Privacy Policy

1. Introduction

PerfSell is operated by PERFSELL, a simplified joint-stock company (société par actions simplifiée) with a share capital of EUR 1,000, whose registered office is at 48 rue de Boulainvilliers, 75016 Paris, France, registered with the Paris Trade and Companies Register under number 999 520 273 ("PerfSell", "we", "us"). It is the controller of the personal data described in this policy, except the data of your customers, which we process on your behalf as described in Annex A of our Terms of Service.

This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our marketplace analytics platform. We process personal data in accordance with the General Data Protection Regulation (GDPR) and French data protection law.

This Privacy Policy is available in French and in English. In case of discrepancy between the two versions, the French version prevails.

2. Data We Collect

2.1 Account Information

• Email address
• Name
• Company name, job title, phone number, postal address, VAT number and timezone (optional, as you enter them)
• Profile picture (optional)
• The date and version of the Terms you accepted
• The date of your last activity in the app, recorded at most once an hour

2.2 Marketplace and Sales Channel Data

When you connect your marketplace or sales channel accounts (such as Amazon, Mirakl-powered marketplaces, Cdiscount, ManoMano, Veepee, Groupon or Shopify), we import and store:

• Order information (order IDs, amounts, dates, status, taxes, fees, refunds)
• End-customer information from orders, where the platform provides it and where it is needed for order management: name, email address, phone number, and billing and shipping addresses (street, city, postal code, country). For Shopify, these fields are retrieved as Shopify protected customer data, with the merchant's authorisation. To let you search your orders and count repeat customers, we also store keyed, non-reversible fingerprints of your customers' names, email addresses and phone numbers.
• Customer reviews left on your orders, where the marketplace provides them (for Mirakl: the customer's first and last name, rating and comment)
• Product catalog data (SKUs, barcodes, titles, prices, stock levels, unit costs)
• API credentials and access tokens (encrypted and stored securely)

You can delete the orders and products imported from a sales channel at any time from the app, by deleting that connection in its settings (a typed confirmation is required). For Mirakl-powered marketplaces and Veepee/Privalia you can also purge that data and keep the connection. This action does not remove customer reviews, nor the financial records of the connection (its fee and settlement entries) when it is your only store on that marketplace; with several stores on one marketplace, it removes only the data attributed to that store. For the rest, and for any Amazon data, write to privacy@perfsell.com and we delete them within one month. For Shopify we also honour Shopify's own erasure requests: a customer redaction request erases that customer's personal data from your orders, and a shop redaction request deletes your store's orders, products and connection.

2.3 Usage Data

• Log data (IP addresses, browser type, pages visited)
• Analytics data (feature usage, performance metrics)

3. How We Use Your Data

We use your data to:

• Provide and maintain our analytics services
• Generate reports and insights about your marketplace performance
• Send you service-related communications
• Improve our platform and develop new features
• Ensure security and prevent fraud
• Comply with legal obligations

AI features: to answer the AI assistant, write AI summaries and suggest product tags and categories, we send OpenAI the business data needed for the task (product titles, SKUs and categories, sales, stock and revenue figures, the name of your workspace, and the text you type). Category and tag suggestions may run in the background on your catalog. Your customers' names, contact details and addresses are not sent. OpenAI processes this data on our behalf and, under its API terms, does not use it to train its models.

4. Legal Basis for Processing (GDPR)

We process your data based on:

• Contract and legitimate interest: Processing necessary to provide our services under our contract with you or with the company you act for; for users acting for a customer, our and the customer's legitimate interest in providing the Service
• Legitimate Interest: To improve our services and ensure security
• Legitimate Interest: To send you emails about PerfSell plans and features related to your use of the Service, such as an invitation to upgrade. You can object at any time with the unsubscribe link in each of these emails or by writing to privacy@perfsell.com.
• Consent: For analytics cookies, where we use them (which you can withdraw anytime)
• Legal Obligation: To comply with applicable laws

5. Data Sharing

We do not sell your personal data. We may share data with:

• Service providers (sub-processors): Vercel (application hosting, EU region), Prisma Data (Prisma Postgres database, Paris, France), Supabase (authentication, EU), Amazon Web Services (product image storage in Stockholm, delivered through CloudFront), Stripe (payments), Resend (transactional email, Ireland, EU), Sentry (error monitoring, EU), OpenAI (AI features, United States) and Google (web fonts loaded by our emails, United States). Integrations you choose to enable, such as Slack or advertising accounts, receive the data you send to them.
• Legal requirements: When required by law or to protect our rights
• Business transfers: In case of merger, acquisition, or sale of assets

6. Data Retention

• Account and workspace data: kept for as long as your account is active or as needed to provide services. After account deletion, we may retain certain data for up to 30 days for backup purposes.
• Your customers' personal data: kept while you use the Service. When your paid access ends, your Customer Data stays exportable from your workspace for 30 days, as described in section 4 of our Terms of Service; you can then ask us to delete your customers' personal data at privacy@perfsell.com: we do so within one month, and keep the orders without it.
• Billing records: invoices, billing details, VAT number and payment history, held by us and by our payment provider Stripe, are kept after account deletion for the period required by accounting and tax law, ten years in France, and are used only for that purpose.
• Objections to plan emails: a hash of your email address, never the address itself, kept as long as needed to honour your objection, including after account deletion.
• Security and audit logs: the email of the user who acted, the action, its date, the name of the workspace and the details of the action, kept as long as necessary to secure the Service and to establish or defend legal claims, and at most 5 years after the event, including after account deletion; write to privacy@perfsell.com to have them deleted.
• Anonymized and aggregated data: may be retained indefinitely for analytics.

Free plan workspaces: we use the date of each user's last activity in the app to detect inactive workspaces (users blocked by the plan's user limit do not count). After 60 days without activity, synchronization and emails of a free workspace pause, after a notice email normally sent 7 days before. A free workspace without activity for 12 months may be deleted with its data, after a notice email sent 30 days before; backups are then kept for up to 30 days.

7. Your Rights (GDPR)

Under GDPR, you have the right to:

• Access: Request a copy of your personal data
• Rectification: Correct inaccurate or incomplete data
• Erasure: Request deletion of your data ("Right to be Forgotten")
• Restriction: Request limitation of processing
• Portability: Receive your data in a structured format
• Object: Object to processing based on legitimate interests
• Withdraw Consent: Withdraw consent at any time

You can correct your profile information in Settings. To exercise any other right, including deletion of your account and its sign-in identity or a copy of your data, write to privacy@perfsell.com. We answer within one month.

8. Data Security

We implement appropriate technical and organizational measures to protect your data:

• Encryption in transit (TLS/HTTPS)
• Encryption at rest for sensitive data
• Access controls and authentication
• Regular internal security reviews of access control and tenant isolation
• Multi-tenant data isolation

9. International Data Transfers

Our application and its database are hosted in the European Union. Some providers (OpenAI, Resend, Stripe, Sentry, Google for the fonts of our emails, Cloudflare for the audience measurement of our website, and Vercel's global network) may process data in the United States. These transfers rely on the EU-US Data Privacy Framework where the provider is certified, or on the European Commission's Standard Contractual Clauses.

10. Cookies and Website Audience

We use essential cookies for authentication and security. Analytics cookies may be used with your consent to improve our services.

Website audience measurement: our website perfsell.com (not the app) measures its audience with Cloudflare Web Analytics, provided by Cloudflare, Inc. (United States). It sets no cookie and stores nothing on your device. It processes the page viewed, the referring site, your country, your browser, operating system and device type, and page loading times; according to Cloudflare, it does not use your IP address or browser details to recognise you. We measure this audience on the basis of our legitimate interest in knowing how our website is used. The data may be processed in the United States, under the EU-US Data Privacy Framework, under which Cloudflare is certified, or under the European Commission's Standard Contractual Clauses. Cloudflare does not process the data of your customers.

11. Changes to This Policy

We may update this Privacy Policy from time to time and will notify you of material changes through the platform or by email. The updated policy applies from its publication; a change to the sub-processors listed in section 5 is announced at least 30 days in advance, as provided in Annex A of our Terms of Service. Each version of this policy remains available at its own address, and the previous version is linked at the top of this page.

12. Contact Us

For any questions about this Privacy Policy or our data practices, please contact us:

If you are not satisfied with our response, you have the right to lodge a complaint with a supervisory authority (e.g., CNIL in France).