Skip to content

Privacy policy

Updated: 25 October 2026

This English text is a courtesy translation. The German version is the authoritative one; if the two differ, the German version applies.

1. Controller

The controller within the meaning of the GDPR is:
NorthProfit UG (haftungsbeschränkt) · Waldnieler Straße 28, 40549 Düsseldorf, Deutschland · kontakt@northprofit.eu

VAT identification number (Sec. 27a UStG): DE463502947. Register court: Amtsgericht Düsseldorf, HRB 113494.

Please direct data protection requests to kontakt@northprofit.eu.

2. Which data we process

NorthProfit processes the following categories of data when you use the service:

  • Order and refund data from the respectively available and connected sales channels: order numbers, amounts, destination countries and, where applicable, customer master data
  • Product and variant data such as SKUs and purchase costs
  • Store configuration data such as domain and encrypted API tokens
  • Payment and transaction data from connected payment services (e.g. PayPal, Stripe, Mollie) where connected
  • Advertising and performance data from connected ad accounts (Meta, Google, TikTok) where connected
  • Invoicing and accounting data including customer and receipt data contained therein (invoices, dunning, OSS reports, DATEV exports)
  • Access/client data from the optional tax advisor collaboration
  • Tracking events from optionally enabled server-side conversion tracking (see section 8)
  • Attribution record per order (for every paid order of a shop with an active web pixel: details of the order and, only with the end customer's consent in the pixel, a contact path with time, source, campaign and ad IDs; without IP address, user agent and visitor identifier; see section 8)
  • User/account data such as email and credentials during authentication
  • Sign in with Google: If you sign in or register with Google, we receive your email address, its verification status and your name from Google. We only request the ‘openid’, ‘email’ and ‘profile’ permissions, do not store any further Google profile data and do not access any other Google data.
  • Bot protection for sign-in, registration, password reset, newsletter and tax advisor registration: We use ALTCHA, a self-hosted proof-of-work challenge. It sets no cookies and uses no services outside our own infrastructure. A solution can only be used once; for this we briefly store a technical identifier in our database.
  • Details from contact, newsletter, lead, early-access and support requests (see section 2a)
  • Questions and required metric/answer context when using North AI, and merchant-selected or edited questions, locally selected brand/competitor terms, provider, requested model and provider-reported model where available, truncated response and match excerpts, detected text matches and check time of requested AI visibility checks

2a. Contact, newsletter and enquiries

Contact form: If you write to us via the contact form, we process your name, email address, an optional subject and your message and forward them by email (sent via Resend) to kontakt@northprofit.eu to answer your enquiry (Art. 6(1)(b) or (f) GDPR).

Lead, demo and early-access forms: If you fill in such a form, we store your details in our database (email address, name, and where provided company, shop address, revenue band, shop platform, tool currently used, message and language) as well as technical metadata of the request (referring page, origin, user agent) to handle your enquiry and get back to you (Art. 6(1)(b) or (f) GDPR).

Newsletter: We use the double opt-in procedure. We first store your email address with language and technical metadata (referring page, user agent) as unconfirmed and send you a confirmation email via Resend; you only receive the newsletter after clicking the confirmation link (Art. 6(1)(a) GDPR). Every sign-up is protected against abuse by ALTCHA (see section 2). You can unsubscribe at any time via the unsubscribe link in our emails or informally by email to kontakt@northprofit.eu.

Support requests from within the product: We process the subject and message of your ticket and its assignment to your account to handle your request (Art. 6(1)(b) GDPR).

We store these details as long as necessary for handling and any follow-up questions, and the newsletter sign-up until you unsubscribe.

3. Source of data and data subjects

Some data does not come directly from you but from the systems you connect (e.g. order and customer data from your shop, advertising data from your ad accounts). Data subjects are in particular: you and your staff as users, your shop's end customers/buyers, website/advertising contacts where the web pixel is active, and, where applicable, your tax advisors.

Where we do not collect personal data from the data subjects themselves, we process it on behalf of and on the instructions of the respective shop operator as a processor (see DPA at /avv). The obligation to inform end customers under Art. 14 GDPR lies with the responsible shop operator.

