Privacy Policy

ProfitBrief is a Shopify app that calculates what your store actually earned. This policy explains exactly what it reads, what it keeps, and what happens when you remove it. It is written to be checked, not skimmed.

Who we are

ProfitBrief is operated by Benipar Corp s.r.o., Primátorská 296/38, Libeň, 180 00 Praha 8, Czech Republic, company ID (IČO) 14226839. For the data described here, we are the controller.

For any question about this policy or your data, write to hello@getprofitbrief.com.

Pilot access requests

Before you install ProfitBrief, you can ask to join the pilot using the form on this website. It asks for your name, work email, public store website, approximate monthly order range and, optionally, a short description of what makes profit difficult to understand. We use this information only to assess the request, reply to you and manage pilot onboarding. We do not add it to a marketing list.

The form posts directly to ProfitBrief’s server at Hetzner and sends the request to our support mailbox through Amazon SES. It is not added to the ProfitBrief store database. The message remains in the support mailbox only as long as needed to answer and manage the pilot, and you can ask us to delete it at any time.

What ProfitBrief accesses

When you install the app, Shopify asks you to approve three read-only permissions. If you choose to use measured Shopify Payments costs, ProfitBrief then asks for two additional read-only permissions. ProfitBrief cannot change anything in your store — it has no write access of any kind.

• Orders (read_orders) — order totals, discounts, shipping charged, taxes, refunds, transaction fees and the date each order was processed.
• Products (read_products) — product and variant names and identifiers, so costs can be attached to the right item.
• Inventory (read_inventory) — item cost values where you have recorded them in Shopify.
• Shopify Payments account and payouts (read_shopify_payments_accounts and read_shopify_payments_payouts) — the account permission lets ProfitBrief reach the balance ledger; the payout permission lets it read that ledger. This is the only place Shopify reports what you actually paid for a shipping label. We read label costs, chargeback fees, customs duty, import tax and Shopify’s own billing from it, and ignore every other entry. These permissions are optional and requested only when you choose measured Shopify Payments costs.

It also reads your shop profile: store name, myshopify domain, currency and time zone. The time zone matters because your daily brief is calculated on your calendar day, not ours.

Accounts you can connect

All of these are optional. Nothing below happens unless you connect it yourself, and disconnecting stops it immediately.

• Meta and Google Ads — we request read-only access to advertising insights and read one thing: how much each ad account spent on each day. We cannot create, edit, pause or spend anything, and we do not read audiences, creatives or anything about the people who saw your ads.
• Printful and Printify — using an API key you paste in, we read what each order cost you to produce and ship. We do not read the shipping addresses on those orders.

The access tokens and API keys for these connections are encrypted before they are stored, using the same key that protects your Shopify session, and are never written to logs or shown in the app after you enter them.

What ProfitBrief stores

• Per-order financial figures— the amounts listed above, plus the order number and Shopify’s order identifier. No customer identity is attached.
• Costs you enter — product costs, shipping costs, payment gateway rates, advertising spend, operating expenses, depreciation, interest and tax.
• Costs read from your payouts — shipping label charges, chargeback fees, duties and subscription billing, each with the date and amount Shopify reported.
• Figures from accounts you connected — daily ad spend per account, and per-order production costs, together with the encrypted credential for each connection.
• Calculated results — daily profit figures, confidence scores and the notes shown on your dashboard.
• Your email address, if you switch on the daily brief, together with a record of which briefs were sent.
• A Shopify session token, which is what lets the app open inside your admin.

The daily brief email

If you enable it, ProfitBrief emails you one summary per day at an hour you choose in your own time zone. It contains your figures and a link back to the app. You can switch it off in the app’s settings at any time, and doing so stops it immediately. We do not send marketing email to merchants and we do not sell or share your address.

Who else processes your data

ProfitBrief runs on a small number of services. The application, database and daily-email sending region are within the European Union:

• Hetzner (Germany) — the servers and database where the app runs and your figures are stored.
• Amazon Web Services (SES, Paris region) — sends the daily brief email.
• Cloudflare— protects and routes traffic to the app and routes mail sent to our own addresses. As part of that delivery it can process network information such as IP addresses and request headers; ProfitBrief does not use it to store your store’s financial records.
• Vercel — serves this public website only. It has no access to store data.

Where you have connected an advertising or fulfilment account, we send that provider your credential in order to read your own figures back. We send them nothing about your store, your orders or your customers.

We run no advertising or tracking of our own, and we do not sell, rent or share your data with anyone for their own purposes.

Analytics and cookies

This website sets no cookies and runs no analytics or tracking scripts. Inside the app, the only cookies are the ones Shopify requires to keep you signed in.

How long we keep it, and how to delete it

Your data is kept while ProfitBrief is installed, so the app can show you history and compare one day against another.

When you uninstall, we stop processing your store immediately and delete the session that gave us access. Shopify then confirms the removal, and on that confirmation we erase everything we hold about your store — orders, costs, calculated results, email settings, delivery records, costs read from your payouts, and every connected-account credential and the figures read with it. Shopify sends that confirmation shortly after uninstall, typically within 48 hours.

You do not have to wait for it. Ask us at hello@getprofitbrief.com and we will erase your data on request.

Encrypted disaster-recovery backups can retain a copy of deleted store data for at most seven days after deletion. These backups are isolated and are not used for ordinary operations or support. They expire automatically under the same seven-day schedule. If a backup must be restored after an outage, any deletion request that applies to it is re-applied before the restored data returns to ordinary use.

Your rights

Under the GDPR you can ask for a copy of the data we hold about your store, ask us to correct it, ask us to erase it, or object to how we use it. Write to hello@getprofitbrief.com and we will respond within 30 days. You also have the right to complain to your national data protection authority.

ProfitBrief additionally implements the three data requests Shopify requires of every app — customer data request, customer redaction and shop redaction — so a request made through Shopify reaches us automatically. Because we hold no customer personal data, a customer data request returns nothing about that customer from us.

Security

Access is read-only everywhere — the Shopify permissions described above, and every account you connect. Traffic is encrypted in transit. Access tokens and API keys are encrypted at rest, stored server side, and never exposed to your browser or written to logs.

Changes

If this policy changes in a way that affects what we collect or how we use it, we will update the date at the top and tell affected merchants by email before the change takes effect.