1. Who controls your data

The data controller for personal data processed through ShopiSpy is Kamil Mazur IT, a sole proprietorship registered in Poland, NIP 7962987680 ("we", "us", "our"). We can be reached at shopispy.us@gmail.com for any privacy-related request. We have not appointed a Data Protection Officer, as it is not required for the scale of our processing; the contact above handles all privacy requests directly.

This Privacy Policy explains what personal data we collect through the ShopiSpy website and dashboard (the "Service"), why we collect it, who we share it with, and the rights you have over it.

2. What data we collect

Category	Examples	Source
Account data	Name, email address, account identifier	Provided by you via Microsoft Entra ID when you sign in
Billing data	Subscription plan, billing status, transaction history	Provided by Paddle.com, our payment processor and Merchant of Record - we do not collect or store your card details
Usage data	Stores/products you view, search and favourite inside the dashboard	Generated automatically as you use the Service
Technical data	IP address, browser type, device/log data	Collected automatically for security and fraud prevention
Support data	Content of emails or messages you send us	Provided by you when you contact us

We do not use cookies or any third-party analytics or advertising trackers on the Service beyond what is strictly necessary to keep you signed in and the Service running.

3. Why we use your data

• To provide the Service (performance of our contract with you) - creating your account, authenticating you, showing you your daily data, processing your subscription.
• To process payments (performance of our contract with you) - via Paddle.com, acting as Merchant of Record.
• To keep the Service secure (our legitimate interest) - detecting and preventing abuse, fraud, and unauthorized access.
• To respond to your requests (our legitimate interest / performance of our contract) - when you contact us for support.
• To comply with legal obligations (legal obligation) - such as tax and accounting rules applicable to our business.

4. Who we share your data with

We do not sell your personal data. We share it only with the service providers ("processors") that are necessary to run ShopiSpy:

• Microsoft (Azure & Entra ID) - our cloud hosting provider (Microsoft Azure, West Europe region) and our identity/authentication provider.
• Paddle.com - our payment processor and the Merchant of Record for all subscriptions, which processes your billing and payment data under its own privacy policy.

We do not use any additional analytics, advertising, or marketing subprocessors. We may disclose data where required by law, for example in response to a valid request from a public authority.

5. International data transfers

Our infrastructure is hosted on Microsoft Azure in the West Europe region, within the European Economic Area. Paddle.com may process data outside the EEA as part of its global payment operations; where this occurs, Paddle relies on appropriate safeguards (such as Standard Contractual Clauses) as described in its own privacy policy.

6. How long we keep your data

We retain your account and usage data for as long as your account is active, and for a reasonable period afterwards in case you wish to reactivate it or as needed to resolve disputes and enforce our agreements, after which it is deleted or anonymized. Billing and payment data is retained by Paddle.com in accordance with its own retention rules and applicable legal requirements.

7. Your rights

If you are located in the European Economic Area or another jurisdiction with similar data protection laws, you have the right to:

• request access to the personal data we hold about you;
• request correction of inaccurate data;
• request erasure of your data ("right to be forgotten");
• request restriction of, or object to, certain processing;
• request a portable copy of your data;
• withdraw consent at any time, where processing is based on consent;
• lodge a complaint with your local data protection authority - in Poland, the President of the Personal Data Protection Office (UODO), uodo.gov.pl.

To exercise any of these rights, contact us at shopispy.us@gmail.com. We will respond within the timeframes required by applicable law.

8. Security

We rely on Microsoft Azure's and Microsoft Entra ID's security infrastructure and follow reasonable technical and organizational measures to protect your data against unauthorized access, loss, or misuse. No method of transmission or storage is 100% secure, and we cannot guarantee absolute security.

9. Children's privacy

The Service is not directed at individuals under the age of 18, and we do not knowingly collect personal data from anyone under 18. If you believe a minor has provided us with personal data, contact us and we will delete it.

10. Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be reflected by updating the "Last updated" date above, and where appropriate, we will provide additional notice.

11. Contact

For any question about this Privacy Policy or your personal data, contact us at shopispy.us@gmail.com.