Privacy Policy

Effective 19 August 2026. Last updated 19 August 2026.

The short version

• We hold your email address, your first name and your store's web address, so we can run your account. We do not hold a password, and we do not hold your card details.

• Your orders reach us without any name, email address, phone number or postal address in them. There is no field for them. We could not store them if you sent them.

• We never sell your data and never use one customer's data for another. We may build anonymous aggregates across all our customers — benchmarks and trends — and nothing in them can be traced back to you.

• Our database and application run in the EU (Stockholm).

• In the app, the only cookies are the ones that keep you signed in — no analytics, no advertising, no profiling. Our website uses Google Analytics, and only if you accept it.

• You can ask us for a copy of your data, or to correct or delete it, at hello@profitscaler.io. We answer within a month and we do not charge.

The rest of this page is the detail behind those points.

1. Who we are

Profitscaler is a service operated by Nordscale Strategies AB, organisationsnummer 559525-5562, VAT number SE559525556201, with its registered office in Enköping, Sweden. We will give you the full registered address on request.

For anything on this page, including any of the rights in section 9, write to hello@profitscaler.io.

We have not appointed a Data Protection Officer. We are not required to.

2. Two different relationships, and they are not the same

This matters more than it looks, so it comes before the detail.

For your own details, we are the controller. Your email address, your name, your store's web address — we decide what happens to those, and this page governs them. Sections 3 to 12 are about this.

For your customers' orders, we are a processor working for you. An order that reaches us is data about a person who bought something from your shop. That is your data about your customer, not our data about them. You decide what is collected and why; we only act on your instructions. The terms for it are the data processing annex to our Terms of Use, at profitscaler.io/terms.

If you are one of our customers' customers and want to know how your order data is handled, the shop you bought from is the right place to ask.

3. What we collect about you, and why

When you sign up

We do not ask for a password. Signing in is by a link sent to your email address, or through your Google account, so there is no password for us to hold or lose.

We do not receive your card details. Those go to our payment provider — see section 7.

While you use the service

The legal bases, for anyone who needs them

Most of the above is processed because it is necessary to provide the service you asked for (GDPR Article 6(1)(b)). The marketing tick is consent (Article 6(1)(a)). The signup IP address, the change record and the technical logs rest on our legitimate interests (Article 6(1)(f)) — keeping a public form usable, and keeping an accurate audit of a system that reports money. You can object to anything in that last group; see section 9.

4. The IP address, specifically

Our signup form is open to anyone. Every valid submission sends an email, and our email allowance is shared across the whole service — so a flood of automated signups would stop sign-in links reaching the people already using Profitscaler. To prevent that, we count submissions per source address.

Our interest is keeping the service available to the people already using it, and preventing abuse of a public form. We name the interest because "legitimate interests" on its own tells you nothing.

In practice: we store one IP address and a counter, for two days. It is never linked to the account that was created, never used to build a profile, never used to decide anything about you beyond "has this address submitted this form too many times in the last hour", and never shared with anyone.

You have the right to object to this. See section 9.

5. Email we send you

Service email is part of the service. Sign-in links, a notice that your feed failed to sync, a warning that you are close to the end of your free orders. We send these whether or not you agreed to marketing, because without them the service does not work.

Marketing email is separate and optional. The box on our signup form is unticked by default, and your account is created whether you tick it or not. Every marketing email has an unsubscribe link. Unsubscribing does not stop service email about your own account.

We keep a record of the exact wording you were shown, its version, and what you chose. If you withdraw consent, we add a record of the withdrawal rather than deleting the original — section 6 explains why.

6. How long we keep things

These are the actual periods. They are enforced by scheduled jobs, not by intention.

Why consent records are kept indefinitely. A consent record exists to show that a particular person was shown particular wording and made a particular choice. Deleting it after a while would destroy the only evidence that the email we sent was email you agreed to — the record has to outlive the consent to be worth having. So withdrawing consent adds a record of the withdrawal next to the original, and we stop sending marketing email.

7. Who else sees your data

We use the providers below. None of them may use your data for their own purposes.

