Legal
PRIVACY POLICY
Version 1.0, in effect from 2026-10-18
Peci: Revenue Radar — Privacy Policy
This Privacy Policy applies to the Peci: Revenue Radar Shopify application ("App") published on the Shopify App Store. It is operated by PÉCI Kft., Aradi utca 5., 2119 Pécel, Hungary (Cg. 13-09-089813; EU VAT HU12761609) ("Company", "we", "us", "our"). The Company is established in the European Union.
1. Who this policy applies to
This policy covers two distinct categories of people:
Merchants — Shopify store owners and their admin users who install and configure the App. Merchants are the primary account holders and pay for the service.
Customers — people who browse the storefront of a Merchant's store where the App is installed, whether or not they place an order. The App processes limited pseudonymous data about their shopping activity (adding to cart, viewing the cart, starting and completing checkout) on behalf of Merchants.
Throughout this policy we label our role by capacity — as Controller or as Processor — wherever the distinction affects your rights or our obligations.
2. Our role under GDPR
For Merchant data (as Controller): The Company acts as data Controller (GDPR Art.4(7)). We determine the purposes and means of processing Merchant account and billing data.
For Customer data (as Processor): The Company acts as data Processor (GDPR Art.4(8)) on behalf of the Merchant, who is the data Controller. Merchants are responsible for their own legal basis for processing Customer data and for informing Customers that their store uses this App. If you are a Customer with questions about your data, contact the Merchant directly.
Scope of this notice, stated explicitly. This notice governs the App. Within it we hold two distinct roles and they do not overlap: we are Controller for Merchant data (Section 3a), and Processor on the Merchant's documented instruction for the storefront analytics data the App collects about Customers (Section 3b). Two records that concern requests are our own, as Controller, and we keep them solely to be able to show how a request was handled: the GDPR compliance rows of the app event log, which carry no customer identifier, and a request a Customer sends us directly, with our reply (Section 3a, Correspondence; Section 5).
A full Article 28 Data Processing Agreement ("DPA") governing the processor relationship is published at https://peci.io/revenue-radar/dpa, is incorporated by reference into the Terms of Service, and is accepted together with the Terms of Service in the App's acceptance step, before the App is first used (Terms of Service, Section 3A). The DPA prevails over the Terms of Service and this Privacy Policy on any question of data protection (see Terms of Service, Order of Precedence).
EU representative (Art.27). Not applicable. The Company is established in the European Union (Hungary), so the Article 27 requirement to designate an EU representative does not apply.
3. Data we collect and why
3a. Merchant data (as Controller)
| Category | Examples | Source | Purpose | Legal basis (GDPR Art.6) |
|---|---|---|---|---|
| Shop identity | Shopify shop domain (mystore.myshopify.com), the store's name, timezone and currency, whether the store is a development store (Merchant record) | Shopify OAuth; Shopify Admin API, read at installation | Service delivery, billing; addressing the store by its name in our emails; cutting daily figures in the store's own timezone; on a development store only, enabling the developer test tools and counting their test events in the store's figures | Art.6(1)(b) — contract |
| Store contact e-mail | The store's contact e-mail address (Merchant record) | Shopify Admin API, read at installation | Sending the Merchant what it must receive from us: the answer to a Shopify customer data request (Section 8c); the copy of its data it asks for (DPA, Section 9.3); our notices as processor (a legal requirement to process otherwise than instructed, an instruction we consider unlawful, a new or replacement sub-processor, a request a Customer sent us directly, a personal data breach, a transfer or US state law obligation we can no longer meet; DPA, Sections 4.1, 4.2, 6.4, 7.2, 8.1, 11.4, 12.5); and notices under the Terms (Terms, Section 17) | Art.6(1)(b) — contract |
| Authentication tokens | Shopify offline access token and refresh token | Shopify OAuth | API access to merchant store | Art.6(1)(b) — contract |
| Plan and usage | Plan tier, visitor limit, a flag set on uninstall (MerchantUsage); on the free plan, the monthly number of distinct visitors, as a count only (the visitor identifiers it is computed from are Customer data, Section 3b) | App internal; Shopify App Pricing | Applying the plan the Merchant has chosen, including the free plan's monthly visitor threshold | Art.6(1)(b) — contract |
| Weekly summary interest | Whether the store has said it would like a weekly summary by e-mail (DigestInterest: shop domain, yes/no) | Admin UI | Measuring demand for a weekly summary feature | Art.6(1)(f) — our legitimate interest in deciding which features to build |
| In-app display choices | Which upgrade offers the store has closed, and when it closed the weekly-summary question (Merchant record) | Admin UI | Not showing again what the store has closed | Art.6(1)(b) — contract |