4. Purpose of processing

We process this data for the following purposes:

  • Calculating and displaying profit/loss and marketing metrics across all connected sales channels
  • Preparing EU VAT/OSS reports and DATEV-compatible accounting data
  • Creating invoices, credit notes and dunning
  • Synchronising tracking/shipment data with payment and advertising services
  • Providing, operating, securing and improving the service

5. Legal basis

Depending on the purpose, processing is based on the following legal grounds:

  • Art. 6(1)(b) GDPR (contract performance) — provision of the agreed features
  • Art. 6(1)(f) GDPR (legitimate interest) — secure operation, strictly necessary cookies, error/abuse prevention (including bot protection)
  • Art. 6(1)(a) GDPR (consent) — all consent-based processing, in particular web analytics (Google Analytics 4) and optional server-side conversion tracking and ad synchronisation (Meta, Google, TikTok)
  • Art. 6(1)(c) GDPR (legal obligation) — statutory retention of our own business records subject to retention requirements (Sec. 147 AO, Sec. 257 HGB), see section 11

6. Data location and security

The platform's core data (order, product and accounting data) is stored in Germany in the NorthProfit data platform.

Transmission happens exclusively over encrypted HTTPS connections. API secrets and access tokens are stored encrypted (AES-256) and are never transmitted in plain text.

We use Resend for requested system emails; message content and delivery information may be processed and stored in the USA, even when sent from an EU region. Connected advertising services, explicitly used AI features and consent-based web analytics may also process data outside the EU. Purposes and recipients are described in sections 7, 9 and 13.

7. Transfers to third countries

Personal data may be processed in third countries for necessary services such as delivery of requested system emails through Resend. This does not require an optional advertising or AI integration switch. Voluntarily connected advertising services and explicitly used AI features serve the respective requested purpose; web analytics and consent-based conversion tracking require the necessary consent.

Third-country transfers are subject to Art. 44 et seq. GDPR. Depending on the provider and transfer, mechanisms include EU Standard Contractual Clauses (SCC), an applicable adequacy decision and, for certified US recipients, the EU-US Data Privacy Framework. Shopify describes binding corporate rules (BCR), adequacy decisions and other safeguards for its international transfers. An EU contracting party or sending region does not mean that all processing takes place in the EU.

A residual risk of access by third-country authorities cannot be entirely excluded. Section 13 lists service providers and connected merchant platforms and payment, advertising and email services as data sources or recipients. A connected platform's role depends on the processing activity and its contracts with the merchant; this does not automatically make it a NorthProfit sub-processor. Stripe serves our own subscription billing here. Sub-processors used on the merchant's behalf and their specific purposes are listed separately in section 6 of the DPA at /avv.

8. Cookies and tracking

Strictly necessary cookies: We use session cookies required for authentication and secure operation. These are consent-free under Sec. 25(2) TDDDG (formerly TTDSG); the legal basis is Art. 6(1)(f) GDPR.

Consent storage: We store your cookie decision in the cookie ‘northprofit_consent_v1’ (lifetime 12 months) and in an entry in your browser's local storage (localStorage); it contains only your decision, your selection per category and the time. This storage is strictly necessary (Sec. 25(2) TDDDG; Art. 6(1)(f) GDPR).

Web analytics (Google Analytics 4): On our website and in the signed-in area, Google Analytics 4 is provided for in consent mode. It is currently not set up on our side, so no data is transmitted to Google Analytics. Should we set it up, access to your device and processing will only take place AFTER your consent via our cookie banner (Sec. 25(1) TDDDG, Art. 6(1)(a) GDPR). Advertising features (ad storage, user data sharing, personalisation) are always disabled. Without consent, no analytics/marketing cookies are set.