Reporting tools you connect yourself are not on this list, and that is not an oversight. The service can publish your reporting data as a file at a private URL. You give that URL to whatever reporting or BI tool you already use, and your tool fetches the file — we do not send it anywhere. Whoever you point at that URL is your supplier, not ours, and what they do with the data is between you and them. The same goes for the product feed you point Google Merchant Center at.

Transfers outside the EU/EEA. Our database and our application are in the EU. Some of the providers above are US companies, and the data they receive is processed in the United States. Those transfers rely on the European Commission's adequacy decision for the EU–US Data Privacy Framework where the provider is certified under it, and on Standard Contractual Clauses where it is not. Ask us at hello@profitscaler.io which applies to a particular provider and we will tell you.

If we change this list, we will tell account holders.

8. Cookies

In the app

The application at app.profitscaler.io sets cookies that are strictly necessary to sign you in and keep you signed in. There is no analytics cookie, no advertising cookie and no profiling cookie anywhere in it. That is why you have never seen a cookie banner there: there is nothing to consent to.

On our website

profitscaler.io uses Google Analytics 4, loaded through Google Tag Manager, to count visits and see which pages get read. It sets cookies that are not strictly necessary, so it runs only if you accept it in the banner shown on your first visit. Decline and it does not load — the site works either way, and nothing about you is collected.

The choice is stored on your device. Clearing your cookies brings the question back.

That is the whole of it: no advertising cookies, no session recording, and nothing that follows you to other sites.

The IP address in section 4 is not a cookie

It is read from the network request itself. It is not stored on your device and not read from it, so none of the rules about cookies apply to it.

Cookies on your own shop's website

Those are yours, not ours. The site that sends us orders is your site, under your own cookie notice. That includes the optional session tag we supply: it records where a visit came from, storing that on your domain as a first-party cookie and a matching entry in the browser's local storage. Our setup instructions tell you to declare it to your consent tool like any other analytics tag. Whether it runs at all is your decision as the site's operator.

The tag is a small file your visitors' browsers load from us, which is how we can improve it without asking you to change anything. Serving a file means receiving the request for it, so a visitor's IP address and browser version reach our delivery network in passing, exactly as they would for a hosted font or script. We do not store them, attach them to an order, or use them for anything. The tag itself sends us nothing about the visit.

9. Your rights

You can ask us to:

• give you a copy of the personal data we hold about you;

• correct anything that is wrong;

• delete it;

• pause what we do with it while a question is being sorted out;

• give it to you in a portable format, or send it to someone else;

• stop processing that rests on our legitimate interests — this is the right to object, and it covers the IP address in section 4 and the change record and logs in section 3;

• withdraw consent to marketing email at any time, through the unsubscribe link in any marketing email or by writing to us. Withdrawing does not affect anything already sent, and does not stop service email.

Write to hello@profitscaler.io. We answer within one month, and there is no charge.

If you are unhappy with how we have handled your data, you can complain to the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY — imy.se), or to the supervisory authority in the EU or EEA country where you live or work. In the United Kingdom that is the Information Commissioner's Office (ico.org.uk); in Switzerland, the Federal Data Protection and Information Commissioner. We would rather you raised it with us first, but you do not have to.

10. Security

Each account's data is separated at the database level, so one customer's data cannot be read by another. Our own access above that boundary is limited, and every change made that way is recorded against the person who made it. Sign-in is by emailed link or Google account, so there are no passwords to steal. Data is encrypted in transit and at rest.

No system is perfectly secure and we will not claim ours is. If you think you have found a vulnerability, tell us at hello@profitscaler.io and we will look at it. We would much rather hear it from you.

11. Automated decisions

We do not make decisions about you by automated means that have legal or similarly significant effects.

The service calculates profit figures and can send them to Google Ads as conversion values, which may in turn affect how Google's bidding behaves. That is a calculation about your orders, run at your instruction and under your control. It is not a decision about a person.

12. Changes to this page

If we change this page we will update the date at the top. If a change materially affects how we use your personal data, we will tell account holders by email rather than relying on you noticing.