This page summarizes how StoreCopy approaches the EU General Data Protection Regulation (GDPR) and related UK GDPR rules. It is for transparency and does not replace legal advice or our full Privacy Policy.
Data controller (for the storecopy.com website, accounts, billing, and support):
When you use StoreCopy to migrate or sync store data, we often act as a data processor on your behalf for content taken from your connected platforms (for example products, orders, or customers). In those cases, you remain the controller for that business data and we process it only to provide the Service under our Terms of Service and, where required, a data processing agreement (DPA).
We process personal data only where a valid legal basis applies under GDPR Article 6:
| Processing activity | Typical legal basis |
|---|---|
| Creating and managing your StoreCopy account (email, password or Google sign-in) | Contract — performance of our agreement with you |
| Running migrations/sync you request; connecting Shopify, Wix, Notion, Airtable, etc. | Contract; for your store data, we act as processor on your instructions |
| Payment and invoicing (Paddle or other payment providers) | Contract and, where applicable, legal obligation (tax/accounting records) |
| Transactional email (password reset, service messages via Resend) | Contract or legitimate interests (secure account access) |
| Strictly necessary cookies (login, PIM/sync session) | Contract / essential for the Service — see Cookie Policy |
| Analytics (Google Analytics, Ahrefs) and marketing embeds (Trustpilot widget) | Consent — only after you opt in via our cookie banner |
| Security, abuse prevention, and service integrity | Legitimate interests, balanced against your rights |
| Support correspondence | Contract or legitimate interests (responding to your requests) |
If GDPR applies to you, you may have the right to:
Some rights may not apply when we process your customers’ data as your processor — in that case, direct requests to us may need to come from you as controller, or we will assist you under our DPA.
For cookie-specific choices, you can also use our on-site Cookie settings (footer) without waiting for a manual response.
Some subprocessors (listed below) may process data outside the European Economic Area (EEA), including in the United States. Where required, we rely on appropriate safeguards such as the European Commission’s Standard Contractual Clauses (SCCs) or equivalent mechanisms offered by those providers. Details are available in each provider’s documentation and Data Processing Addendum.
We use trusted third parties to host and operate the Service. They access personal data only to perform services for us:
| Provider | Purpose |
|---|---|
| Cloud / infrastructure hosting | Running servers, databases, and the storecopy.com application |
| Optional Google sign-in; optional Google Analytics (with consent) | |
| Paddle (and/or other payment processors) | Payment processing and billing |
| Resend | Transactional email delivery |
| Ahrefs | Optional analytics (with consent) |
| Trustpilot | Optional review widget (with consent) |
This list covers common subprocessors for the public website and core app. Connected ecommerce platforms (Shopify, Wix, etc.) are controlled by you; data flows between your stores and StoreCopy under your authorization.
We may update subprocessors as the Service evolves. Merchants requiring a formal Data Processing Agreement (DPA) or subprocessor list for migration processing should email [email protected] with subject “DPA request”.
If you are in the European Economic Area and believe we have not addressed your concern, you have the right to lodge a complaint with a data protection supervisory authority.
Our lead establishment is in Spain. The competent authority is:
Residents of other EU/EEA countries may also contact their local supervisory authority. UK residents may contact the Information Commissioner’s Office (ICO).
Privacy and GDPR questions: [email protected]