Privacy notice

Operator and purpose

POD Optimizer processes account and merchant-authorized platform data to provide catalog reporting, cost estimates, recommendations, collection health and an audit trail. The controller/processor roles and lawful bases must be documented in the final notice and merchant agreement.

Data processed

• Account email, optional identity-provider profile, workspace memberships, roles and authentication sessions.
• Shopify shop identity, product and variant IDs, merchandising text, images, options, prices, cost per item, order and line identifiers, timestamps, financial status, quantities, revenue, refunds and payment fees when available. Customer names, addresses and email are not selected by the order reporting adapter.
• Meta account identifiers, currencies, reporting timezones, catalog item identities, product-set filters and permitted advertising performance data.
• Encrypted provider credentials, merchant-entered economics and strategies, audit events, job status and request protection counters. Counter keys hash client/rule information.
• Optional journey snapshots retain order IDs, readiness, visit time, normalized landing handles and coarse referral classification. Raw landing URLs, query strings and customer identifiers are discarded.

Providers and disclosure

The current hosted private beta uses Vercel for the website and import processing, Neon for its PostgreSQL database in Frankfurt, Google for sign-in, and a Cloudflare Worker to trigger scheduled processing. The scheduler receives execution status, not merchant report payloads or Shopify/Meta tokens. Hosting and scheduling providers may process request metadata and execution logs. Shopify and Meta receive the API requests authorized by each merchant. Stripe is prepared in test mode; the current free beta does not collect subscription payments. No email sign-in delivery provider is active. The complete subprocessor register, provider contracts, hosting and log locations, and any international transfer safeguards still require review before public launch. Selecting Frankfurt for the database does not establish that every provider processes all data only in the European Union. The current textual design suggestions make no external AI request.

Retention and deletion

Imported reports remain until the owner deletes imported data or the workspace is removed under the operator’s policy. Disconnecting a provider deletes its local credential and attempts supported remote revocation; it does not by itself erase historical reporting. Optional journey snapshots are cleared when imported data is deleted. Audit events are retained separately for accountability. Exact production retention periods, log rotation and backup expiry are pending owner policy.

Cookies and security

Authentication uses a necessary session cookie; authorization flows use temporary state cookies. Tokens are encrypted at rest by the application. Access is scoped to workspace membership. Reporting does not automatically change advertising decisions. Production security, incident response and recovery procedures require release validation.

Your requests

You can contact the operator using the details above about access, correction, deletion, restriction, objection and portability, where applicable. You may also contact the competent supervisory authority; in Italy, the Garante per la protezione dei dati personali provides information about complaints. Settings provides an imported-reporting JSON export for workspace owners and administrators, excluding credentials and raw payloads. Imported data deletion is available to workspace owners after active imports stop. Complete identity-account export and account deletion procedures still require the operator’s retention policy.

Transparency requirements informing this draft: European Commission data protection obligations and the Garante’s information about data processing and privacy notices. The operator must complete and review this draft before launch.