MarginPatrol | Version 1.0 | Prepared 08 August 2026
Publication date: 02.09.2026. Effective date: 02.09.2026. Canonical page: https://marginpatrol.com/privacy.
1. Who is responsible and what this notice covers
MarginPatrol is operated by the operator identified in the Legal Notice, trading as MarginPatrol. Its business and correspondence addresses are published there. Contact us at support@marginpatrol.com with the subject Privacy. The Legal Notice identifies the operator; the UK correspondence address is not, by itself, a UK establishment.
This notice covers our website, Shopify application, connected mobile access, integrations, account administration and support. It is a notice, not consent to every processing activity and not a substitute for a Merchant's customer privacy notice.
2. Our role and the Merchant's role
For account administration, our own subscription records, security management, legal compliance, support administration and limited service analytics, we determine the purposes and means and act as controller to the extent applicable law uses that term.
For store, order and advertising information processed to provide a Merchant's calculations, reports, signals and configured notifications, the Merchant normally determines the business purpose. We act as its processor under the DPA. If the Merchant is itself a processor, it must be authorised by the relevant controller and the DPA applies to the corresponding subprocessing.
An order number, account identifier, device token or coded record can be personal data even without a name. We do not assume information is anonymous merely because direct customer contact details have been removed. Shopify and merchant-selected advertising or workspace platforms may have separate roles for their own services.
3. Categories and sources of information
| Category | What it includes and where it comes from |
|---|---|
| Account and permissions | Business and store identifiers, shop domain, user identifiers, role, assigned stores, invitation contact details, account contact information and acceptance records; from Shopify, the Merchant and Authorised Users |
| Store financial records | Orders and line-item identifiers, product and variant information, quantities, prices, discounts, refunds, transaction fees, shipping amounts, relevant country/region or shipping-method information, costs, currency, time zone and event dates; from authorised Shopify data and Merchant inputs |
| Calculations and review | Published financial results, component quality, source status, selected periods, alerts, observations, review actions, reports, exports and related context; generated from the authorised data |
| Advertising integration | Selected account/campaign identifiers and metadata, dated spend, connection and sync information, authorisations and tokens; from connected platforms and authorised manual entries |
| Subscription administration | Selected plan, confirmed contract status, periods, trial dates, order counts, cancellation/change requests and billing-return context; from the app and Shopify |
| Devices and communications | App/device and session identifiers, push tokens, notification preferences, recipients, delivery status and configured Slack workspace/channel identifiers; from the device, user and selected delivery service |
| Support, rights and security | Correspondence, proportionate identity/authority evidence, relevant diagnostics, access/security events, technical request details such as IP address where recorded, and request outcomes; from the requester and service operation |
| Limited product analytics | Indirect account/context identifiers, event type, dates, categorical quality/readiness/access states and necessary counts; from use of the Service, not raw store financial amounts or buyer records |
The core profit calculation does not require buyer names, buyer email addresses, telephone numbers, exact delivery addresses or payment-card credentials. We do not ask Merchants to add them to financial imports. However, provider privacy-request payloads, support communications or underlying permitted records can contain personal information. Any such receipt is limited to the request or necessary service purpose and is subject to minimisation and deletion; this is not a claim that no personal data is ever processed.
We receive Shopify subscription information, not the card credentials used to pay Shopify. We do not request special-category data or criminal-offence data for the calculation. Product descriptions and free text can reveal sensitive matters; do not deliberately submit them where unnecessary. Notify us if unnecessary sensitive information has been supplied.
Data-inventory release check: confirm the fields actually received, temporarily buffered, logged and retained before publication. A statement that contact details are not shown in reports does not establish that they were never received.
4. Purposes and legal bases when we are controller
Where the GDPR or UK GDPR applies, we rely on the bases below only where their requirements are met. Ukrainian processing must also have a basis permitted by the Law of Ukraine On Personal Data Protection. We do not use a contractual clause as a substitute for consent where consent is legally required. The GDPR legal-obligation basis is used only where the obligation qualifies under that regime; a separate Ukrainian duty is not automatically treated as an EU or UK statutory obligation.
