Privacy Policy

1. Who we are and how to contact us

SmartProfit is operated by SMART COD FORM S.R.L., a Romanian company, tax identification number (CUI) 55681023, Trade Register number J2026057225005, EUID ROONRC.J2026057225005, registered at Str. Principala 203 C, Hintesti, Arges, Romania. This policy covers getsmartprofit.com, app.getsmartprofit.com and the SmartProfit service.

For privacy questions or requests, email support@getsmartprofit.com with the subject “SmartProfit privacy”. This is the contact address for SMART COD FORM S.R.L. in relation to SmartProfit.

2. Our role and your role

We act as a data controller for information used to manage our own website, business accounts, subscriptions, support, security and legal obligations. Where a merchant connects a store and instructs us to process its customer or order information to deliver the service, the merchant normally acts as controller and we act as processor. If the merchant is itself a processor, we act as its subprocessor.

Our Data Processing Addendum governs that processing. A shopper with a request about a purchase should normally contact the merchant first; we assist the merchant and do not use its customer information for our own unrelated marketing.

3. Information we process and where it comes from

• Business account and company information: name, email, sign-in credentials in protected form, account and workspace identifiers, team permissions, company details, country of registration, tax settings and preferences that you provide or authorize.
• Store analytics: Shopify shop and order identifiers, order references and dates, products, variants, SKUs, inventory, quantities, shipping country and methods, payment gateways, order/payment/fulfillment status, prices, discounts, taxes, refunds and financial totals. Product costs, expenses, shipping costs and other financial inputs may be provided by you or a connected service.
• Optional invoicing: an invoicing feature you enable may require customer names, email, telephone, billing or shipping addresses and invoice/payment details. These fields are not needed by our standard store analytics query; access depends on the integration and permissions actually enabled.
• Advertising integrations: authorized business and advertising-account identifiers, account settings, campaign/ad-group or ad-set/ad identifiers and names, status, budgets and reporting metrics such as spend, impressions, clicks, purchases, conversion value, CTR, CPC, CPM, CPA and ROAS. Authorization credentials and granted permissions are processed to maintain the connection.
• Billing and support: subscription choice, trial and billing status, transaction or invoice references, refund requests and information you send us. Shopify or another disclosed billing provider processes payment details on its own payment interface; we do not ask you to email card details.
• Technical information: IP address, request timestamps, device/browser and network information, authentication/security events, error information and browser storage needed for sign-in or your chosen preferences.

Information comes from you, authorized team members, connected platforms, your browser and our hosting infrastructure. We do not request sensitive personal information such as health records or full payment-card details through SmartProfit.

4. Purposes and legal grounds

For information for which we are controller, we rely on the following grounds where applicable:

• Contract performance or steps you request before a contract: provide access and the trial, operate your subscription, respond to support and refund requests, and deliver the services you request as an individual business customer.
• Legitimate interests: administer relationships with business representatives, secure the service, diagnose errors, prevent misuse, maintain business records and establish or defend legal claims. We consider the impact on individuals and their reasonable expectations. You may object to processing on this basis.
• Legal obligations: comply with applicable accounting, tax, data protection and lawful regulatory requirements.
• Consent: optional marketing communications or non-essential tracking where used and where consent is required. Consent can be withdrawn without affecting earlier lawful processing.

Imported merchant customer information is processed on the merchant’s documented instructions; the merchant is responsible for identifying its lawful basis and informing its customers. Required account or authorization information is necessary to provide the relevant feature; if it is not provided, that feature may be unavailable.

5. Shopify, TikTok, Meta and other connections

Connecting a platform is optional unless it is necessary for the feature you request. We use access only within the permissions granted by the authorized account holder. Shopify data supports store and profit reporting; TikTok Ads and Meta Ads data supports advertising reports, attribution comparisons and performance recommendations. Provider availability and permissions determine which features can operate.

Advertising reporting does not require access to your private social messages or publishing personal social content. The reporting integrations do not automatically create advertisements or change budgets. We do not sell platform data, use it to build unrelated advertising audiences, or use merchant customer information to train general-purpose AI models.

You may revoke authorization through the platform’s connected-app or business-integration settings, or ask us to disconnect it. Revocation stops future authorized access; it does not by itself delete information already imported. See Data Deletion. Each platform also processes information under its own terms and privacy policy.

