PeekProfit Privacy Policy

Last updated 10 October 2026

PeekProfit is a Shopify app that works out the profit of a Shopify store. It is made by ME MORE COOL PTY. LTD. (ABN 45 611 538 697), trading as memorecool ("we", "us"). This policy explains what PeekProfit reads from a store, what it keeps, and what it never keeps. We handle personal information in line with the Australian Privacy Principles under the Privacy Act 1988 (Cth).

1. Who this is about

Our user is the merchant who installs PeekProfit. The merchant's customers are not our users, and PeekProfit is built so that it does not need to know who they are (see section 3).

2. What we collect from the store

When a merchant installs PeekProfit, Shopify gives the app read-only access to the store. We read and keep:

• Store details: the store's address on Shopify, its Shopify ID, name, currency and time zone, and the app plan it is on.
• Access credentials: the access tokens Shopify issues to the app, stored encrypted (AES-256-GCM). They can only read store data; they cannot change anything in the store.
• Products: titles, handles, status, image links, and for each variant its title, SKU, weight and the cost recorded in Shopify.
• Orders: order number, dates, status, currency, item quantities and prices, discounts, shipping charged, taxes, tips, duties, refunds, payment methods and transaction fees, order tags, and the country of the shipping address.
• Access log: each time someone opens the app, the Shopify staff user ID of the person signed in (a number Shopify assigns, not a name or email), the page or report requested and the time. We keep it for 90 days to be able to tell who accessed a store's data.
• What the merchant enters: product costs, shipping and handling costs, transaction fee rules, custom expenses, advertising spend and report settings.
• Email report recipients: the email addresses the merchant adds to receive daily or weekly profit reports, whether each address has confirmed it wants them, and which report was last sent. Nothing is sent until the address owner confirms; an address that does not confirm is deleted after 14 days, and all of a store's addresses are deleted when the app is uninstalled. To limit confirmation emails to one a day, we keep a note that we sent one to an address for 30 days. If someone unsubscribes, we keep their address on a do-not-email list so that no store can add it again.
• Where an order came from: from Shopify's record of the visit that led to an order, the marketing parameters only (utm source, medium, campaign, content and term), the ad click identifiers that ad platforms add to links (such as fbclid or gclid), and the host names of the landing and referring pages. We do not keep page paths, search terms or anything else from those addresses.

2a. What we collect from services the merchant connects

A merchant can choose to connect their ad accounts and fulfilment services. We only connect when the merchant asks, and only read data.

• Ad platforms (Meta, Google Ads, TikTok, Microsoft Advertising, Snapchat, Pinterest, X and Amazon Ads): the ad accounts the merchant chooses, their names, currencies and time zones, and for each day the campaigns, ad sets and ads with their names, spend, impressions, clicks and the purchases and purchase value the platform reports. We never read audiences, people's profiles or messages, and we cannot create or change ads.
• Fulfilment services (Printful, Printify, Gelato, CJ Dropshipping, Shipwire) and Shopify Shipping: what the merchant was charged for each order (product, shipping, taxes and fees), with the order reference and item SKUs. We do not read the customer's name or address from these services.
• Connection credentials: the access tokens or API keys for these services, stored encrypted (AES-256-GCM) and used only to read the data above.

3. What we never store about customers

PeekProfit does not store a customer's name, email address, phone number, street address or any payment card details. For each order we keep only:

• the country of the shipping address, so costs and shipping can be set per country;
• a one-way, salted hash of the Shopify customer ID, so repeat orders can be grouped without knowing who placed them; and
• how many orders that customer had placed, so the app can tell new customers from returning ones.

When Shopify tells us a customer has asked to be erased, we remove the hash and order count from that customer's orders. When a customer asks a store for their data, there is nothing identifying to return, because we never held it.

4. How we use it

Only to show the merchant their profit reports, to keep them up to date as orders change, to bill the app plan through Shopify, and to fix problems the merchant reports. We do not sell any information, do not use it for advertising, and do not use it to train artificial intelligence.

5. Who can see it

Only people signed in to the store's Shopify admin who can open the app. Other stores cannot see anything about yours. memorecool staff look at a store's data only to provide support the merchant asks for, to keep the service secure, or where the law requires.

6. Where it is kept, and service providers

PeekProfit data is stored on our servers in Sydney, Australia. We use these providers, who handle data only to provide their service to us:

• Shopify — the platform the app runs in, and billing for the app plan (Canada and the United States).
• Cloudflare — secure network connection between Shopify and our servers.
• Resend — sends the email reports a merchant asks for (United States). Only the recipient address and the report itself are sent.
• Frankfurter (European Central Bank reference rates) — daily exchange rates to convert ad spend and fulfilment costs into the store currency. Only currency codes and dates are sent.

Ad platforms and fulfilment services the merchant connects are not our providers: they are the merchant's own services, which we read from on the merchant's instruction. Their own privacy policies apply to the data they hold.

7. How long we keep it

We keep a store's data while PeekProfit is installed. A merchant can disconnect an ad platform or fulfilment service at any time; we then delete its credentials and the data we read from it. When the app is uninstalled we delete the access tokens for Shopify and every connected service at once, delete the data read from connected services, and stop reading the store. Shopify then asks us to erase the store's data, normally 48 hours later, and we delete everything we hold for that store. Our nightly backups are kept for 14 days on our server and for 30 days on an encrypted backup drive, so a deleted store disappears from every backup within 30 days of that erasure. Access log entries are deleted after 90 days.

8. Your choices and rights

A merchant can ask us for a copy of their data or for its deletion at any time, or simply uninstall the app. Customers of a store should contact that store first; we will help the store answer. To make a request or a complaint, email support@memorecool.au. If you are not satisfied with our answer, you can contact the Office of the Australian Information Commissioner (oaic.gov.au).

9. Security

The app signs in through Shopify, so there is no PeekProfit password. Every request from the Shopify admin carries a token signed by Shopify that our servers check; data travels over encrypted connections; access tokens are encrypted at rest, and the database and its backups are stored on encrypted disks; each store's data is kept apart by checks on our servers; and every access to a store's data through the app is logged. No system is perfectly secure; if a breach is likely to cause serious harm we will notify affected merchants and the OAIC as the law requires.

10. Changes

We may update this policy; the date above will change, and we will tell merchants about material changes.