| Purpose | Basis and limits |
|---|---|
| Create and operate an account for an individual sole-trader customer | Steps requested before contracting and performance of that person's contract, only for objectively necessary processing |
| Deal with company personnel and administer team access | Legitimate interests in supplying and administering the business relationship; an employee is not automatically personally a party to the Merchant contract |
| Administer subscriptions and account records | Contract where necessary for an individual contracting customer; otherwise legitimate business-administration interests; legal obligation for records a specified law requires |
| Maintain security, prevent abuse, enforce rights and handle disputes | Legitimate interests in protecting users and the Service, subject to necessity, proportionality and individual rights; legal obligation where a specific obligation applies |
| Respond to support and privacy requests | Contract or legitimate interests for service support; legal obligation for applicable rights and regulatory duties |
| Understand service reliability and completion of user workflows | Legitimate interests in improving the Service using limited, proportionate events; no raw financial data, advertising-account data or buyer-content analytics |
| Send requested operational notifications | Contract or legitimate interests in the requested business service; device permission alone is not a universal data-protection lawful basis |
| Optional marketing and non-essential device tracking | Consent where required by privacy or electronic-marketing law; no reliance on accepting Terms as marketing consent |
For Merchant Data processed on behalf of a Merchant, its lawful instructions and the DPA govern our processing. The Merchant remains responsible for its notices and basis. We do not reuse processor data for unrelated controller purposes under the label of analytics.
Providing the minimum store authorisation, identifiers and cost information is necessary to supply the requested calculation. If you do not provide it, the affected connection, result or action may be unavailable or incomplete. Optional advertising connections and notification choices are not mandatory merely to form a contract. We do not assert that an individual is legally obliged to buy the Service or supply optional marketing information.
5. Recipients and controlled access
Authorised people in the Merchant's organisation can see information within assigned store permissions. We use the providers listed in the Subprocessors register for hosting, databases and private storage, secret/key management, transactional communications, push delivery, redacted error monitoring and privacy-safe server-side product events. Optional destinations such as a Merchant's Slack workspace are used only when enabled and authorised.
Operational email or Slack can contain financial summaries selected by the Merchant. Private push notifications hide financial amounts by default, but the user can change the permitted setting. Delivery services still receive the destination and technical delivery metadata necessary to deliver a message. We do not promise that all notifications are invisible to every third party.
Personnel access is limited to legitimate authorised purposes, confidentiality duties and appropriate controls. We may disclose narrowly necessary information to advisers, courts or authorities where law requires or permits it. A corporate transaction does not automatically permit unrestricted transfer; confidentiality, applicable privacy law and the stricter Google rules remain applicable.
We do not sell Merchant financial or personal data, use it for cross-context behavioural advertising, or provide it to data brokers. It is not supplied for training general-purpose AI models. These are service commitments, not a claim of external certification.
6. Google API data
6.1 Information accessed and permissions
If an authorised user connects Google Ads, the integration uses the Google Ads OAuth permission https://www.googleapis.com/auth/adwords. It receives access/refresh tokens and reads accounts available to that user, selected account identifiers and descriptive metadata, status and manager/test indicators, currency and time zone, campaign identifiers/names/status, and account/campaign advertising spend by date.
MarginPatrol uses this permission to read the data needed by its visible features. It does not use the connection to create, edit or delete campaigns, upload click/call conversions, request Google Ads customer contact details or retrieve payment-card credentials. A broad provider permission does not authorise unrelated uses.
6.2 Purposes and handling
Account metadata supports account selection and connection status. Dated spend supports source coverage, data quality, profit after ads, breakdowns, reports and signals. Tokens support authorised API access, refresh and revocation. Advertising cost is not automatically attributed as profit of an individual order, product or campaign.
Google data and derived information may be processed by the hosting, database, secrets and key-management providers that actually handle that flow, and by authorised delivery providers only to deliver a prominently disclosed notification the Merchant enables. The approved Subprocessors register identifies those roles. We do not make an EU-only or two-provider-only claim where another host processes that data. Raw tokens and provider payloads are not sent through customer notifications or general product analytics.
MarginPatrol's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements where applicable. We do not use Google data for advertising, data brokerage, creditworthiness, unrelated profiling or general-purpose AI training. The restrictions also apply to derived data where the policy so requires.
Human access to Google data is allowed only with the user's specific affirmative agreement, when necessary for security or law, or another expressly permitted policy exception. General support authority is not unrestricted permission to inspect raw Google data. A merger or asset transfer involving Google data is not treated as automatically authorised by accepting these Terms; any required specific prior consent must be obtained.
6.3 Disconnection and deletion
You can disconnect Google Ads in Settings and revoke the app's access in your Google Account controls at https://myaccount.google.com/permissions. Disconnection stops future use of the affected authorisation and clears local token material when it is no longer needed for another valid connection using the same authorisation. It does not automatically erase previously imported spend that remains necessary to explain retained results.
You may separately request store-data deletion in Settings or through support. Google account/campaign/spend records, derived identifiable records and credentials follow the Data Retention and Deletion Policy and any shorter applicable Google, Shopify or legal requirement. Backups and minimal compliance evidence are addressed there; no new consent to retention is inferred from disconnecting.
