Privacy Policy — Profit Flow

Who we are (data controller)

Profit Flow Ltd. („Профит Флоу“ ЕООД), Company No. (ЕИК) 206313406, VAT BG206313406, registered at 1517 Sofia, g.k. Suhata reka, Building 100, Entrance D, Floor 2, Apt 6, Bulgaria, is the controller of your personal data. Contact: sales@profitflow.bg, +359 88 764 6664.

What we collect

Contact & quote forms: your name, email, store URL, budget band and message.
Lead / email-capture forms: your email address (and the page/offer it came from).
Technical data: standard server/CDN logs (IP, browser, pages) from our host.
Cookies / similar: see our Cookie Policy.

Why we use it & legal basis

To respond to your enquiry and provide a quote — steps prior to a contract / legitimate interest.
To deliver services you engage us for — performance of a contract.
To send you information you requested — consent (withdrawable anytime).
To secure and operate the site — legitimate interest.

Processors & third parties

We share data only with service providers that help us run the site and respond to you — for example our website host, our form/email provider, and (only with your consent) analytics. Each processes data on our behalf under appropriate agreements. We do not sell your data. Where a provider is outside the EU/EEA, transfers rely on appropriate safeguards (e.g. EU Standard Contractual Clauses).

Retention

We keep enquiry and lead data only as long as needed to respond and for our legitimate business records, then delete or anonymize it. You can ask us to erase it sooner.

Your rights

Under the GDPR you can request access, rectification, erasure, restriction, portability, and object to processing, and withdraw consent at any time. Email sales@profitflow.bg to exercise these rights.

You may also lodge a complaint with the Commission for Personal Data Protection (CPDP / КЗЛД) in Bulgaria — https://www.cpdp.bg.

Profit Flow Shopify apps (merchant & customer data)

When a merchant installs one of our Shopify apps (for example ProfitFlow: AOV Bundle), we process a limited set of store data on the merchant's behalf to provide the app's features. For that data the merchant is the controller and Profit Flow Ltd. acts as a processor.

What the app accesses and stores

Store & catalog: the store domain, currency, and the products and variants the merchant selects for an offer — to configure and display offers.
Orders: through Shopify's order webhook we read an order's id, name, subtotal, currency and the variant ids it contains, to attribute which orders an offer influenced and to show the merchant estimated added revenue. We do not store customer names, emails, phone numbers or addresses.
Storefront events: aggregate, non-identifying counts (offer impressions, add-to-cart, gift adds). Any cart token used to de-duplicate events is hashed.
Merchant contact: the store's contact email, used to send the merchant periodic performance-summary emails, which they can unsubscribe from at any time.

Why we process it

To provide the app's core functionality (building checkout-safe offers and attributing influenced orders) and to give the merchant analytics about the app's performance. We do not use this data for advertising and we do not sell it.

Sub-processors

App data is hosted on our server infrastructure (DigitalOcean) and merchant performance emails are sent via Resend. Each processes data on our behalf under appropriate agreements. Where a provider is outside the EU/EEA, transfers rely on appropriate safeguards (e.g. EU Standard Contractual Clauses).

Retention & deletion

We keep only the minimal records above while the app is installed. When a merchant uninstalls the app we mark the store inactive and remove access-token references, and we honor Shopify's data-deletion requests (customers/redact, shop/redact) and customers/data_request. Merchants or their customers can also email sales@profitflow.bg to request access or erasure.

Changes

We may update this policy; the "last updated" date above reflects the latest version.