts (subtotal, total, shipping charged, discounts, refunds, payment fees), line items (product, variant, quantity, price), discount codes and automatic discounts, payment gateway names, sales channel and order tags. For fulfillments: the carrier's name, the fulfillment service, and whether a Shopify Shipping label exists and was printed. Up to 24 months of order history.
• Products, variants and inventory: titles, options, SKUs, weights, product types, prices, and unit costs where Shopify has them.
• Discounts: your discount codes and their settings.

Only these three things per order:

• the shipping state or province;
• the first three characters of the ZIP or postal code;
• a keyed one-way hash of the Shopify customer id, made with a key unique to your store. It lets the app tell that two orders came from the same customer (for example, to count repeat orders). It cannot be turned back into the id without your store's key, and it is never used to identify anyone.

We do not store your customers' names, email addresses, phone numbers, street addresses, full ZIP codes or parcel tracking numbers. The one step that writes orders to storage keeps only the fields listed above, and automated tests fail if a field is added. When the analyst reads your store directly to answer a question, those reads are read only, and personal fields in the answer are removed before the analyst sees them.

Product, packing and shipping costs, overhead figures, files you upload (for example a profit and loss export or a cost sheet), the questions you ask, notes, and your approvals or rejections of proposed changes.

When a staff member signs in to the app on a phone, we keep their Shopify user id and name, a label for the device, and, if they turn notifications on, the phone's push subscription. When a staff member approves a change, their Shopify user id is recorded as the approver. We do not store staff email addresses.

On the phone app, hold to talk sends your recording to a speech-to-text service and shows you the text. We do not keep the audio. While you speak, each piece of audio waits a few seconds in our cache and expires within 2 minutes. Nothing is sent to the analyst until you press Send.

What each analysis cost, for your bill and your monthly spending limit.

We keep your data to provide the app. Order history covers up to 24 months.

The app's access tokens for your store are deleted at once, and any signed-in phones are signed out. Shopify sends us a deletion request (shop/redact) 48 hours after you uninstall, and we delete all of your store's files and database records 48 hours after that, about 4 days after you uninstall, unless you install the app again first. We keep only the record of what the app billed (amounts and dates, no customer data).

When Shopify sends us a customer's deletion request (customers/redact), we remove that customer's hash from every stored order and from every file made from them. The state and ZIP prefix stay on those orders as anonymous figures. We keep the removed hash (never the customer id) so that a later sync cannot link those orders to the customer again.

When Shopify sends us a customer's data request (customers/data_request), we look up the orders we hold for that customer and the three fields listed in section 2.2. Email us and we will send you that list so you can answer your customer.

A phone sign-in lasts at most 180 days and ends after 60 days without use. The record of an ended sign-in is removed once it has been ended for 30 days, the next time the store's list of phones is updated, and in any case with the rest of your data when you uninstall.

Our file storage keeps the previous version of a changed or deleted file for 7 days, to protect against accidental loss, and then removes it automatically. So a deleted file is fully gone about a week after it is deleted. The session database keeps encrypted backups for 30 days. Data deleted from our live systems can remain in encrypted backups until those backups expire.