Optional server-side conversion tracking (product feature): If you as a shop operator enable the conversions/events interfaces to Meta, Google or TikTok, NorthProfit transmits events from your shop (e.g. page view, cart, checkout, purchase, refund) server-side to the advertising platform you have connected. Only events of end customers who have consented to sharing for marketing purposes are transmitted; without consent, or where the consent status is unknown, no data is sent to advertising platforms. Consent originates from the NorthProfit web pixel, which runs in your shop and reads the end customer's decision from Shopify's privacy settings (customer consent). The pixel only operates where analytics, marketing and data sharing are permitted; before consent it reads no cookies, no browser storage, no page addresses with click identifiers and no Shopify client identifier. A refusal or withdrawal is reported to NorthProfit only as a control signal without attribution or customer data.

Data transmitted in server-side conversion tracking: Depending on the platform, the following may be transmitted: email address and phone number only as SHA-256 hash (for Meta additionally first name, last name, city, state, postal code and country, likewise only as SHA-256 hash), customer and visitor identifiers as SHA-256 hash. Not hashed are order number, currency and conversion value, the address of the page visited and the referrer; for Meta and TikTok also the end customer's IP address and user agent, advertising-platform click and cookie identifiers (e.g. fbclid, fbp, fbc, ttclid, ttp) and the cart items (product number, quantity, price); for Google click identifiers (gclid, gbraid, wbraid) and the user agent. We hold the end customer's IP address in full length only for as long as delivery needs it: in the inbox of the Shopify webhook until it has been processed or the retries have expired, and in the delivery queue until the event has been delivered, all attempts have expired or the row is closed after 7 days at the latest; afterwards it is cleared there. In new event data we store it only truncated (IPv4 to /24, IPv6 to /48), in new order data not at all. Entries stored earlier may still contain the full address. We do not send a truncated address to Meta or TikTok. By default the conversion value is the gross revenue of the order. If you switch it to ‘profit’, we transmit the calculated contribution margin of the order; negative values are sent as 0. The respective shop operator is responsible for obtaining end-customer consent and informing end customers.

Optional Klaviyo events: If you connect Klaviyo and enable events, we transmit purchase and refund events together with the email address in plain text to Klaviyo where the end customer has given marketing consent, because Klaviyo needs it to match the profile. Until delivery, the email address is held encrypted (AES-256-GCM) in our outbox.

Advertising contact in the NorthProfit web pixel: after the end customer has consented, the pixel stores only the most recent advertising contact in the browser storage of the Shopify pixel sandbox (entry “northprofit_attribution_v3”): UTM values, click IDs (fbclid, gclid, ttclid, gbraid, wbraid) and campaign, ad set and ad IDs, each with the time of the landing. The entry is valid for no more than 90 days and is deleted when consent is withdrawn; remnants of earlier versions (“northprofit_attribution_v1” and “_v2”) are not carried over but deleted. Without consent the pixel neither reads nor writes anything for this.

Attribution record per order: for every paid order of a shop with an active NorthProfit web pixel, NorthProfit stores, on behalf of the merchant, a record that reports such as attribution, campaign, UTM and customer-journey analysis calculate with. It is created for every such order, even where the end customer has not consented in the pixel. Without consent it contains no contact path from the pixel but only details that the order itself carries: order number, time of purchase, purchase value and, where the landing or referring address of the order contains them, click IDs (fbclid, gclid, ttclid); the origin of the record is then “details of the order” or “no source”. With the end customer's consent in the pixel (which is a precondition for the pixel to send events), the contact path is added: up to 20 contacts with time (click or landing), channel, source and medium, campaign (name and ID), ad set and ad ID and the type and value of the click ID (origin: pixel). Not stored are the IP address, user agent, visitor or session identifier and device characteristics; the referring page is kept only as a class, not as an address. The purpose is to evaluate advertising effectiveness for the merchant. The legal basis, on the part of the merchant as controller, is for the details of the order itself the legitimate interest in measuring its advertising effectiveness (Art. 6(1)(f) GDPR) or, where they belong to the performance of the purchase contract, the contract (Art. 6(1)(b) GDPR); for the contact path from the pixel it is the end customer's consent (Art. 6(1)(a) GDPR, section 25(1) TDDDG). The shop operator is responsible for the legal basis and for informing end customers. The record is stored for as long as the order data it belongs to and is deleted with them: by deletion orders concerning an end customer or shop (section 11).

