Privacy Policy and Data Processing Agreement

Part 1. Privacy Policy

This Privacy Policy describes how we collect, use, and disclose personal information about you as a customer of Juicy Profit Analytics, including through the Shopify App Store, our website at juicy.fyi, and any API or plugin integrations. It covers your merchant account, billing, support, and website and usage data. It complies with Swedish and EU data protection laws, including the General Data Protection Regulation (GDPR). Processing of your store's customer data is covered by the Data Processing Agreement below.

Data controller

Daka Labs AB is the Data Controller for data relating to your direct relationship with us as a customer of Juicy Profit Analytics, including your account information, billing details, and communications with our support team.

Daka Labs AB
Organization Number: 559395-2921
Stora vägen 31b, 513 33 Fristad, Sweden
Email: [email protected]

What data we collect about you

We collect the following categories of data about you to provide and improve the Service:

• Account information: Your Shopify store URL, email address, and subscription plan.
• Usage data: Pages visited, features used, clicks and interactions, browser and device type, IP address, and time spent in the Service.
• Session recordings and error data: Recordings of how you navigate and interact with the Service, along with technical error logs. Input fields are masked and passwords are never recorded.
• Communications: Messages you send to our support team.
• Cookies and tracking: Session cookies, preference cookies, and analytics identifiers. See the Cookies section below.

Why we collect it (purpose and legal basis)

We process your data under the following legal grounds:

• Performance of a contract: To deliver the profit analytics service you subscribed to, including calculating margins, attributing orders, and generating reports.
• Legitimate interests: To improve the Service, diagnose issues and errors (including through product analytics and session recordings), prevent abuse, and communicate product updates, where these interests are not overridden by your rights.
• Legal obligation: To comply with applicable tax, accounting, and regulatory requirements.
• Consent: For optional features such as marketing communications. You may withdraw consent at any time.

How we use your data

• To process your subscription and manage billing via Shopify
• To respond to support inquiries
• To detect, investigate, and prevent fraudulent or unauthorized activity
• To improve the Service and fix errors through product analytics and session recordings

Optional advertising platform integrations, including Meta Conversions API, are covered in the DPA under Advertising platform integrations.

AI and ChatGPT plugin integration

Juicy integrates with Shopify Sidekick, which is powered by OpenAI's infrastructure. When you use the Shopify Sidekick integration ("Ask Shopify's AI about your profit"), the following applies:

• Profit data from your store (such as revenue, costs, ROAS, and margins) may be included in prompts sent to OpenAI's API to generate responses.
• OpenAI processes these prompts in accordance with their own Privacy Policy and API usage policies.
• We do not store the content of individual AI queries beyond what is necessary to display the response in the session.
• This feature is opt-in. If you do not use the Shopify Sidekick integration, no data is shared with OpenAI.

Who we share your data with

We do not sell your personal data. We share data about you only with trusted service providers that act as our processors for your account, billing, support, and usage data:

• Shopify Inc.: App platform and billing
• Cloudflare Inc.: Website hosting, CDN, and DDoS protection
• Crisp IM SARL: In-app chat support
• PostHog Inc.: Product analytics, session recordings, and error tracking (data hosted in the EU, Germany)
• OpenAI Inc.: AI query processing (only when Shopify Sidekick integration is enabled)
• Public authorities: When required by law or legal process

All third-party providers are bound by data processing agreements and are required to protect your data in accordance with applicable law. Sub-processors that handle your store's customer data are listed in the DPA.

International data transfers

Some of our service providers are located outside the European Economic Area (EEA), including in the United States. When we transfer personal data outside the EEA, we ensure appropriate safeguards, such as Standard Contractual Clauses (SCCs) approved by the European Commission, are in place to protect your data.

Product analytics data processed by PostHog is stored within the EU (Germany). PostHog Inc. is a US company; any access to this data from outside the EEA is covered by Standard Contractual Clauses under our data processing agreement.

Data retention

We retain your account and usage data for as long as your account is active or as needed to provide the Service. If you uninstall Juicy or request deletion, we will delete your personal data within 30 days, unless we are required to retain it for legal, regulatory, or accounting purposes.

Session recordings are automatically deleted after a limited retention period.

Anonymized and aggregated data that cannot identify you may be retained indefinitely for product improvement purposes.

Cookies

We use cookies and similar technologies for the following purposes:

• Strictly necessary cookies: Required for the Service to function, including session management and security.
• Preference cookies: Remember your settings and display preferences.
• Analytics cookies: Help us understand how the Service is used so we can improve it. We use PostHog for this purpose.

You can control cookies through your browser settings. Disabling certain cookies may affect the functionality of the Service.

Your rights under GDPR

As a data subject under GDPR and Swedish data protection law, you have the following rights:

• Right to access your personal data
• Right to rectification of inaccurate personal data
• Right to erasure ("right to be forgotten")
• Right to restriction of processing
• Right to data portability
• Right to object to processing based on legitimate interests
• Right to withdraw consent at any time (without affecting the lawfulness of prior processing)
• Right to lodge a complaint with the Swedish Authority for Privacy Protection (IMY) at imy.se

These rights apply to your own account data, where Daka Labs AB is the Data Controller. If you are a customer of one of our merchants and wish to exercise these rights over your order or purchase data, please contact that merchant directly, as they are the Data Controller for that data. Daka Labs AB will support the merchant in responding to your request as required under GDPR.

