Privacy Policy

1. Information We Collect

Shop information. When you install Culprit we receive your Shopify store domain, a short-lived access token used to communicate with the Shopify Admin API, and billing status information.

Storefront telemetry. Culprit injects a small JavaScript pixel into your storefront. This pixel captures anonymous technical error events — such as failed cart additions, empty shipping rate responses, and JavaScript exceptions — and sends them to our servers. These events contain no personally identifiable information about your customers. They do not include names, email addresses, payment details, or any other customer data.

Billing information. Subscription billing is handled entirely by Shopify through the Shopify Billing API. We do not collect or store credit card numbers or payment details.

2. How We Use Information

• To detect and surface silent storefront failures in your Culprit dashboard
• To trigger alert notifications you have configured (email or Slack)
• To verify your active subscription status
• To maintain the security and integrity of the service

We do not sell, rent, or share your information with third parties for marketing purposes.

3. Data Storage and Security

Your shop data and telemetry events are stored in Supabase, a managed PostgreSQL database service. Data is encrypted at rest and in transit. Access to the database is restricted to the Culprit backend service using service-level credentials that are never exposed to the public.

Shopify access tokens are stored securely and used solely to register the monitoring pixel and verify billing status. Tokens are invalidated and removed when you uninstall the app.

4. Data Retention

Telemetry event data is retained while your account is active. If you uninstall Culprit, your store data and credentials are immediately cleared. All remaining shop data is permanently deleted within 48 hours of uninstallation in accordance with Shopify's GDPR requirements.

5. Third-Party Services

• Shopify — app installation, OAuth authentication, and billing
• Supabase — database hosting and storage
• Render — backend API hosting
• Vercel — frontend dashboard hosting

Each third party operates under its own privacy policy and data protection standards.

6. GDPR and Your Rights

If you are subject to the General Data Protection Regulation (GDPR), you have the right to access, correct, or request deletion of data we hold about your store. Because Culprit captures only anonymous technical events and no customer personal data, there is no customer personally identifiable information to export or delete.

To request deletion of your store data, uninstall the app from your Shopify admin. All data is permanently removed within 48 hours. For any additional requests, contact us at the address below.

7. Changes to This Policy

We may update this policy from time to time. Material changes will be communicated through the app or by email. Continued use of Culprit after changes take effect constitutes acceptance of the updated policy.

8. Contact

Questions about this Privacy Policy can be directed to: cleu2012@gmail.com