| Summary opt-out list | A one-way SHA-256 hash of an e-mail address together with the shop domain; the address itself is never stored (DigestOptOut) | The unsubscribe link in a weekly summary e-mail (the App does not send these e-mails at present) | Honouring an unsubscribe for as long as we hold the shop's data | Art.6(1)(f) — our legitimate interest in honouring an objection to e-mail we send |
| App event log | Action type, timestamp, optional structured detail (AuditLog) | App internal | Debugging, GDPR webhook compliance | Art.6(1)(f) — our legitimate interest in running, debugging and securing the App and in demonstrating that GDPR requests were handled |
| Terms acceptance record | Shop domain, the versions of the Terms of Service, the Privacy Policy and the DPA accepted, time of acceptance, method (the in-app button), time of uninstall (TermsAcceptance) | App internal, when you click "I accept" | Proof of the contract and of the version accepted | Art.6(1)(f) (legitimate interest: establishing, exercising or defending legal claims) |
| Correspondence | The name, e-mail address and content of e-mails you send to revenueradar@peci.io, privacy@peci.io or legal@peci.io, or that a Customer sends us directly, and our replies | You | Answering support, data-protection and legal requests; afterwards, keeping the exchange to show how a request was handled (Section 5) | Art.6(1)(b) (contract) for support; Art.6(1)(c) (legal obligation) for requests under data protection law; Art.6(1)(f) (legitimate interest in establishing, exercising or defending legal claims) for keeping the exchange after the matter is closed |
| Hosting request log (staff) | The IP address and browser user agent of the people who use the App's pages in the Shopify admin, and the full request address, which includes the session token Shopify passes to the App and which identifies the staff user, in the hosting provider's request log | Your browser, through the hosting provider | Operating and securing the App | Art.6(1)(f) (legitimate interest in running and securing the App) |
At installation we read the store's contact e-mail address from Shopify and keep it with the shop record to send the messages listed above; it is deleted with the shop record (Section 5). The App sends no marketing e-mail.
Providing the Merchant data above is a condition of using the App: without it the App cannot be installed or run.
3b. Customer data (as Processor — on behalf of Merchant)
The App's Shopify Web Pixel records four storefront events: product added to cart, cart viewed, checkout started, and checkout completed. The App does not store Customer names, email addresses, postal addresses, phone numbers, payment information, or IP addresses. The App requests only the write_pixels and read_customer_events Shopify access scopes: it has no permission to read customer records or orders through the Shopify Admin API, so we cannot link the pseudonymous identifiers below to a customer account. The hosting provider (Vercel) receives each request's IP address and browser user agent, and its request log keeps them for up to 30 days (Section 5); no IP address is written to the App's database.
| Category | Field(s) | Source | Purpose | Legal basis | Retention |
|---|---|---|---|---|---|
| Storefront event | Event type, the event's own identifier, the time it occurred and the time it was received; Shopify's pseudonymous visitor identifier (clientId); a session key built from that identifier and the calendar day; the checkout token; currency, subtotal and total; the products involved (product and variant ID, product title, price, quantity) (PixelEvent) | The App's Web Pixel | Measuring where in the cart and checkout steps purchases are abandoned | Processed on the Merchant's documented instruction (Art.28); the legal basis is the Merchant's (Section 2) | 30 days, then deleted by the scheduled cleanup; deleted on shop/redact |
| Bot assessment | A one-way hash of the browser's user agent together with the shop domain, a bot score and the reasons for it (PixelEvent) | Computed at intake from the user agent, the screen size and whether cookies are enabled, which the pixel sends with the event; the raw user agent, the screen size and the cookie flag are not stored, though the recorded reasons name which of them indicated automation | Excluding automated traffic from the Merchant's figures | Merchant instruction (Art.28) | As the storefront event |
| Monthly visitor count | The pseudonymous visitor identifier, the month, and the first and last time it was seen that month (VisitorMonth) | The App's Web Pixel | Counting distinct visitors per month against the free plan's monthly visitor threshold, only while the store is on the free plan, as part of the service the Merchant instructs (DPA, Section 3.1); used for no other purpose | Merchant instruction (Art.28) | The current and the previous month; older months are deleted by the scheduled cleanup; deleted on shop/redact |
| Daily figures | Per day and per product: carts started, checkouts reached, orders completed, the value of checkouts that were started and did not become orders, product title (ProductFunnelDaily, ShopFunnelDaily); no visitor identifier | Computed from the storefront events | The Merchant's dashboard | Merchant instruction (Art.28) | Until shop/redact, or 30 days after the uninstall if that webhook does not arrive |
The pixel also sends, with each event, any discount amount at checkout and the number of items in the cart; the App does not use them and does not store them. It does not send the page referrer.