Identifier-free operational counters: NorthProfit Mobile builds explicitly configured for production and the signed-in NorthProfit web dashboard may send separate counters for app launch, foreground return, an analytics choice, and the start and successful completion of fixed essential flows to our STRATO infrastructure. Each request contains only the contract version, a one-time request id, app id, production channel, platform, app version, build and event type; no user, installation, session, advertising, device, shop or account id and no financial or content data. Without analytics consent, the device does not retain a durable event queue for these counters; each counter is transmitted directly with no more than one immediate retry. The server immediately aggregates by day and deletes the deduplication hash after eight days. This cannot measure unique users, sessions, retention or user journeys. The purpose and legal basis are the data-minimising verification of technically functioning releases and essential flows (Art. 6(1)(f) GDPR); it is not used for advertising, profiling or cross-app tracking.

First-party product analytics in the signed-in NorthProfit dashboard: Only after analytics consent, the browser creates random installation and session identifiers scoped solely to NorthProfit. We measure app starts, active session duration through minute heartbeats, and visits to a fixed allow-list of dashboard areas. Shop, account, user, order, customer, financial and free-text data are excluded from these events. A new session starts after five minutes away. Raw events are normally retained on our STRATO infrastructure for 180 days and may be configured shorter. On withdrawal, events associated with the random identifier are deleted using a deletion proof held only on the device. The legal bases are consent under Art. 6(1)(a) GDPR and Sec. 25(1) TDDDG.

You can withdraw or adjust your consent at any time with effect for the future via the 'Cookies' button in the footer.

9. AI-assisted features (North AI and AI visibility)

North AI answers the questions you ask. When you use it, your question and the required metric and answer context are sent to OpenAI Ireland Ltd. to refine the response.

When you start an AI visibility check, NorthProfit sends merchant-selected or edited questions to OpenAI Ireland Ltd. The locally selected brand/competitor terms are not automatically appended to the questions. NorthProfit stores the questions, locally selected terms, provider, requested model and provider-reported model where available, truncated response and match excerpts, detected text matches and check time as a history. The result refers exclusively to these responses by the respective model to your questions.

Visibility measurement: When you explicitly start visibility measurement, we send the questions (search terms) you selected or edited, as well as the chosen location and language, to the measurement provider DataForSEO and receive search result or answer data in return. The questions are free text: please do not enter personal data of third parties. We store questions, measurement runs, evaluated matches and the cost per measurement run as a history. Without your explicit start, no data is transmitted to DataForSEO.

The legal basis is Art. 6(1)(b) GDPR (contract performance) or Art. 6(1)(f) GDPR (legitimate interest in a helpful assistant). Where personal data is processed on the merchant's behalf, the DPA's instructions and purposes apply. AI output may contain errors and does not constitute tax or legal advice. Training and the different forms of storage are explained in section 11.

10. Your rights

You have the right to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection (Art. 21).

Where processing is based on consent, you may withdraw it at any time with effect for the future (Art. 7(3) GDPR); the lawfulness of processing carried out before the withdrawal remains unaffected.

To exercise your rights, contact kontakt@northprofit.eu. You also have the right to lodge a complaint with a supervisory authority. The authority competent for us is the State Commissioner for Data Protection and Freedom of Information North Rhine-Westphalia (LDI NRW), Kavalleriestraße 2–4, 40213 Düsseldorf, www.ldi.nrw.de.

11. Retention periods

We store personal data only for as long as necessary for the respective purposes:

Statutory periods for business records apply to NorthProfit's own records subject to retention requirements, only where relevant to our own legal obligations. They do not justify blanket retention of all merchant data.

Personal data processed on the merchant's behalf is subject to the DPA at /avv. For Shopify merchant data, including all copies, it requires deletion no later than 30 days from the respective trigger specified there. Its statutory exception is limited to specifically affected data and the legally necessary duration; periods for our own records do not extend this deletion deadline across the board.

