Privacy Policy

ProfNerve is operated by Carlos Bondia Casino, established in Spain. Privacy requests can be sent to privacy@profnerve.com.

We process merchant account information, connected-store identifiers, server-restricted integration credentials, store configuration, product and order information, technical customer identifiers, historical order counts, advertising performance data, audit results and security logs.

Shopify customer names, addresses, telephone numbers and email addresses are not requested for the current ProfNerve audit. We request only the protected customer data required to calculate customer, order and retention statistics.

Data is processed to authenticate merchants, maintain requested integrations, calculate ecommerce and advertising metrics, generate profit audits and recommendations, provide reports, prevent abuse, troubleshoot failures and comply with law.

Merchant account and integration data is processed to perform the service agreement. Security and limited operational logging rely on legitimate interests in operating a safe service. Merchants remain responsible for an appropriate legal basis for customer data made available through connected platforms.

ProfNerve limits processing to information needed for merchant-facing reports and statistics. Individual Shopify order and customer records are retrieved for transient processing and are not persisted as customer lists. Recommendations support merchant decisions and do not make decisions about consumers with legal or similarly significant effects.

We use Shopify for commerce integration, Supabase for authentication and database infrastructure, Vercel for hosting, and OpenAI for restricted analysis generation. Each provider processes data only as needed for its service and under applicable contractual and security terms. Restricted international transfers use a recognised legal safeguard where required.

Raw Shopify order and customer responses are processed transiently. Integration credentials are removed when access is disconnected or revoked. Personal data associated with a disconnected Shopify store is deleted or irreversibly anonymised no later than 30 days after disconnection, unless a shorter legal deadline applies.

Aggregated reports are retained while the merchant account is active. They are deleted or anonymised on account deletion, except for narrowly limited records that law requires us to retain.

ProfNerve uses encrypted network connections, server-side access controls, user and store ownership checks, restricted administrative access, provider encryption at rest, safe error responses and security logging.

Depending on applicable law, individuals may request access, correction, deletion, restriction, portability or objection. Shopify customer requests should normally be made to the relevant merchant. We assist merchants with verified requests and honour Shopify privacy webhooks. Contact privacy@profnerve.com.

We may update this policy when the product, providers or legal requirements change. Material changes will be communicated and a new version will require acceptance where appropriate.