Shopify's visitor identifier and the checkout token are pseudonymous: they do not by themselves reveal identity, but they constitute pseudonymous personal data under GDPR Art.4(1), because Shopify, or the Merchant, can link them to an individual. We process them solely to group a Customer's events into a shopping session, to assess automated traffic per visitor, to count each checkout once, and to count distinct visitors.
Consent. The App's Web Pixel declares the analytics purpose only to Shopify's customer privacy settings; the marketing and preferences purposes are not declared, and data sale is declared as not applicable. Shopify runs the pixel according to the store's customer privacy settings: where the store asks visitors for consent, according to the choice they make for the analytics purpose; where it does not ask, Shopify treats analytics as permitted and the pixel runs, also for visitors in the European Economic Area. The App itself does not read a consent signal. Where the Merchant's jurisdiction requires consent for analytics, the Merchant, as Controller, is responsible for obtaining it through the store's consent settings.
4. How we use data
- Delivering the service: recording the four storefront events, filtering automated traffic, and showing the Merchant where carts and checkouts are abandoned, by day and by product.
- Plan enforcement: counting distinct monthly visitors while the Merchant is on the free plan, for that plan's monthly visitor threshold, as part of the service the Merchant instructs (DPA, Section 3.1), and reading the active plan from Shopify.
- Support and debugging: AuditLog entries and application logs help diagnose issues on request.
- GDPR webhook compliance: processing Shopify's mandatory privacy webhooks on behalf of the Merchant (see Section 8).
We do not sell, rent, or share personal data with third parties for advertising or marketing.
5. Data retention
The retention descriptions in this policy describe the same rules; this Section 5 states them in full. For Customer data, the DPA prevails (Terms of Service, Section 20).
Customer data
Raw storefront events (PixelEvent) are kept for 30 days and then deleted. Monthly visitor counts (VisitorMonth) are kept for the current and the previous month and then deleted. Daily figures carry no visitor identifier and are kept until the shop's data is deleted (below). The scheduled cleanup runs every four hours (Vercel Cron). These periods are fixed; the Merchant cannot change them.
Merchant data — and what happens on uninstall / shop redaction
When a Merchant uninstalls the App, or when Shopify sends the shop/redact webhook, we purge merchant and shop personal data and all Shopify access tokens within 30 days of the triggering event. On uninstall we delete the Session (offline access token, refresh token). When Shopify's shop/redact webhook follows (typically 48 hours after the uninstall), we delete everything else we hold for the shop: the storefront events, the monthly visitor counts, the daily figures, the Merchant record (including the store contact e-mail, which we also remove from our e-mail provider's suppression list if it is listed there because an e-mail bounced, Section 7), the plan and usage record, the weekly summary interest and opt-out entries, and the operational AuditLog rows. If shop/redact does not arrive while the App stays uninstalled (for example, because the webhook is lost), the scheduled cleanup deletes the same data itself, 30 days after the uninstall; a reinstall within that time cancels the deletion. AuditLog is the one exception and it is split: the operational rows (installs, uninstalls, pixel activations, plan changes) are deleted, while the GDPR compliance rows (customers/data_request, customers/redact, shop/redact) survive, as set out below. Access tokens are not retained after uninstall.
