Privacy Policy

Effective 7 October 2026

1. Who we are

Sharpsum is an app for Shopify stores. It is made by SIA MANUM, a company registered in Latvia, in the European Union.

• Company: SIA MANUM
• Registration number: 40203414494
• VAT number: LV40203414494
• Legal address: Gaismas iela 22-26, Daugavpils, LV-5414, Latvia
• Email: support@manum.lv
• App address: sharpsum.manum.lv

In this policy, "we" and "us" mean SIA MANUM; "you" means the merchant who installs Sharpsum and the people who use it for that merchant; "customers" means the people who buy from your store.

We have not appointed a data protection officer, because the GDPR does not require one for the processing we do. Send any privacy question to support@manum.lv.

2. What Sharpsum does

Sharpsum shows your store's profit by day and by month. It starts from revenue, which is Shopify's net sales plus shipping charges, and subtracts the cost of goods, shipping cost, handling, payment fees, ad spend and the expenses you enter. You can see the figures in your shop's currency, or in another currency at Shopify's daily exchange rates.

We use your data only to provide Sharpsum to you.

3. Our two roles

Your store data: we work for you. You decide why your store data is processed, and we follow your instructions. In GDPR terms, you are the controller and we are your processor. Our duties are set out in the Data Processing Terms, Part B of our Terms of Service.

Data about you as our user: we decide. This covers your support messages, technical logs and your subscription status. For this data we are the controller. Sections 7 and 8 explain it.

4. Data Sharpsum reads from Shopify

Sharpsum reads this data through Shopify's Admin API and through ShopifyQL, Shopify's analytics query language.

Orders

• order IDs and order dates;
• line items, quantities and prices;
• discounts, taxes, refunds and cancellations;
• shipping charges;
• the shipping destination: country and region only;
• payment transactions: the payment method, amount and fee.

Products

• the cost of each product, and the cost Shopify recorded for each sale.

Your shop

• the shop's myshopify.com address, currency, time zone, weight unit and Shopify plan;
• Shopify's daily exchange rates, when you view figures in another currency;
• the status of your Sharpsum subscription.

Customer names, email addresses, phone numbers and addresses. Shopify lets an app use ShopifyQL only if the app also has access to protected customer fields. For this reason, our access request to Shopify covers customer names, email addresses, phone numbers and addresses. Sharpsum does not store customer names, email addresses, phone numbers or street addresses. Of an address, it keeps only the country and region an order was shipped to.

Why we treat order data as personal data. An order in Sharpsum does not contain the customer's name, but your store can still link the order to the customer who placed it. So we protect all order data as personal data.

5. Data you enter in Sharpsum

• Expenses: name, amount, dates and VAT rate.
• Ad spend: amounts by day and by channel.
• Settings: your choices about how Sharpsum calculates profit, such as shipping costs by destination and payment provider fees.

Expense names are free text. Please do not put personal data about other people in them unless you need to.

6. Connected ad accounts

You can connect ad accounts at Meta (Facebook and Instagram), Google Ads, TikTok, Microsoft Advertising, Pinterest and Snapchat, once each connection is available in Sharpsum.

• How you connect. You sign in with the ad platform (OAuth) and choose whether to give Sharpsum access.
• What we read. Sharpsum reads only the daily spend totals of the accounts you choose, with their currency and time zone. It does not create, change or delete campaigns, ads, audiences or budgets.
• How we use it. We use the totals only to show ad spend in your profit reports.
• How we store it. We store the spend totals with your other Sharpsum data, and the access tokens encrypted.
• Who we share it with. No one. We do not pass the tokens or the totals to anyone else, and we do not use them for advertising.
• How to remove it. Disconnect an account on Sharpsum's Ad spend page; we then delete its tokens. When you remove Sharpsum, we delete all connection data with the rest of your store's data (section 11). You can also ask us to delete this data at any time at support@manum.lv. More: deleting your data.