7. International processing
The operator is based in Ukraine. Hosting in the EEA does not by itself eliminate an international transfer when a separate organisation or authorised recipient outside the EEA can access information. Approved providers and their actual processing/support locations are identified in the Subprocessors register.
Before making a restricted transfer, we must establish the lawful route required by the applicable regime: an applicable adequacy decision, appropriate enforceable safeguards with the required assessment and supplementary measures, or a strictly applicable statutory exception. For relevant EEA/UK transfers this can require completed Standard Contractual Clauses and the UK Addendum or IDTA. Routine service delivery is not based on a generic consent to worldwide transfer.
You may request information about safeguards and an appropriately redacted copy at support@marginpatrol.com. A provider's name or a link to a template is not proof of a signed transfer instrument or a certification.
8. Retention and deletion
The Data Retention and Deletion Policy contains the implemented technical schedule. It distinguishes active data, a limited read-only archive, exports, operational records, security records and backups. A plan's 90/365-day history allowance is not a physical deletion deadline.
Accepted store-deletion instructions stop access and new processing of the affected store immediately, subject only to necessary deletion/compliance operations. Permanent removal is asynchronous. Minimal records may be retained when an identified legal duty requires them; that does not justify retaining the entire store database for general litigation convenience.
Cancelling renewal alone does not delete the data. Uninstall and mandatory privacy requests can require deletion independently of archive availability. Deleted data is not automatically restored by reinstalling. If a backup is restored, applicable deletion instructions must be reapplied before normal service resumes.
9. Security and devices
We use proportionate access controls, encrypted transport, protection of integration credentials, isolated store permissions and restricted operational access. The DPA security schedule states our required safeguards. We do not claim ISO certification, an independent audit or protection against every incident unless separately evidenced.
When store access is revoked, the affected mobile permission and future server access are revoked as described in the Service. Other authorised stores need not be removed. A disconnected device may still show information previously received until it next interacts with the service; we cannot remotely erase a screenshot or a recipient's separately downloaded copy. Biometric/device protection does not mean that MarginPatrol receives a fingerprint or face template; any such technical claim must match the verified device implementation.
10. Your rights and requests
Depending on the applicable law, you may ask for access and a copy, correction, deletion, restriction, portability, information about sources/recipients and processing, and objection to processing based on legitimate interests. You can withdraw consent where processing relies on it, without affecting its prior lawfulness.
Right to object: You can object to processing based on legitimate interests on grounds relating to your situation, and to direct marketing at any time, by contacting support@marginpatrol.com. We stop or restrict the affected processing as the applicable law requires. Direct-marketing objections are honoured. Rights are not unconditional; we explain any lawful limitation rather than requiring a paid subscription.
Write to support@marginpatrol.com or use Settings. We request only proportionate evidence of identity and authority. Do not email passwords, tokens or a complete customer dataset. Where we act as processor for a store, we normally refer the request to the Merchant and assist it rather than disclose another store's data directly. Shopify privacy requests are handled through the applicable privacy-request process.
For GDPR/UK GDPR requests we respond without undue delay within the applicable one-month period, subject only to a lawful extension or pause, with required explanations. A shorter applicable deadline prevails. Ukrainian rights and procedural deadlines apply where relevant.
11. Complaints and supervisory authorities
You can raise a data-protection complaint through support or by writing to the operator. We will acknowledge it without undue delay, investigate it, provide appropriate progress information and communicate the outcome. This is a complaint-handling commitment, not a promise that every complex complaint will be resolved within 30 days, and it does not replace a shorter applicable rights-request deadline.
You retain the right to complain to the competent authority or seek judicial relief. In Ukraine, contact the Ukrainian Parliament Commissioner for Human Rights: https://ombudsman.gov.ua/uk/zvernennya. In the UK, contact the Information Commissioner's Office: https://ico.org.uk/make-a-complaint/. In the EEA, the competent authority may be that of your habitual residence, workplace or the alleged infringement; the EDPB publishes the authority list. You do not waive those rights by contacting us first.
12. Automated processing, children and changes
MarginPatrol automatically calculates business financial results, prioritises configured signals and applies agreed account-capacity rules. These functions are not designed to make credit, employment, insurance or other solely automated decisions producing legal or similarly significant effects about individual customers. Contact us to challenge an account decision or incorrect input. We do not claim that any future automated decision is exempt from applicable law.
The account service is intended for authorised business users, not children. A Merchant remains responsible for the lawfulness of customer records that may relate to children; we do not infer a customer's age from the existence of an order.
We identify material updates and provide an effective date. New purposes or disclosures requiring consent or another permission will not begin merely because we replaced this page. Older versions and applicable notices are retained as appropriate evidence. Questions: support@marginpatrol.com.