Privacy Policy

This policy explains what personal data StoreCanary collects, why, how long we keep it, who helps us process it, and the rights you have. It applies to visitors of storecanary.io, to people who run a free scan or buy an audit, and to store owners we contact by email. It is written for the GDPR (EU), the UK GDPR, and the California Consumer Privacy Act (CCPA, as amended by the CPRA).

1. Who is responsible for your data

The controller is LAMOTTE LLC, a limited liability company organized under the laws of the State of New Mexico (USA), registered address 1209 Mountain Road Pl NE, STE N, Albuquerque, NM 87110, USA, telephone +1 917 814 5390. For any privacy question or request: hello@storecanary.io.

2. What we collect, why, and on which legal basis

a. Public data about Shopify stores (the scan)

Our scanner reads the publicly accessible pages of a Shopify store: product pages, sitemap, robots.txt and structured data, exactly as Google sees them. It never accesses a store's admin, never logs in and never installs anything. This is mostly business data, not personal data. Where a page shows a person's name or contact details, we do not use it for the scan itself.

Legal basis: our legitimate interest in providing and improving a visibility check of public web pages (GDPR art. 6(1)(f)).

b. Free scan and audit customers

• The store URL you submit, and the scan report generated for it
• Your email address, if you ask us to email you the report or if you buy an audit
• Order details: store, amount, date, language, discount code used, and the record of your consent to immediate delivery (see our Terms)
• Your messages, if you write to us

Payments are handled by Stripe. We never see or store your full card number. Legal basis: performance of the contract you request (art. 6(1)(b)), and legal obligations for accounting and tax records (art. 6(1)(c)).

c. Store owners we contact by email (B2B prospecting)

We send a limited number of emails to Shopify store owners to show them visibility problems our scanner found on their public store. For this we process:

• The business email address published on the store's own website (contact page, legal notice, footer) or in another public professional source such as a public company register. We do not buy email lists.
• Where publicly available, the name of the business contact and the company name
• The store's domain, the results of the public scan, the page where the address was found, and the history of our messages and your replies

Before sending, we check that the address can receive mail (a technical server check that sends no message). Outreach emails are sent from our sister domain getstorecanary.com, operated by the same company.

Legal basis: our legitimate interest in offering a service directly relevant to your professional activity (art. 6(1)(f)). For stores in France and the UK, we do not email personal free-mail addresses (such as Gmail or Outlook) found on stores, and for Canada and Australia we only use addresses that are conspicuously published.

Your right to object: every email contains a one-click unsubscribe link. You can also simply reply "stop" or write to hello@storecanary.io. Once you object, we stop immediately and keep only your address in a suppression list, so we never contact you again.

d. Website visitors

• Technical server logs (IP address, browser user agent, page requested, time) to run and secure the site
• Basic usage events, for example that a report page was opened or that the purchase button was clicked, which may include the IP address or a pseudonymized version of it

Legal basis: our legitimate interest in operating, securing and measuring our own service (art. 6(1)(f)).

3. Cookies

We use no advertising cookie, no retargeting pixel and no third-party analytics cookie. We set only two first-party cookies, both strictly necessary:

• sc_lang: remembers whether you prefer the English or French site. Expires after 12 months.
• sc_s: keeps you signed in to your account page, only if you sign in. HttpOnly, expires after 30 days.

Our pages load their fonts from Google Fonts, which means your browser sends its IP address to Google when the page loads.

4. Who processes data for us

We do not sell your personal data and we do not share it for cross-context behavioral advertising. We use the following service providers, which only process data on our behalf and for the purposes below:

• OVH US LLC (USA): hosting of the website, the application, its data and our self-hosted automation tool (n8n). Servers located in the United States.
• Stripe (Stripe, Inc., USA, and Stripe Payments Europe, Ireland): payment processing. See stripe.com/privacy.
• Zoho (Zoho Corporation B.V., EU data center): email sending and mailboxes.
• Anthropic (Anthropic PBC, USA): AI models used to sort the replies we receive and to help prepare outreach, such as identifying a business contact name from public sources.
• Notion (Notion Labs, Inc., USA): internal tracking of our outreach and support.
• Telegram (Telegram Messenger): internal operational alerts to our team, which may mention a store domain or an email address.
• Apify (Apify Technologies s.r.o., Czech Republic): collection of public posts from merchant forums for market research.
• Google (Google LLC, USA): web fonts, and public page performance data for the stores we scan (store URLs only).

5. International transfers

LAMOTTE LLC is established in the United States and our servers are in the United States, so if you are in the EU or the UK your data is processed in the US. When a provider receives personal data of people in the EU or UK outside those areas, the transfer is covered by the EU-US Data Privacy Framework (and its UK extension) where the provider is certified, or by the European Commission's Standard Contractual Clauses with the UK addendum. You can ask us for a copy of the relevant safeguards.

6. How long we keep data

• Scan reports and store URLs: up to 24 months after the scan, or less if you ask us to delete them
• Customer and order records, including the record of your consent to immediate delivery: as long as required by accounting and tax law, and for the defense of legal claims
• Prospecting data: up to 24 months after our last contact, unless you object earlier
• Suppression list (people who asked us not to contact them): kept as long as needed to honor the request
• Raw web server logs: deleted after 14 days. Usage events: up to 24 months
• Support emails: up to 3 years after the last exchange

7. Your rights

EU and UK (GDPR, UK GDPR): you can access your data, have it corrected or erased, restrict its processing, receive it in a portable format, and object at any time to processing based on our legitimate interest, including prospecting. You can also lodge a complaint with your supervisory authority, for example the CNIL in France (cnil.fr) or the ICO in the UK (ico.org.uk).

California (CCPA/CPRA): you have the right to know what personal information we collect and how we use it, to access it, to have it deleted or corrected, and to opt out of any sale or sharing. We do not sell or share personal information and we do not use sensitive personal information. We will not discriminate against you for exercising these rights. An authorized agent may make a request on your behalf.

Everyone else: we apply the same rights to all, wherever you live.

To exercise a right, write to hello@storecanary.io. We may ask you to confirm that the request comes from you, and we answer within one month (45 days for California requests).

8. Security

Access to our servers is restricted, connections are encrypted (HTTPS, TLS), and secrets are stored outside the code. No system is perfectly secure: if a breach affects your data, we will notify you and the competent authorities as the law requires.

9. Children

StoreCanary is a service for businesses. It is not directed at children and we do not knowingly collect data about them.

10. Changes

We may update this policy. The date at the top shows the latest version, and material changes are announced on this page.

11. Contact

Privacy questions and requests: hello@storecanary.io · LAMOTTE LLC, 1209 Mountain Road Pl NE, STE N, Albuquerque, NM 87110, USA.