1. Information we collect
Profitlume provides ecommerce profit reporting and insights. We collect account and authentication identifiers, workspace membership and permissions, support communications, and technical information needed to operate and secure the service, such as request logs and session information.
When you authorize an integration, we receive the data supported by the granted permissions. This can include store and order identifiers, product details, sales, refunds, costs, payment-processing fees and advertising spend. We also process expenses, cost assumptions and other records you enter. Connected records may relate to your customers; connect only data you are authorized to provide.
Authentication cookies and session storage support sign-in and security. Payment details entered into Stripe Checkout are handled by Stripe. Profitlume is not intended to receive or store full payment-card numbers.
2. How information is used and disclosed
We use information to provide reports, reconcile connected records, manage access and subscriptions, respond to support requests, maintain audit history, detect misuse and improve reliability. We do not sell personal information or use connected merchant data for cross-context behavioral advertising.
Authorized workspace members can access information according to their permissions. We use service providers for hosting (OVHcloud), authentication (Auth0), billing (Stripe), email (Namecheap) and operational notifications (Slack). Providers receive information necessary for their role through authenticated service connections or support communications. Connected platforms such as Shopify and Meta process data under their own policies.
3. AI-assisted insights
When model-backed insights are enabled with authorization, Profitlume sends report dates, aggregate financial totals, order counts and completeness flags to OpenAI. This flow excludes customer details, order and store identifiers, and invoice text. API requests use store:false; this does not eliminate the provider’s applicable abuse-monitoring retention. AI output can be inaccurate and must be reviewed.
We may disclose information where required by law, to protect rights and security, or in a business transfer subject to appropriate confidentiality protections. We do not grant a service provider unrestricted access merely because it is listed here.
4. Security, location and retention
We use HTTPS, server-side permission checks, tenant-scoped database controls and protected server credentials. Access is restricted according to role. No system or transmission is completely secure. You are responsible for protecting your account and limiting the access you grant.
Information may be processed in the United States and other locations where our service providers operate. Where required, applicable safeguards must be used for international transfers.
We retain information as needed to provide the service, maintain financial and security audit records, resolve disputes and meet legal obligations. Retention varies by record type and purpose. Deletion requests are assessed against these requirements. Deletion from backups may occur through their normal retention cycle rather than immediately; retained copies must not be used to restore erased data into ordinary service access.
5. Your choices and requests
You can disconnect supported integrations and contact support@profitlume.com to request access, correction, export or deletion. Disconnecting prevents future authorized access but does not automatically delete historical records. We may verify your identity and authority before acting.
Depending on your location, you may have rights to object to or restrict processing, withdraw consent where processing relies on consent, request portability, or complain to your local privacy regulator. We will handle requests under applicable law. For shopper information controlled by a merchant, contact that merchant; Profitlume assists authorized merchants with relevant requests.
6. Children and policy updates
Profitlume is a business service and is not directed to children under 18. If you believe a child has provided personal information, contact us. We may update this policy as the service changes. The effective date identifies the current version; material changes will be communicated as required by law.
7. Contact
For privacy questions or requests, email support@profitlume.com.