Legal archive for finalised accounting data on the merchant's behalf: Invoices that you created and finalised through NorthProfit, including the customer data they contain, related payments, reminders, document versions and change logs, as well as accounting records you archived (e.g. DATEV exports, received receipts and incoming invoices), remain in a separate, access-restricted legal archive after an uninstall or a deletion request for as long as the statutory retention period runs. It is generally 8 years for invoices and other accounting vouchers (including voucher bundles and received invoices) (Sec. 147(3) and (4) AO, Sec. 257(4) and (5) HGB, for invoices also Sec. 14b UStG) and 10 years for DATEV posting batches and exports insofar as they are books or records (Sec. 147(3) and (4) AO, Sec. 257(4) and (5) HGB), in each case from the end of the calendar year in which the voucher arose or the posting period ends (in case of later entries: the last entry is made). Related payment, reminder, document, goods receipt and stock data and change logs remain for as long as the voucher they belong to. Orders to which a finalised invoice refers remain only as a reference without customer data, addresses and raw data; the customer data is contained in the invoice. We keep the archive on the merchant's behalf and instructions, the merchant being the controller subject to this obligation, and use it only for this purpose. After the period ends we delete this data unless a statutory extension applies (e.g. a tax assessment period that is still open or an audit in progress). Before uninstalling, the merchant can secure their invoices and records via the service's export functions. All other merchant data is deleted after the DPA's 30-day period.

  • NorthProfit's own invoices and payment records insofar as they are accounting vouchers: generally 8 years from the end of the year in which they arose (Sec. 147(3) and (4) AO, Sec. 257(4) and (5) HGB)
  • Our own books, inventories, opening balance sheets, annual financial statements, management reports and organisational documents required to understand them: 10 years from the end of the relevant calendar year (Sec. 147(3) and (4) AO, Sec. 257(4) and (5) HGB)
  • Our own commercial/business correspondence and other tax-relevant documents: generally 6 years; statutory extensions, in particular for open tax assessment periods or audits, remain unaffected
  • User/account data: until the end of the business relationship, then deletion subject to statutory retention periods
  • Model training: We do not release AI inputs and responses for model training. OpenAI does not use API data for training by default. This does not mean that no data is stored.
  • AI data at NorthProfit: Responses may be cached to provide the service. AI visibility results remain stored as a history. These stores are also subject to their respective purposes and the DPA's deletion obligations where the data is processed on the merchant's behalf.
  • Response storage and technical caching at the AI provider: OpenAI's additional response storage is disabled for AI visibility checks. This does not automatically end technical caching or security logs. For supported models, OpenAI may retain a technical prompt cache for up to 24 hours.
  • Further retention at the AI provider: OpenAI normally stores abuse monitoring logs for up to 30 days. Different service or contractual terms, legal obligations and safety cases may require longer retention, particularly for usage policy violations. This does not promise immediate deletion of all provider and NorthProfit copies after a response.
  • Raw events of the NorthProfit web pixel and outbox for Klaviyo events: currently without a fixed automatic deletion period, they are deleted with a deletion order (e.g. concerning an end customer or shop); the IP address in them is stored only truncated for new entries; deletion orders (e.g. concerning an end customer) are carried out independently of this.
  • Attribution record per order (contact path of the order): for as long as the related order data; it is deleted with them (deletion order concerning an end customer or shop), independently of the raw events of the web pixel.
  • Technical abuse prevention (rate limiting and ALTCHA replay block): until the respective time window expires; expired entries are deleted daily.
  • Identifier-free mobile operational counters: deduplication hashes for no more than 8 days; non-linkable daily aggregates remain for operational trend comparison
  • Consent-based first-party product analytics: raw events normally for 180 days or until earlier verifiable withdrawal; aggregate trends that can no longer be linked to the random identifier may remain
  • Other tracking/analytics data: in line with the purpose or the consent given, then deletion/anonymisation

12. Necessity of provision and automated decisions

Providing certain data is necessary to perform the contract (use of the service); without it, the service cannot be provided or only to a limited extent. Optional integrations are voluntary.

No solely automated decision-making with legal or similarly significant effect within the meaning of Art. 22 GDPR takes place; the metrics shown serve solely for your information.

