What we know about you.
Short version: a store URL, an email address if you give us one, and whether you paid. We do not sell anything to anyone, and there is no advertising network embedded in this site beyond measuring whether our own ads worked.
1. What we collect
The store you asked about
The URL you paste, the hostname we reduce it to, and the public product data we read from that storefront — titles, prices, variants, image URLs, and so on. This is a third party's catalogue data, published openly on their own site. It is not normally personal data, and we do not go looking for any.
Your email address
Only if you hand it over: to receive the free 30-product sample, to ask us to quote a store we cannot scrape automatically, or because Stripe passes it to us when you pay. We use it to send you the file you asked for, to answer you, and to receipt your purchase.
Payment
Card details never touch our servers. Checkout is hosted by Stripe, and what comes back to us is a session identifier, whether it was paid, and the email address you gave Stripe. Stripe is the controller of your payment data in its own right — see their privacy policy.
Measurement
If you allow it, Google Analytics and Google Ads conversion measurement, routed through our own server at sgtm.shoplifter.app rather than straight to Google. When a purchase or a lead happens, we send Google a SHA-256 hash of your email address so they can match it to an ad click. We do not send the address itself.
Technical
Your IP address and browser user-agent reach our servers as part of any web request. We use them to run the service, prevent abuse, and approximate location for analytics. We do not keep request logs as a profile against you.
2. Cookies and local storage
Nothing below in the analytics or advertising rows is set until you choose. Everything defaults to denied, in the page source, before any tag loads.
| Name | Purpose | Kept for | Category |
|---|---|---|---|
| shoplifter.jobs.v1 | The token that lets your browser — and only your browser — reopen a scan you started or paid for. Without it you cannot reach your own export. | Until cleared | Strictly necessary |
| shoplifter.consent.v1 | Remembers this exact choice, so we stop asking. | 6 months | Strictly necessary |
| FPID | Set by our own tagging server to recognise a returning visitor for analytics. First-party, HTTP-only. | 2 years | Analytics |
| _ga, _ga_* | Google Analytics visitor and session identifiers. | 2 years / 3 months | Analytics |
| shoplifter.gclid.v1 | The Google Ads click identifier from the link you arrived on, so a later purchase can be credited to the right ad. | 90 days | Advertising |
| _gcl_* | Google Ads conversion linker. | 90 days | Advertising |
Change your mind whenever you like: . Rejecting everything does not restrict the service — the scan still runs.
3. Why we are allowed to
- Performing a contract. Running your scan, taking payment, and delivering the file.
- Consent. Analytics and advertising measurement. You gave it on the banner and can take it back the same way.
- Legitimate interests. Keeping the service up, stopping abuse, and keeping records of what we sold to whom.
- Legal obligation. Retaining transaction records for tax.
4. How long we keep it
- Scan results: 30 days, then deleted.
- Scans nobody paid for: 24 hours.
- Access tokens and download links: 72 hours.
- Email addresses from leads and purchases: until you ask us to remove them, or the transaction record ages out for tax.
- Analytics: per the retention set on the Google Analytics property.
5. Who else touches it
- Railway — hosting and database, EU West region.
- Stripe — payments.
- Google — Analytics and Ads measurement, if you consented.
- Resend — sending you the file and receipts.
- Webshare — the proxy network our scrapers make outbound requests through. It sees the storefronts we fetch, not you.
Some of these are in the United States. Those transfers rely on the EU Standard Contractual Clauses and the UK Addendum.
6. Your rights
Under UK GDPR and the EU GDPR you can ask us for a copy of what we hold, to correct it, to delete it, to restrict what we do with it, to receive it in a portable form, or to object to processing based on legitimate interests. Withdrawing consent is a button, not a request: .
Email hello@shoplifter.app and we will answer within 30 days. If we handle it badly you can complain to the ICO in the UK, or your national supervisory authority in the EU.
7. Children
This is a tool for people running online shops. It is not intended for anyone under 16, and we do not knowingly collect their data.