Privacy Policy
Last updated: October 15, 2026
This policy explains what personal data ProfitDay collects, why, and what you can do about it. ProfitDay is a web app that shows Shopify merchants their daily profit.
1. Who we are
ProfitDay is operated by APPCARTEL S.R.L., a company registered in Romania (Trade Register no. J2025073028003, tax ID (CUI) 52570322), with its registered office at Strada Principală 72P, Corușu 407056, Baciu commune, Cluj County, Romania ("ProfitDay", "we", "us").
Contact for any privacy question: contact@profitday.app.
2. Two roles: controller and processor
- Your account. For the data about you as a ProfitDay user (for example your email address and sign-in details), we are the controller. This policy describes that processing.
- Your store data. For the data we read from your Shopify store and your ad accounts to calculate your profit, you (the merchant) are the controller and we are your processor. That processing is governed by our Data Processing Agreement.
3. What we collect
Account data
- Email address, and your name and profile picture if you sign in with Google.
- A password, which our authentication provider stores only as a secure hash. We never see it.
- Your settings: language, display currency, dashboard layout.
- How you found us (campaign parameters in the sign-up link), if present.
Store data (from Shopify, as your processor)
- Store details: store domain, Shopify store ID, currency, time zone, plan and billing status.
- Order financials: order number and ID, dates, amounts, discounts, shipping charged, taxes, duties, refunds, cancellations, payment gateway and fees, line items and quantities, and the destination country of each order.
- Catalog data: products, variants, SKUs, prices, weights and costs.
We do not collect your customers' names, email addresses, phone numbers or street addresses. We request only the order fields needed to calculate profit.
Ad data (only if you connect an ad account)
- Ad account names, IDs, currency and time zone.
- Daily spend, impressions, clicks and the conversion value reported by the platform, per campaign.
- An access token for each connection, stored encrypted.
Costs you enter
- Product costs, packaging, shipping, fees, custom costs, tax and cash-on-delivery settings.
Technical data
- Server logs and error reports (IP address, browser type, time, the page or request that failed), kept for security and to fix problems.
4. Why we use it and our legal basis
| Purpose | Legal basis (GDPR) |
|---|---|
| Create and run your account, sign you in, provide the service | Performance of a contract, Art. 6(1)(b) |
| Calculate and show your profit from store, ad and cost data | Performance of a contract, Art. 6(1)(b), and your instructions as controller |
| Send service emails (sign-in links, import status, alerts, billing notices) | Performance of a contract, Art. 6(1)(b) |
| Keep the service secure, prevent abuse, fix errors | Legitimate interests, Art. 6(1)(f) |
| Understand which sign-up channels work (campaign parameters) | Legitimate interests, Art. 6(1)(f) |
| Keep billing and accounting records | Legal obligation, Art. 6(1)(c) |
We do not sell personal data, we do not use it for advertising, and we do not use your store data to train machine-learning models.
5. Data from Google, Meta and TikTok
- Google. If you sign in with Google, we receive your name, email address and profile picture. If you connect Google Ads, we read campaign performance and spend. ProfitDay's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
- Meta. If you connect Meta Ads, we read your ad accounts' spend and performance. We use it only to show your advertising costs and profit to you.
- TikTok. If you connect TikTok Ads, we read your ad accounts' spend and performance, for the same purpose.
We only read data. ProfitDay never creates, changes or pauses ads.
6. Who we share it with
We use the following service providers (sub-processors). Each processes data only on our instructions and under a data processing agreement.
| Provider | Purpose | Data location |
|---|---|---|
| Supabase | Database, authentication, file storage, background jobs | European Union (Frankfurt, Germany) |
| Vercel | Hosting of the web app | EU region for app functions; global edge network for delivery |
| Render | Background processing (imports, recalculation) | European Union (Frankfurt, Germany) |
| Sentry | Error monitoring | European Union |
| Resend | Sending service emails | European Union |
| mail.ro (eureg.ro) | Our support mailbox | European Union |
| Sign-in with Google; Google Ads connection | As described by Google | |
| Shopify | Source of store data; billing | As described by Shopify |
| Meta, TikTok | Ad account connections you choose to make | As described by each platform |
We may also disclose data when the law requires it, or to protect our rights, users or the public.
7. International transfers
We keep our database in the European Union. Where a provider processes data outside the European Economic Area, we rely on an adequacy decision (for example the EU-U.S. Data Privacy Framework, where the provider is certified) or on the European Commission's Standard Contractual Clauses.
8. How long we keep it
- Account data: while your account is open. When you delete your account, we delete your account, your stores' data and all access tokens within 30 days.
- Store data after uninstall: when a store uninstalls ProfitDay, Shopify asks us to delete that store's data. We delete it within 30 days of that request.
- Logs and error reports: up to 90 days.
- Backups: deleted data disappears from our backups when they are overwritten, within 30 days.
- Billing records: as long as Romanian accounting law requires.
9. Security
Data is encrypted in transit (TLS) and at rest. Access tokens for Shopify and ad platforms are additionally encrypted with AES-256-GCM, with the key held outside the database. Each account can only read its own data, enforced in the database. Access to production systems is limited to the operator and protected with two-factor authentication.
10. Your rights
You can ask us to access, correct, delete, restrict or export your personal data, and you can object to processing based on legitimate interests. Email contact@profitday.app. We answer within one month.
You can also delete your account yourself in Settings, and export your data before you do.
If you think we have not handled your data correctly, you can complain to the Romanian data protection authority, ANSPDCP (www.dataprotection.ro), or the authority in your country.
11. Cookies
We use only cookies that are needed to sign you in and remember your preferences. See our Cookie Policy.
12. Children
ProfitDay is a business tool and is not meant for anyone under 16.
13. Changes
If we change this policy in a way that matters, we will tell you by email or in the app before the change takes effect. The date at the top shows the latest version.