Privacy Policy

1. Who we are

Profflow is a SaaS product for Shopify store owners, built and operated from Tallinn, Estonia. Wherever your store trades, your data is processed inside the EU under the GDPR — the terms set out below apply to every customer, not only European ones.

The data controller responsible for your personal data is:

Company

Profflow Analytics OÜ

Registry code

17552133

VAT

EE103006985

Registered address

Paekaare tn 10, Tallinn, Estonia

Contact

hello@profflow.co

2. What data we collect

Account data

• Email address (required to create an account)
• Name (optional)
• Billing information (processed by Stripe — we never store card details)

Shopify data

• Order totals, revenue, and return amounts
• Shopify transaction and processing fees
• Store currency and basic store settings

We use read-only Shopify API access. We never access customer personal data, product details, or store settings.

Connected payment and advertising accounts

• Payouts, fees, refunds and chargebacks from a payment account you connect
• Spend, and the campaign or channel it belongs to, from an advertising account you connect

Read-only in every case, and only where you connected the account yourself. Nothing is connected by default.

Usage data

• Pages visited and features used
• Browser type and device type
• IP address (anonymised after 30 days)

3. How we use your data

• To provide and improve the Profflow service
• To calculate your profit dashboard and cash flow forecast
• To send you transactional emails (invoices, alerts)
• To respond to support requests
• To comply with legal obligations

We do not sell your data to third parties. We do not use your data for advertising.

Questions you ask the AI operator

The question you type and the figures needed to answer it are sent to Google’s Gemini model, which returns the answer. It is your own aggregate commerce data, never customer records, and it is not used to train the model.

4. Data storage and security

All data is stored on servers located in the EU. We use Supabase with EU data residency. Data is encrypted at rest and in transit using industry-standard encryption.

We retain your data for as long as your account is active. If you delete your account, all data is permanently deleted within 30 days.

5. Your rights under GDPR

Your data is processed in the EU under the GDPR wherever you are, so these rights are yours whether or not you live in Europe. You have the right to:

• Access — request a copy of all data we hold about you
• Rectification — correct any inaccurate data
• Erasure — request deletion of your data
• Portability — receive your data in a machine-readable format
• Objection — object to processing of your data

To exercise any of these rights, email support@profflow.co. We will respond within 30 days.

6. Cookies

We use essential cookies to keep you logged in and remember your preferences. We do not use advertising or tracking cookies. See our Cookie Policy for details.

7. Who else processes your data

Everyone below, and nobody else. Each is a processor acting on our instructions under a data processing agreement; none of them receives your data for their own purposes.

• Supabase — database and authentication, on EU infrastructure
• Vercel — hosting, and cookieless aggregate analytics
• Stripe — card payments, and the invoices for them. Card numbers never reach us
• Shopify — your store data, read-only. Where you installed Profflow from the Shopify App Store, Shopify also handles the billing
• Google (Gemini) — the AI operator. When you ask it a question, the figures needed to answer it are sent to Google’s model. They are your own aggregate figures, not customer records, and Google does not use them to train its models under the terms that apply to us
• Telegram — alerts, only if you connect it yourself, and only the alert text you asked for

Where you connect a payment or advertising account — PayPal, Klarna, Meta Ads, Google Ads — Profflow reads it with the credentials you supplied, read-only, to produce your own figures. Those platforms are your data controllers for the accounts you hold with them, and you can revoke Profflow’s access at the platform at any time.

We do not sell your data, and we do not use it for advertising.

8. Changes to this policy

We may update this policy from time to time. We will notify you by email if we make significant changes. The date at the top of this page shows when it was last updated.

9. Contact

For any privacy-related questions: support@profflow.co