Records that survive uninstall: the GDPR compliance AuditLog rows (customers/data_request, customers/redact, shop/redact), retained for 3 years; and the Terms acceptance record (TermsAcceptance), as set out below. The compliance rows exist to prove that an erasure we performed was in fact performed: shop/redact arrives roughly 48 hours after an uninstall, so deleting them here would destroy, within two days, the record of an erasure carried out earlier. They hold Shopify's own request ids and row counts; they carry no customer or visitor identifier. None of these records contains Customer personal data or access tokens.
Thirty days is the period within which the Shopify API License and Terms of Use (Section 6.2.3) require Merchant Data to be deleted after an uninstall.
The Terms acceptance record (shop domain, the accepted document versions, the times of acceptance and uninstall, the method) is retained for 5 years after uninstall as the proof of the contract for the general limitation period (Hungarian Civil Code (Ptk.), Section 6:22), is not deleted on shop/redact, and is then deleted by the scheduled cleanup.
The shop domain is a business identifier.
Invoices and payout records for paid plans are issued and held by Shopify and kept in our accounting records, outside the App, for the period required by Act C of 2000 on Accounting (Art. 6(1)(c)); the App itself retains no billing record beyond the 30 days above. No customer personal data and no access tokens are retained for accounting purposes.
AuditLog entries for active Merchants are retained for 90 days, then purged by the scheduled cleanup. The single exception is the GDPR compliance rows named above, which are retained for 3 years.
Application logs. We log the App's operation to maintain the quality and availability of the service. The hosting provider (Vercel) records every request in its own request log, with the time, the path, the response status, and the IP address and browser user agent of the caller, including the storefront pixel's requests from Customers' browsers; it keeps its logs for up to 30 days. The App's own log lines name the shop domain and contain no Customer identifier. A copy of the production logs is forwarded to our own server in the European Union, which removes the IP address, the user agent, the referrer and any query string, and masks any e-mail address, on receipt and keeps the rest for 14 days. We use the logs only to maintain the quality and availability of the service, that is, to detect errors, crashes and timeouts, to follow request volumes and response times, and to investigate faults. We do not use them for any other purpose.
Backups. The database provider keeps a point-in-time restore history of 24 hours, so data deleted under this Section can remain restorable for up to 24 hours after its deletion.
Correspondence. E-mails sent to our addresses and our replies are kept until the matter is closed and then for the general limitation period of 5 years (Hungarian Civil Code (Ptk.), Section 6:22), so that we can show how a request was handled.
6. Shopify Protected Customer Data
The App does not request access to Shopify Protected Customer Data: it requests neither the read_customers nor the read_orders scope, and reads no customer record, name, e-mail address, postal address or phone number through the Shopify Admin API. This does not mean that the App processes no personal data of Customers: the pseudonymous data it does process is set out in Section 3b.
Access scopes. The App requests these Shopify access scopes: write_pixels, read_customer_events. Both are used to activate the App's Web Pixel and to receive the four storefront events it records (Section 3b).
7. Sub-processors and platform providers
Shopify is not our sub-processor. Shopify Inc. is the independent e-commerce platform and app marketplace on which both the Merchant and the App operate. In respect of storefront customer data, Shopify acts as an independent controller / platform under its own terms and privacy policy, not as a sub-processor engaged by us. Data reaches the App from Shopify; Shopify does not process on our instruction.
We engage the following sub-processors to deliver the service:
| Sub-processor | Role | Data shared | Region | Safeguard |
|---|---|---|---|---|
| Vercel Inc. | Application hosting, edge delivery and application logs | All data in transit; transient IP at edge; application and request logs, including the IP address and user agent of each request (Section 5) | United States | EU–US Data Privacy Framework and/or SCCs (see Section 8 international transfers) |
| Databricks, Inc. (Neon) | PostgreSQL database hosting (Neon, provisioned via Vercel Marketplace) | All persisted data | United States (AWS us-east-1) | Databricks is certified under the EU–US Data Privacy Framework, and its certification covers Neon; SCCs stand as a fallback. Databricks Data Processing Addendum, which applies to the Neon service; sub-processor list at neon.com/subprocessors |
| Amazon Web Services (Amazon Simple Email Service) | Delivering the e-mails the App itself sends from revenueradar@peci.io to the store's contact e-mail address: the answer to a customers/data_request and the copy of data under the DPA, Section 9.3 | The store's contact e-mail address and the content of these e-mails, in transit; of them, only the copy under the DPA, Section 9.3 carries Customer data. If an e-mail to the address bounces, AWS keeps the address on our account's suppression list until we delete the store's data (Section 5), when we remove it from that list, unless another store using the App still has the same contact address. If the address is reported as spam, it stays on the list, so that no further e-mail is sent to it | eu-west-1 (Ireland, EU) | Processed within the EU; no third-country transfer for this processing |
| Zoho Corporation B.V., the Netherlands (Zoho Mail) | E-mail hosting for our revenueradar@peci.io, privacy@peci.io and legal@peci.io addresses | The content of e-mails sent to or from these addresses: Merchant correspondence, the notices we send from them, any request a Customer sends us directly (DPA, Section 7.2), and a Merchant's request under the DPA, Section 7.4, with our answer; these may contain Customer data | European Union (Zoho's EU data centre) | Processed in Zoho's EU data centre |
The e-mail host in the table also holds the e-mails Merchants send to these addresses and the e-mails we send to Merchants from them. We use no other service provider for Merchant personal data.
