Privacy Policy

Your customer CSVs are converted entirely in your browser. The file you upload never leaves your device - we have no server-side copy of it, ever. The only data we store on our servers is what we need to run your account and process payments: your email, your Stripe subscription status, and a hashed counter of how many free conversions your IP has used.

The data controller for shopifytometa.com is By Forrest Ltd, registered in England and Wales at 44, 7 Huntley Street, London, WC1E 6AJ, United Kingdom.

For privacy questions or to exercise your rights, contact Forrest Radford at hello@shopifytometa.com. We aim to respond within 30 days.

Under UK GDPR / EU GDPR Article 6, every piece of personal data we process needs a lawful basis. Here's exactly what we hold and why:

• Your email address. Provided when you sign up via magic link or when you check out via Stripe. We use it to identify your account, send you sign-in links, and link payments to entitlements. Legal basis: contract (Article 6(1)(b)) — we can't deliver the service without it.
• Your Stripe customer ID and subscription status. Stored so we know whether your Pro subscription is active, paused, cancelled, etc. Stripe also stores your full billing details (name, country, card data) — we never see card numbers. Legal basis: contract.
• Session tokens. When you sign in, we set a single signed cookie (stm_session) that maps to your email inside our Redis store. This is how we keep you logged in for 30 days. Legal basis: contract (strictly necessary to provide a logged-in service).
• Magic-link tokens. When you request a sign-in link, we generate a single-use token, store it for 15 minutes, then delete it the moment it's used (or it expires). Legal basis: contract.
• Free-tier IP counters. To enforce the 3-free-conversions limit, we increment a counter keyed to your IP address. The counter expires automatically after 30 days. We never log the IP itself in application logs and never link it to your email. Legal basis: legitimate interest (Article 6(1)(f)) — preventing abuse of the free tier.
• Conversion counters. For paid users we keep a simple count of how many conversions you've done this month. We never store anything about the contents of those conversions — just the tally. Legal basis: legitimate interest (operating the service and showing you usage stats).
• Aggregate analytics. We use Vercel Analytics, which is cookieless and reports anonymised aggregates only (e.g. "500 people visited the homepage today"). It does not identify you personally and does not use cross-site tracking. Legal basis: legitimate interest (understanding how the site is used).

• The contents of your customer CSV. Conversion runs in your browser. The file you upload never reaches our servers, is never saved to disk, is never logged, and is never transmitted to any third party.
• We don't use Google Analytics, Meta Pixel, or any advertising tracker.
• We don't sell your data to anyone, ever.
• We don't use your data to train AI or any other model.
• We don't send you marketing email unless you explicitly opt in.

These are the third parties that process data on our behalf. Each is bound by a Data Processing Agreement (DPA) and only handles data for the purpose listed.

• Vercel Inc. (USA) — hosts the website and runs Vercel Analytics (cookieless, aggregate). Privacy policy.
• Upstash Inc. (USA, EU regions available) — provides the Redis database that stores accounts, sessions, magic-link tokens, IP counters, and conversion counters. Privacy policy.
• Stripe Payments Europe Ltd (Ireland, with US affiliates) — processes payments, holds card data, manages subscriptions and the customer billing portal. PCI-DSS Level 1 compliant. Privacy policy.
• Resend, Inc. (USA) — sends transactional emails (sign-in magic links, payment receipts where applicable). Privacy policy.

Some of our processors are based in the United States. Where personal data is transferred outside the UK or EEA, we rely on the UK International Data Transfer Addendum and the EU Standard Contractual Clauses (SCCs) as the lawful transfer mechanism. All processors above have signed these where applicable.

• Account record (email, Stripe IDs, subscription state): until you ask us to delete it.
• Session token: 30 days from sign-in, then auto-deleted.
• Magic-link token: 15 minutes, or immediately on use.
• Free-tier IP counter: 30 days from first use, then auto-deleted.
• Monthly conversion counters: ~70 days, then auto-deleted.
• Stripe billing records: retained by Stripe under their own retention policy. Stripe is required to keep transaction records for several years to comply with tax and anti-money-laundering laws — this is outside our control.

You have the right to:

• Access — ask for a copy of the data we hold about you.
• Rectification — ask us to correct inaccurate data.
• Erasure ("right to be forgotten") — ask us to delete your account and the data tied to it. Note Stripe is legally required to retain some payment records.
• Portability — get a machine-readable export of the data we hold.
• Restriction or objection — limit how we process your data, including objecting to anything based on legitimate interest.
• Withdraw consent — where we rely on consent.

To exercise any of these, email hello@shopifytometa.com. We'll respond within 30 days.

You also have the right to lodge a complaint with a supervisory authority. In the UK that's the Information Commissioner's Office (ICO). If you're in the EU, you can complain to your local data protection authority.

We only set cookies that are strictly necessary to run the service. See our Cookie Policy for the full list.

If we make material changes (new processors, new categories of data, new purposes), we'll update the "Last updated" date at the top and post a notice on the homepage at least 14 days before the change takes effect.

By Forrest Ltd
44, 7 Huntley Street, London, WC1E 6AJ, United Kingdom
hello@shopifytometa.com