If you explicitly connect an external assistant or other authorized reporting client, it can receive the reports or information you request within your granted account permissions. That external service handles the information under its own terms and privacy practices; you control whether to connect it and what to request.

6. Who receives information

Access is limited to people and providers who need information for the relevant purpose: your authorized workspace members; personnel supporting the service; hosting and database providers; the platforms you connect; the billing provider handling your subscription; and professional advisers or authorities where necessary for a legal obligation or claim. We may disclose necessary information in a business reorganization or transfer, subject to applicable confidentiality and data protection requirements.

Railway Corporation provides hosting and managed infrastructure. When country-based website presentation is enabled, a public visitor IP address may be sent to ipapi.co (Kloudend, Inc.) to obtain an approximate country. This does not determine your company’s tax residence; you choose the company’s registration country. Legal pages do not initiate this country lookup. See our subprocessor information, Railway privacy policy and ipapi privacy policy.

The embedded Shopify interface also requests App Bridge and Polaris resources from Shopify’s content delivery network. Enabled invoicing connections may transmit required invoice customer details to the invoicing provider you select, such as SmartBill.

7. International processing

SmartProfit is operated from Romania. Our hosting infrastructure includes the United States; connected platforms and service providers may process information in other countries. We do not represent that all data stays in the European Economic Area.

Transfers subject to GDPR must use an applicable adequacy decision or appropriate safeguards, such as the European Commission’s Standard Contractual Clauses and any necessary supplementary measures. Railway’s published Data Processing Addendum addresses its international processing and transfer mechanisms. You can contact us for information about the safeguards relevant to your processing and a copy, subject to lawful redaction of confidential information.

8. How long we keep information

We retain account and imported reporting information while needed to provide the requested service and reporting history. Disconnecting a source and cancelling a subscription are different from requesting deletion. When service-related data is no longer needed, or after a valid deletion instruction, we delete or anonymize it without undue delay, subject to lawful retention requirements.

Billing and accounting records are retained for the period required by applicable law. Support, security and dispute records are kept only as long as necessary for the issue, relevant limitation periods and legal obligations. Retention is assessed against the record’s purpose, sensitivity and legal requirements; an account cancellation is not a reason to retain all imported customer information indefinitely.

If a restricted backup still contains deleted information, it must not be used for ordinary business processing, and deletion is applied again if the backup is restored. Backup removal follows the relevant infrastructure retention cycle. We can explain the retention criteria applicable to a specific request.

9. Security and confidentiality

We apply safeguards appropriate to the processing risks, including authenticated access, workspace/store authorization checks and restricted handling of integration credentials. Public Shopify and Meta authorization credentials use a server-side encrypted vault. Access to customer data must be limited to authorized persons under confidentiality duties. No online system is completely secure; we do not claim a certification or an absolute security guarantee.

Keep your sign-in credentials and platform accounts secure, grant only appropriate team access, and contact us promptly if you suspect unauthorized use.

10. Your rights and complaints

Subject to the conditions in applicable law, you may request access, correction, deletion, restriction or portability of your personal information, object to processing based on legitimate interests, and withdraw consent. You may object at any time to direct marketing. You will not be penalized for exercising a privacy right.

Email support@getsmartprofit.com. We may request proportionate verification to protect your information. We respond without undue delay and normally within one month of receiving a request. Where legally permitted, complexity or the number of requests may require up to two additional months; we explain the extension within the initial month. Rights requests are normally free, subject only to exceptions permitted by law.

You can complain to the Romanian supervisory authority, ANSPDCP, or another competent supervisory authority, including in the country where you live or work. You do not have to contact us before making a complaint.

11. Recommendations, children and updates

Profit and advertising recommendations support business decisions. SmartProfit does not use your personal information to make solely automated decisions with legal or similarly significant effects on you. The service is for adult business users and is not directed to children. Merchant order data can nevertheless relate to the merchant’s customers, whose rights remain protected.

Our Cookie Policy explains browser storage. We update this policy when practices or requirements change, publish the revised date and provide additional notice where required. A new policy does not remove existing privacy rights or retroactively authorize an incompatible use of data.