We will notify Merchants of any new or replacement sub-processor at least 30 days in advance by email to the store's contact e-mail address, and Merchants may object as set out in the DPA (Section 6.4).
8. International transfers and data-subject rights
8a. International transfers
The App's application hosting (Vercel) and its database (Neon) are located in the United States. Because the Company is established in the European Union and processes personal data covered by the GDPR, transfers of that data to the United States are safeguarded as follows:
- EU–US Data Privacy Framework (DPF) is the primary transfer basis where the relevant United States sub-processor is certified under it. Vercel Inc. and Neon/Databricks are DPF-certified (see Section 7).
- The DPF adequacy decision is currently valid but subject to legal challenge before the EU courts. Accordingly, Standard Contractual Clauses (SCCs) adopted by European Commission Decision 2021/914 are incorporated into our agreements with United States sub-processors and stand as a standing operational fallback, not merely a theoretical one, so that transfers remain lawful if the DPF adequacy decision is invalidated.
A copy of the Standard Contractual Clauses we rely on is available on request at privacy@peci.io.
United Kingdom. For transfers subject to the UK GDPR, the UK International Data Transfer Agreement (IDTA), or the UK Addendum to the EU SCCs, applies to UK–US transfers, alongside the UK extension to the DPF where the sub-processor participates in it.
Canada. If Canadian privacy law (PIPEDA) applies to you, the rights described in this policy are available to you as well; write to privacy@peci.io.
Australia. If Australian privacy law (the Australian Privacy Principles) applies to you, the rights described in this policy are available to you as well; write to privacy@peci.io.
8b. Merchant rights (as data subjects of Controller processing)
Merchants may exercise GDPR rights (access, rectification, erasure, restriction, portability, objection) by contacting privacy@peci.io. We will respond within one month of receiving the request; where necessary, taking into account the complexity and number of requests, this may be extended by two further months, in which case we tell you within the first month (GDPR Art.12(3)).
Your right to object. Where we process your data on the basis of our legitimate interests (Section 3a: the weekly summary interest, the summary opt-out list, the app event log, the Terms acceptance record, the hosting request log, and keeping correspondence after the matter is closed), you may object at any time, on grounds relating to your particular situation, by writing to privacy@peci.io.
Right to complain (Art.77) and supervisory authority. You have the right to lodge a complaint with a supervisory authority. The Company's lead supervisory authority is:
> Nemzeti Adatvédelmi és Információszabadság Hatóság (NAIH) > 1055 Budapest, Falk Miksa utca 9-11, Hungary > Postal: 1363 Budapest, Pf. 9. > Phone: +36 1 391 1400 > Email: ugyfelszolgalat@naih.hu > Web: naih.hu
You may also complain to a supervisory authority in the Member State of your habitual residence, your place of work or the place of the alleged infringement (GDPR Art.77(1)).
