Terms of Service

Provide accurate, current, and complete information during registration and integration setup.

Maintain the security of your account credentials and connected API access tokens.

Use the service exclusively for lawful business operations, analytics, and financial tracking.

Permissions — By connecting integrations, you grant ProfitIQ the necessary read-only API permissions to access, retrieve, and store your synchronization data.

Liability — We are not responsible for service outages, API rate limits, data changes, or policy modifications enforced by connected third-party providers.

All subscription fees are billed in advance on a monthly basis and are non-refundable unless explicitly stated.

You are responsible for fees associated with external store connections or API usage that exceeds your plan thresholds.

Roles — You are the data controller; ProfitIQ is your data processor. We process customer personal data only to provide the analytics you request, on your documented instructions, and never for our own purposes.

Data minimization — For your customers we process only the customer name and city. We do not process customer email addresses, phone numbers, or street/postal addresses. From Shopify we request only the read_orders and read_products scopes (plus read_all_orders to extend order history beyond 60 days, which adds no new data type).

Security — We apply appropriate technical and organizational measures, including AES-256-GCM encryption of credentials at rest, TLS in transit, per-tenant isolation, restricted and logged staff access, and separation of test and production data.

Sub-processors — We use Vercel (hosting) and Supabase (managed database) as sub-processors, each bound by their own security and confidentiality obligations. We will inform merchants of material changes to our sub-processors.

Data-subject requests & deletion — We support Shopify's mandatory compliance webhooks (customers/data_request, customers/redact, shop/redact) and honor deletion requests, applying customer redaction and deleting store credentials as described in our Privacy Policy.

Breach notification — In the event of a personal-data breach affecting your data, we will notify you without undue delay in line with our security incident response policy.

Duration & return — On termination or uninstall, we delete stored credentials and, on request, the associated personal data, subject to any legal retention obligations.