Privacy policy

This policy covers the ShopSettle service. Operator: Shoppeguru Technology Inc., 30 N Gould St #29770, Sheridan, WY 82801. Contact: support@shopsettle.com

What we collect

• Your account email, for sign-in, notices and billing.
• Shop details: shop ID, name, region and type.
• Authorization tokens (stored encrypted, deleted immediately when you disconnect).
• Statements, transactions and fee breakdowns, payouts (only the last four digits of a bank account) and withdrawals.
• Order IDs, status, timestamps, SKU lines and prices; product titles and seller SKUs.
• Product costs, other costs and account mappings that you enter.

We do not store buyer personal information. Buyer names, phone numbers, emails, addresses and messages are discarded when data is read and never reach our database or logs.

How we use it

To calculate profit, reconcile payouts, create exports, provide support and billing. We do not sell your data.

Sharing

Only with vendors needed to run the service (hosting, email delivery, payments, error monitoring). Never sold, never used for advertising.

Where data is kept, and access from abroad

Data is hosted in the United States. Our team may access the systems remotely from other countries, for example Japan.

Retention and deletion

• When you disconnect, or TikTok tells us the authorization was cancelled, tokens are deleted immediately. Other data is kept for 30 days so you can export it, then permanently deleted, with a deletion record (a hash of the shop identifier, the time and row counts).
• You can also delete everything immediately from the Shops page.
• Webhook payloads (with personal data removed) are kept for 30 days; application logs (redacted) are kept for 30 days.
• Backups are encrypted and kept on a 14-day rolling basis; deleted data disappears from backups within 14 days.

Your rights

You can access, correct, export and delete your data. California residents have the rights described in the CCPA/CPRA. Send a request through the contact above; we handle requests within 7 days.

Security

Tokens are encrypted with AES-256-GCM, traffic uses HTTPS, every data access is limited to your account, and sign-in uses single-use email links.

Children

The service is not for anyone under 18.

Changes

We update this page when the policy changes and email you about material changes.