8c. Customer rights (Processor context)
Because we act as a Processor for Customer data, Customers should direct data requests to the Merchant (the Controller). The Merchant is responsible for responding. Shopify automatically routes the following mandatory privacy webhooks to us on Merchants' behalf, and we act on them within the timelines below.
customers/data_request — When a customer exercises their right of access. Shopify identifies the customer by their customer account and orders. The App holds no record keyed to a customer account or an order, and it cannot link Shopify's pseudonymous visitor identifier to a customer account (Section 3b), so it has no record to compile for the request. The request is recorded in AuditLog with Shopify's request id; that entry is one of the GDPR compliance rows retained for 3 years (see Section 5), and it carries no customer identifier. The App then answers the Merchant automatically, once per request, by e-mail to the store's contact e-mail address (Section 3a): the answer names Shopify's request id and confirms that the App holds no record linked to the customer's account or orders. The App does hold pseudonymous storefront events (Section 3b), which it cannot match to the customer on its own; if the Merchant gives us the customer's checkout token or visitor identifier, we provide or delete the matching records (DPA, Section 7.4). If the answer cannot be sent at once (no contact e-mail address on file yet, or a delivery failure), the App tries again every four hours, unless the store's data has been deleted in the meantime (Section 5).
customers/redact — When a customer exercises their right to erasure. For the same reason, the request matches no record the App holds, and nothing is deleted on receipt; the pseudonymous storefront events of every Customer are in any case deleted after 30 days, and the monthly visitor counts after two months (Section 5). If the Merchant gives us the customer's checkout token or visitor identifier, we delete the matching records (DPA, Section 7.4). One compliance AuditLog row is written to record that the request was received and how many records it matched: it holds Shopify's request id and the counts, and no customer identifier; it is retained for 3 years (see Section 5).
shop/redact — When a Merchant uninstalls and Shopify requests shop-level deletion (Shopify sends this typically 48 hours after uninstall). We delete all data associated with the shop: the storefront events, the monthly visitor counts, the daily figures, the Merchant record, the plan and usage record, the weekly summary interest and opt-out entries, the Session (including the access tokens), and the operational AuditLog rows. The GDPR compliance AuditLog rows are retained for 3 years (see Section 5); they carry no customer identifier and are the proof that the erasure took place. The Terms acceptance record is retained for 5 years (see Section 5). Completed on receipt, and in any event within 30 days.
9. United States State Privacy Rights
This section is for residents of United States states with comprehensive privacy laws (such as California, Virginia, Colorado, Connecticut, Utah, Texas, Oregon and Montana).
Customers of a Merchant's store. When you use a Merchant's store, the App processes your personal information on that Merchant's behalf. Under these laws we act as the Merchant's service provider / processor / contractor, not as a "third party", and the Merchant is the business responsible for your request. To access, delete, correct or port your data, or to exercise any other right your state gives you, contact the Merchant whose store you used. The Merchant will instruct us, and we will help the Merchant respond (see the DPA, Section 7).
Merchants. For the account and contact data we hold about Merchants and their staff, contact us at privacy@peci.io. The process in Section 8b applies.
We do not sell or share personal information as those terms are defined by the CCPA/CPRA. We do not use personal information for cross-context behavioural advertising, and we do not disclose it for monetary or other valuable consideration.
Sensitive personal information. The App does not seek to collect sensitive personal information (e.g. precise geolocation, government IDs, health, biometric, or protected-class data), and does not use personal information to infer characteristics about consumers. Of Customers, we process only pseudonymous identifiers and cart and checkout fields as described in Section 3b. The only inference the App makes is a bot score, used to exclude automated traffic from the Merchant's figures.
Minors (US). The App is a B2B tool directed at Merchants and is not directed to children. We do not sell or share personal information (see above), and so do not sell or share the personal information of consumers under 16.
De-identified data. Where we use de-identified or aggregated data (e.g. for service metrics), we maintain it in de-identified form, do not attempt to re-identify it, and contractually require the same of any recipient.
10. Article 28 DPA summary and where to find the full DPA
The full Data Processing Agreement under GDPR Art.28 is published at https://peci.io/revenue-radar/dpa, is incorporated by reference into the Terms of Service, and is accepted together with them in the App's acceptance step. It also contains the US service-provider/contractor terms referenced in Section 9. The DPA prevails over the other documents on any data-protection question. Key terms:
- Subject matter: processing pseudonymous storefront analytics data to show the Merchant where carts and checkouts are abandoned, and, on the free plan, counting distinct monthly visitors for that plan's monthly visitor threshold, on behalf of the Merchant.
- Duration: for as long as the App is installed, plus the retention periods in Section 5; deletion or return of data on termination.
- Nature and purpose: collection, storage, aggregation and deletion of storefront event data as described in this policy.
