Privacy Policy | ShopGPT Pro

Issuing Entity: ShopGPT · Effective Date: December 17th, 2025 · Version: 1.0

1. Preamble and Scope of Applicability

ShopGPT ("Company") provides the ShopGPT platform, APIs, and associated digital services. This Privacy Policy constitutes a legal statement regarding collection, processing, usage, and security of Personal Data for users of the Services.

The Policy complies with global data protection standards including:

United States: CCPA/CPRA and applicable federal standards
UK & EU: UK Data Protection Act 2018 and GDPR
Pakistan: Prevention of Electronic Crimes Act (PECA) 2016

By accessing the Services, you acknowledge these practices.

2. Definitions and Interpretation

Personal Data: Information relating to an identified or identifiable natural person
Data Controller: Entity determining purposes and means of processing
Data Processor: Entity processing data on behalf of the Controller
Processing: Any operation performed on Personal Data (collection, recording, storage, etc.)

3. Data Collection and Aggregation

3.1 Information Provided Directly

Identity Data: Name, corporate entity, title
Contact Data: Email, address, telephone
Authentication Data: Encrypted credentials, API keys
Financial Data: Last 4 digits of cards only (full details processed by PCI-DSS compliant gateways)

3.2 Automated Usage Data

Technical data including IP addresses, browser type, operating system, and platform usage metrics.

3.3 Platform and Business Data

Store configurations, product catalogs, images, and descriptions.

4. Legal Basis for Processing

Contractual Necessity: Required to fulfill Service Agreement
Legitimate Interests: Fraud prevention, security, algorithm improvement
Legal Obligation: Compliance with statutory requirements
Consent: Explicit opt-in for direct marketing or tracking technologies

5. Use and Disclosure of Information

5.1 Operational Usage

Provision and optimization of Services
Payment processing and invoicing
Authentication and access prevention
AI model training using only "de-identified and aggregated data"

5.2 Third-Party Sharing

Data disclosed only to trusted Sub-Processors bound by confidentiality agreements, including:

Cloud Infrastructure (AWS, Digital Ocean, Azure)
Payment Processors
Analytics Providers

6. International Data Transfers

6.1 EEA/UK Transfers

Transfers outside the EEA/UK are governed by Standard Contractual Clauses (SCCs) or UK International Data Transfer Agreement (IDTA).

6.2 Pakistan Transfers

Data handled per PECA 2016 and Ministry of Information Technology guidance.

7. Data Retention and Minimization

Active Accounts: Data retained for account lifetime
Deleted Accounts: Archived for 30 days before permanent deletion
Anonymization: Aggregated data retained indefinitely for research

8. Rights of the Data Subject

8.1 Europe (GDPR) and UK

Right to Access
Right to Rectification
Right to Erasure
Right to Portability

8.2 United States (CCPA/CPRA)

Right to Know
Right to Delete
Right to Opt-Out
Non-Discrimination Protection

8.3 Pakistan

Access and correction rights per constitutional protections and PECA framework.

Submit requests via Help Form with typical 30-45 day response timeframe.

9. Security Measures

Encryption: TLS 1.2+ in transit, AES-256 at rest
Access Control: Role-based access control and MFA
Audits: Regular vulnerability scanning and penetration testing

No digital transmission is absolutely impenetrable.

10. Cookies and Tracking Technologies

Essential Cookies: Session management
Analytical Cookies: Usage tracking (Google Analytics)
Preference Cookies: User settings storage

Users may control cookie acceptance via browser settings. See our Cookie Policy.

11. Children's Privacy

Services are B2B only and not intended for those under 18. Personal Data from children under 13 (or 16 in applicable jurisdictions) will be immediately deleted if discovered.

12. Amendments to This Policy

ShopGPT reserves modification rights. Material changes communicated via email or Service dashboard notice.

13. Contact and Dispute Resolution

Contact: Help Form for Privacy Officer/Data Protection Officer inquiries.

Governing Law: California, England and Wales, or Islamabad (depending on jurisdiction).

14. Incorporation and Relationship to Terms of Service

This Policy is incorporated into the ShopGPT Terms of Service. Your access is conditioned upon acceptance of both documents. In case of direct conflict regarding Personal Data processing, this Policy prevails.