13. Recipients and service providers

  • STRATO AG: Application + database hosting (Germany (EU))
  • Hetzner Online GmbH: Storage of the daily database backups, encrypted before upload (offsite backup) (Germany (EU))
  • Shopify International Limited / regional Shopify contracting party: Connected merchant platform and data source (orders, customers). For a billing address in Europe, the contracting party is Shopify International Limited in Ireland; other merchant regions have their respective regional Shopify contracting parties. (Ireland; e.g. Canada/Singapore)
  • Stripe Payments Europe Ltd.: Billing for subscriptions concluded directly with NorthProfit; the data protection role depends on the payment activity and Stripe's contractual terms (EU (Ireland) + USA (SCC))
  • PayPal (Europe) S.à r.l.: Payment/tracking synchronisation (optional) (EU (Luxembourg) + USA (SCC))
  • Mollie B.V.: Payment processing/synchronisation (optional, per shop) (EU (Netherlands))
  • Klarna Bank AB (publ) or the Klarna contracting party responsible for your Klarna region: Reading the settlement data of your own Klarna merchant account (optional, per shop; access with your own credentials, which we store encrypted) (Sweden (EU); depending on the selected Klarna region (Europe, North America, Oceania), the Klarna region concerned)
  • Plus Five Five, Inc. (Resend): Delivery of necessary system emails and emails initiated by the merchant (e.g. invoices, payment reminders and dunning notices to its customers, confirmations) and of the data export requested by Shopify to the merchant; the recipients' email address, name and postal address and the message content (e.g. the invoice document) are processed (USA (SCC; DPF in addition))
  • Meta Platforms Ireland Ltd.: Conversions API + ad sync (optional, only with the end customer's consent); transmitted are, among others, hashed email address and phone number, IP address, user agent, click and cookie identifiers, order number and conversion value (details in section 8) (EU (Ireland) + USA (SCC/DPF))
  • Google Ireland Ltd.: Google Analytics 4 (own website, consent-based; currently not set up), sign in with Google (optional) and Google Ads/GA4 sync, conversions (optional, only with the end customer's consent; among others hashed email address, click identifiers, user agent, order number and conversion value, details in section 8) (EU (Ireland) + USA (SCC/DPF))
  • TikTok Technology Ltd.: Events API + ad sync (optional, only with the end customer's consent); transmitted are, among others, hashed email address and phone number, IP address, user agent, click and cookie identifiers, order number and conversion value (details in section 8) (EU (Ireland) + USA (SCC))
  • Klaviyo, Inc.: Retention/email forwarding (optional, per shop): purchase and refund events with the email address in plain text, which Klaviyo needs to match the profile; only with the end customer's marketing consent (USA (SCC/DPF))
  • Recharge, Inc.: Subscription analytics (optional, per shop) (USA (SCC))
  • OpenAI Ireland Ltd.: Refinement of North AI answers and explicitly started AI visibility checks (EU (Ireland) + USA (SCC))
  • DataForSEO (provider of the measurement data for visibility measurement): Visibility measurement in search engines and AI answers (only after an explicit start): the selected questions (search terms) as well as location and language are transmitted (Registered office: DataForSEO OÜ, Tallinn, Estonia (EU); basis: Processing on our behalf under Art. 28 GDPR based on DataForSEO's data processing agreement (part of its terms of service, version of 12 June 2026). The provider is established in the EU. For sub-processors outside the EU, for example in the USA, DataForSEO states that it relies on standard contractual clauses (Implementing Decision (EU) 2021/914) or adequacy decisions.)

Further services connected by the merchant: If you connect further sales, marketplace, payment, advertising or marketing services to NorthProfit (depending on availability, e.g. eBay, Amazon, WooCommerce, Shopware, TikTok Shop and the email marketing services Brevo, Mailchimp, ActiveCampaign, Campaign Monitor, MailerLite, Omnisend, Iterable, Drip and Kit), we read the data required from these services with your credentials or transmit to them only the data you have enabled. You select these services yourself; their role depends on the processing activity and your contracts with the provider. They do not automatically become sub-processors of NorthProfit (see section 7 and DPA section 6).

← ← Back to website · Legal notice