- Type of personal data: Shopify's pseudonymous visitor identifier, a session key derived from it, checkout tokens, cart and checkout amounts and products, a hash of the user agent and a bot score; and, in the hosting provider's request log, the IP address and user agent of each storefront request. No names, contact details or payment data of Customers.
- Categories of data subjects: Customers of the Merchant's Shopify store who add a product to the cart, view the cart, or start or complete checkout.
- Processing on instructions only: we process personal data only on the Merchant's documented instructions, including as to international transfers, unless required by EU or Member State law (in which case we inform the Merchant unless the law prohibits it).
- Confidentiality of personnel: persons authorised to process the data are bound by confidentiality (Art.28(3)(b)).
- Security: appropriate technical and organisational measures (Art.32), as summarised in Section 11.
- Sub-processors: we engage sub-processors only under a written contract imposing the same data-protection obligations (flow-down); we give Merchants at least 30 days' prior notice of any new or replacement sub-processor and a right to object within that period (Art.28(2), (4)).
- Assistance with data-subject rights: we assist the Merchant, by appropriate technical and organisational measures, in responding to data-subject requests (Art.28(3)(e)).
- Assistance with security, breach, DPIA: we assist the Merchant with Art.32–36 obligations, including data protection impact assessments and prior consultation with the supervisory authority (Art.28(3)(f)).
- Breach notification: we notify the Merchant without undue delay, and in any event within 48 hours (DPA, Section 8.1), after becoming aware of a personal data breach (Art.33(2)).
- Deletion or return: before uninstalling, the Merchant may request a copy of its data (DPA, Section 9.3); uninstalling is the instruction to delete, and we delete existing copies unless EU/Member State law requires storage (Art.28(3)(g)).
- Audit and inspection: we make available all information necessary to demonstrate compliance with Art.28 and allow for and contribute to audits and inspections conducted by the Merchant or an auditor it mandates, subject to reasonable notice and confidentiality (Art.28(3)(h)).
- Order of precedence: the DPA prevails over the Terms of Service and Privacy Policy on data-protection matters.
11. Security
We implement appropriate technical and organisational measures including:
- HTTPS/TLS for all data in transit
- Database encryption at rest and in transit (at-rest encryption provided by the database Sub-processor, Neon; TLS in transit)
- Shopify API authentication tokens are stored in the database and are covered by that at-rest encryption; the App applies no additional application-level encryption of its own. They are purged on uninstall and on shop redaction, and no token is retained afterwards.
- Access to production data limited to authorised personnel bound by confidentiality
- Automated deletion of storefront events and monthly visitor counts per Section 5
We will notify affected Merchants without undue delay if we become aware of any personal data breach affecting personal data we process on your behalf. (As a processor, Article 33(2) GDPR imposes no risk threshold on this notification to the controller; the risk assessment governs only the Merchant-controller's own notification duties.)
12. Children
The App is directed at Shopify merchants (business users). We do not knowingly process personal data of children. Where the App operates on storefronts across the EU, the age of digital consent varies by Member State (between 13 and 16); the Merchant, as Controller of storefront customer data, is responsible for the applicable age threshold and for any parental-consent requirements. If you believe we have inadvertently processed a child's data, contact privacy@peci.io.
13. Changes to this policy
We review this policy at least once a year. We announce material changes to this policy in the App, shown when you open it, at least 30 days before the change takes effect. The version of this policy in force when you accept the Terms of Service in the App is recorded with your acceptance (Terms of Service, Section 3A). The version line at the top of this document shows the version in force and the date it took effect, and each earlier version is listed in the version history at the end of this page.
14. Contact
For privacy questions, data-subject requests, or the full DPA:
PÉCI Kft. Aradi utca 5., 2119 Pécel, Hungary Data / privacy matters: privacy@peci.io Legal notices: legal@peci.io Full DPA: https://peci.io/revenue-radar/dpa
We have not appointed a data protection officer: at the current scale of our processing, GDPR Art.37 does not require one, and we review this as the App grows; privacy@peci.io is the contact for every data-protection matter.
Version history
Each version of this document is listed with the period it was in effect. Version numbers were assigned on 2026-08-31, when this register was created.
| Version | In effect | What changed | Copy |
|---|---|---|---|
| 1.0 | 2026-10-18 – current | First published version. | this page |