7. Data we collect for our own business

• Support messages. When you email us, we receive your name, your email address and your message.
• Technical logs. Our hosting provider, Cloudflare, processes technical data to run and protect Sharpsum, including IP addresses, request times and the addresses of the pages requested.
• Subscription status. Shopify tells us which plan you are on and whether your subscription is active.
• Cookies. Sharpsum uses no cookies for tracking or advertising. Sign-in works through Shopify's session tokens. This website sets no cookies.

Sharpsum does not run on your storefront and collects nothing directly from your customers.

8. Why we use data, and our legal basis

Sharpsum needs access to your store data to work. Without it, you cannot use the app.

What we never do

• We do not sell personal data or any of your store data.
• We do not use your data for advertising.
• We do not share your data, including aggregated or anonymised data, except as described in section 9.
• We do not use your data to compare your store with other stores.
• We do not use your data to train AI or machine-learning models.
• We never contact your customers.
• We make no automated decisions about people that have legal or similarly significant effects.

9. Who we share data with

We use these service providers (sub-processors):

We will tell you before we add or replace a sub-processor, as set out in our Data Processing Terms. We may also disclose data when the law requires it, for example to obey a valid court order; where the law allows, we will tell you first.

Shopify processes your store data under its own privacy policy: shopify.com/legal/privacy. The ad platforms process your ad account data under their own terms with you.

10. Where data is stored

SIA MANUM is established in the European Union (Latvia). Sharpsum runs on Cloudflare. Each store's data is kept in its own Durable Object, a separate database apart from other stores, in Cloudflare's European Union jurisdiction: Cloudflare stores and processes it in data centres in the EU.

Where a service provider processes data outside the European Economic Area, for example Cloudflare's global network passing a request on, the transfer is covered by the provider's data processing terms, which include the EU Standard Contractual Clauses.

11. How long we keep data

If you want to keep your data, download it before you remove Sharpsum: the Profit, Expenses and Ad spend pages each offer a CSV download.

12. How we protect data

• Cloudflare encrypts all Durable Object data at rest (AES-256).
• All traffic to and from Sharpsum is encrypted with TLS.
• Each store's data is kept in its own Durable Object, apart from other stores.
• Ad account tokens are stored encrypted.
• Only the owner of SIA MANUM has access to the production systems, through accounts protected by two-factor authentication.
• Every look we take at a store's data, for example to answer a support request, is logged for that store.
• We follow a written security incident response policy.

If a security breach affects your data, we will tell you without undue delay and no later than 48 hours after we become aware of it. We also report it to Shopify, as Shopify's terms require.

13. Requests from your customers

Your customers use their privacy rights through you, because you are the controller. If one of your customers contacts us, we pass the request to you and do not answer it ourselves unless you ask us to.

Shopify passes us three kinds of privacy requests. We complete each one within 30 days, as Shopify requires.

• A customer asks for their data. Shopify tells us which orders the request covers. For those orders we hold only the details listed in section 4, never the customer's name, email address, phone number or street address. Sharpsum shows you the request on its Profit page, with these details as a file to download.
• You ask to erase a customer's data. Shopify lists the orders concerned. We delete the shipping country and region of those orders; only their amounts remain in your totals, which point to no one.
• You remove Sharpsum. We delete all of your store's data, as section 11 describes.

14. Your rights

You have the right to access the personal data we hold about you, to correct it, to delete it, to restrict how we use it, to object to our use of it where we rely on our legitimate interests, and to receive a copy in a structured, commonly used, machine-readable format. We give these rights to everyone, wherever they live.

To use a right, write to support@manum.lv. We answer within one month. If a request is complex, we may need up to two more months; if so, we tell you within the first month.

You can also complain to a data protection authority. In Latvia this is Datu valsts inspekcija (Data State Inspectorate), Elijas iela 17, Riga, LV-1050, Latvia, +371 67223131, pasts@dvi.gov.lv, www.dvi.gov.lv. You can also complain in the EU country where you live or work, or where you believe the problem happened.

15. Children

Sharpsum is a tool for businesses. It is not meant for children.

16. Changes to this policy

We publish every change on this page and update the effective date. If a change is important, we tell you in Sharpsum at least 30 days before it applies.

17. Contact

SIA MANUM
Gaismas iela 22-26, Daugavpils, LV-5414, Latvia
support@manum.lv