Privacy Policy

The converter is free and needs no account. Your customer CSV is converted entirely in your browser — the file never leaves your device and we have no copy of it, ever. The only things that reach our servers are an anonymous "a conversion happened" ping for the public counter, any reviews or feedback you choose to send, and standard website analytics (described below).

The data controller for shopifytometa.com is By Forrest Ltd, registered in England and Wales at 44, 7 Huntley Street, London, WC1E 6AJ, United Kingdom.

For privacy questions or to exercise your rights, contact Forrest Radford at hello@shopifytometa.com. We aim to respond within 30 days.

Under UK GDPR / EU GDPR Article 6, every piece of personal data we process needs a lawful basis. Here's exactly what we hold and why:

• Anonymous conversion count. When a conversion finishes, your browser sends a ping with no file contents and no personal data. We add it to the site-wide total shown on the homepage. Legal basis: legitimate interest (Article 6(1)(f)) — showing how the tool is used.
• Short-lived fair-use counters. To stop scripted abuse of the counter and the feedback form, we keep a counter keyed to your IP address that deletes itself after 24 hours. It is never linked to anything else you send us. Legal basis: legitimate interest — preventing abuse.
• Reviews and feedback you send. If you submit a review or a feature request / bug report, we store what you write and, only if you choose to provide it, your email so we can reply. Legal basis: consent (Article 6(1)(a)) — you choose to send it, and can ask us to delete it at any time.
• Website analytics. We use Vercel Analytics (cookieless, anonymous aggregates), Google Analytics 4 (page views and how visitors use the site) and the Meta Pixel (measuring visits from our own Meta ads). Google and Meta may set cookies and receive technical data such as your IP address and browser details. They never receive your CSV or its contents. Legal basis: legitimate interest for Vercel Analytics; consent for Google Analytics and the Meta Pixel.
• Admin sign-in. Only site administrators can sign in, to moderate reviews and read feedback. Visitors never need an account.

• The contents of your customer CSV. Conversion runs in your browser. The file you select never reaches our servers, is never saved, is never logged, and is never sent to any third party — including Google and Meta.
• We don't ask for or store payment details.
• We don't sell your data to anyone, ever.
• We don't use your data to train AI or any other model.
• We don't send you marketing email unless you explicitly opt in.

These are the third parties that process data on our behalf. Each is bound by a Data Processing Agreement (DPA) and only handles data for the purpose listed.

• Vercel Inc. (USA) — hosts the website and runs Vercel Analytics (cookieless, aggregate). Privacy policy.
• Upstash Inc. (USA, EU regions available) — provides the Redis database that stores the conversion total, fair-use counters, reviews, feedback, and admin sign-in sessions. Privacy policy.
• Google LLC / Google Ireland Ltd — Google Analytics 4 website analytics. Privacy policy.
• Meta Platforms Ireland Ltd — the Meta Pixel, used to measure visits from our own Meta ads. Privacy policy.
• Resend, Inc. (USA) — sends admin sign-in emails only. Privacy policy.

Some of our processors are based in the United States. Where personal data is transferred outside the UK or EEA, we rely on the UK International Data Transfer Addendum and the EU Standard Contractual Clauses (SCCs) as the lawful transfer mechanism. All processors above have signed these where applicable.

• Your CSV: never received, so never stored.
• Fair-use IP counters: 24 hours, then auto-deleted.
• Reviews and feedback (and any email you added): until we've dealt with it or you ask us to delete it.
• Admin sign-in sessions: 30 days, then auto-deleted.
• Google Analytics and Meta Pixel data: retained by Google and Meta under their own policies.
• Records from the previous paid plan: if you ever paid us, Stripe keeps transaction records for several years to meet tax and anti-money-laundering laws. This is outside our control.

You have the right to:

• Access — ask for a copy of the data we hold about you.
• Rectification — ask us to correct inaccurate data.
• Erasure ("right to be forgotten")— ask us to delete any review, feedback or email you've sent us.
• Portability — get a machine-readable export of the data we hold.
• Restriction or objection — limit how we process your data, including objecting to anything based on legitimate interest.
• Withdraw consent — where we rely on consent.

To exercise any of these, email hello@shopifytometa.com. We'll respond within 30 days.

You also have the right to lodge a complaint with a supervisory authority. In the UK that's the Information Commissioner's Office (ICO). If you're in the EU, you can complain to your local data protection authority.

We only set cookies that are strictly necessary to run the service. See our Cookie Policy for the full list.

If we make material changes (new processors, new categories of data, new purposes), we'll update the "Last updated" date at the top and post a notice on the homepage at least 14 days before the change takes effect.

By Forrest Ltd
44, 7 Huntley Street, London, WC1E 6AJ, United Kingdom
hello@shopifytometa.com