To exercise any of these rights, contact us at [email protected]. We will respond within 30 days.

How we protect your data

• All data is encrypted in transit using TLS and at rest using industry-standard encryption.
• Access to personal data is restricted to authorized personnel on a need-to-know basis.
• We regularly review our security practices to maintain compliance with industry standards.
• We maintain data processing agreements with all third-party processors.

Children's privacy

The Service is intended for business use by adults operating Shopify stores. We do not knowingly collect personal data from individuals under the age of 16. If we become aware that we have collected such data, we will delete it promptly.

Contact us

For privacy-related questions, requests, or complaints:

Daka Labs AB
Stora vägen 31b, 513 33 Fristad, Sweden
Email: [email protected]
Phone: +46 722-37 81 34

Part 2. Data Processing Agreement (DPA)

Our Data Processing Agreement, made under Article 28 of the GDPR, applies automatically to every merchant using the Service and forms part of the terms. You (the merchant) are the Data Controller for personal data relating to your store's customers and orders. Daka Labs AB acts as your Data Processor for that data. Data protection rules vary by country, so it is your responsibility as the merchant to have a valid legal basis for the customer data you share with us through the Service.

Scope

We process personal data relating to your store's customers and orders on your behalf: order data, customer names, addresses, and purchase history retrieved via the Shopify API. To provide the Service we also process:

• Shopify store data: Orders, products, variants, customers (in aggregate), shipping information, and transaction fees, accessed via the Shopify API with your explicit authorization.
• Cost and expense data: COGS values, shipping rules, custom expenses, and 3PL fees that you enter into the Service.
• Ad attribution data: UTM parameters from advertising platforms (Meta, Google, TikTok, Snapchat, Pinterest, Microsoft Ads, AppLovin) linked to your orders.

We process that data only on your documented instructions, in order to:

• Calculate and display profit, margin, COGS, shipping costs, and ad attribution in your dashboard
• Generate order-level and store-level reports
• Sync data across multiple connected Shopify stores

Our obligations under Article 28

For personal data we process on your behalf, we commit to the following:

• We process personal data only on your documented instructions.
• People authorised to process the data are bound by confidentiality.
• We apply appropriate technical and organisational security measures. Data is encrypted in transit using TLS and at rest using industry-standard encryption. Access is restricted to authorized personnel on a need-to-know basis, and we review our security practices regularly.
• We use only the sub-processors listed in this DPA, and we give you notice before we change that list.
• We assist you with requests from data subjects. If a customer of your store contacts us about their order or purchase data, we will refer them to you and support you in responding, as required under GDPR.
• We notify you of a personal data breach without undue delay.
• When the Service ends, we delete or return the personal data, unless the law requires us to keep it.
• We make the information available that you need to review our compliance, including for audits.

Advertising platform integrations (optional)

You can optionally connect your own Meta dataset. If you do, we send data only for customers who have consented, to your Meta dataset, via the Meta Conversions API (CAPI). Consent follows your store's Shopify customer privacy and consent settings. This integration is off by default. You can disconnect it at any time. After you disconnect it, we send no further data to Meta.

You remain the Data Controller. You are responsible for your legal basis and your consent banner. We act as your Data Processor. Meta processes the data under its own terms. Where we hash customer identifiers before sending them, we use SHA-256.

If you enable an advertising platform integration, we process event data relating to your store’s customers, including order value, currency, products purchased, event time, click identifiers (such as fbclid), browser identifiers (such as the _fbp and _fbc cookies), IP address, user agent, and hashed customer identifiers (such as email address, phone number, name, and postal address). Hashed data is pseudonymized, not anonymized, and remains personal data.

Sub-processors

We do not sell personal data we process for you. The providers below act as our sub-processors for your store's customer data:

• Shopify Inc.: Store data access via the Shopify API
• OpenAI Inc.: AI query processing (only when Shopify Sidekick integration is enabled)
• Meta Platforms Ireland Ltd: Meta Conversions API, only when you connect a Meta dataset
• Public authorities: When required by law or legal process

We give you notice before we add or replace a sub-processor. Each sub-processor is bound by a data processing agreement and must protect the data in accordance with applicable law.

International transfers

Some sub-processors are located outside the European Economic Area (EEA), including in the United States. When we transfer personal data that we process for you outside the EEA, we use appropriate safeguards, such as Standard Contractual Clauses (SCCs) approved by the European Commission.

Deletion or return

When the Service ends, we delete or return the personal data we process for you, unless the law requires us to keep it. If you uninstall Juicy, we delete that data within 30 days, unless we are required to retain it for legal, regulatory, or accounting purposes.

Audits and a signed copy

We make available the information you need to review our compliance with this DPA, including for audits. You can request a signed copy at [email protected].