Privacy Policy

Last updated: November 5, 2026

1. Who we are. ProfitRoot is a product of SharpUnit LLC ("we", "us"). This policy explains how ProfitRoot handles information.

2. Data you upload. Two paths, handled differently. CSV files you upload are parsed in your browser and are not sent to us unless you save a workspace. Orders synced from a connected Shopify store are transmitted to and stored on our servers so they can be recomputed on later visits. When you save a workspace, the source input needed to reload it — your figures, or the raw upload text — is stored to your account in our database; The derived outputs (the reconciled bridge and margin ladder) are recomputed from those inputs on load and are never stored. Saved data is readable only by your signed-in account and encrypted in transit and at rest.

2a. Connected stores (Shopify). If you connect a Shopify store, ProfitRoot reads your Shopify Orders through Shopify's API and stores the order economics needed to reconcile revenue to Net Sales, on our servers, in your account only. Every read is limited to your store by our server code, and our database refuses direct access from a browser or our public key. One exception: our own automated checks use a credential that can read synced orders, daily briefs and store details, and cannot change them. We use this data solely to compute and reconcile your revenue analysis. Access tokens are stored encrypted. This is distinct from the CSV path described in section 2: CSV files you upload are parsed in your browser.

2b. Your customers. We do not store your customers' names, email addresses, phone numbers or street addresses. So that repeat buyers can be counted, each order carries a pseudonymous buyer key: a keyed one-way hash of the buyer's email address. It is personal data under the GDPR even though it does not name anyone, and it is deleted with the order. Discount codes on an order are stored with it.

2c. Sub-processors. Anthropic provides the AI model behind the support helper; we send it your question and the words of the help article being answered from, and it does not receive your orders or your customers' details. Ask Root, the in-app assistant, is not available yet. When it is, it will send Anthropic your question and the labels of the figures involved, and Anthropic will not receive your orders or your customers' details. Resend delivers our email, so it processes the address a message is sent to and that message. Our hosting and authentication providers are described in sections 4 and 7.

2d. Questions and support. If you send a support message, we store your reply address and the message so that we can answer it. Questions you ask the public support helper are stored with a truncated salted hash of your IP address, never the address itself, so we can see what it could not answer. Ask Root is not available yet, so no questions about your store are processed today. When it is, those questions will not be stored; we will keep only their cost and outcome. You can ask us to delete a support message at any time, and a store's support messages are deleted when it is disconnected or redacted.

2e. Connected assistants. A store's owner can create a read-only key that lets an AI assistant read that store's figures over the Model Context Protocol. Each key is limited to one store and can be revoked at any time, and we keep an audit log of what each key called and when. The assistant you connect is yours, and what it does with what it reads is governed by its own terms.

3. Site analytics (first-party, cookieless). When you visit our marketing pages, we record the page you viewed, where you arrived from (the referring URL and any campaign tags in the link), and a coarse country and device type, server-side in our own database. This is first-party and cookieless: we do not use third-party analytics, advertising, or tracking technologies, we do not set tracking cookies, and we do not fingerprint your device. These records contain no IP address, no account, and no name. We do not use your data to train machine-learning models, and we do not sell data. We keep these records for up to 13 months, then delete them automatically.

4. Account information (if you sign in). ProfitRoot may offer optional account sign-in. If you create an account, our authentication provider processes your email address and authentication credentials to manage your sign-in session. If you save workspaces, their input data is stored to your account as described in section 2. If you choose a paid plan, Shopify bills it on your Shopify invoice. Shopify holds your payment details; we receive only your store's plan and its status. We never send your financial data to a payment provider. Authentication session cookies are used solely to keep you signed in.

5. Requests you send us. If you ask us for something through a form on this site, such as a link to open ProfitRoot on your desktop, we collect and store your email address and whatever else that form asks for (an optional store URL, the file types you tell us you have) in our database, with how you reached the site (campaign tags, referrer, landing page) and any referral code in your browser, so we can respond and credit the referral. We do not use it for anything else. We do not sell or share it, and we do not add you to any third-party marketing tool. You can ask us to delete it at any time (see section 8).

6. Files you send us by email. If you email us a data export for review, we store that file only for as long as it takes to produce the analysis you asked for, and we delete it on completion or on your request, whichever comes first. We do not add it to any account, we do not use it to train anything, and we do not share it. We ask that exports be anonymized where possible. To request deletion sooner, email admin@tryprofitroot.com.

7. Hosting. The ProfitRoot application is delivered through our hosting provider, which may process standard technical request information (such as IP address) as part of serving the site, consistent with its own privacy practices.

8. Data retention and deletion. CSV data you upload and do not save is parsed in your browser and is not retained by us. Orders synced from a connected Shopify store are stored on our servers, as described in section 2a. Workspaces you save are retained in your account until you delete them — you can delete any saved workspace at any time from within the app. First-party attribution records (section 3) are retained for up to 13 months and then purged automatically. Requests you send us (section 5) are kept until we have responded, and are deleted on request — email us. To delete your account, contact us at admin@tryprofitroot.com.

8a. Connected-store data. Disconnecting your Shopify store, or uninstalling ProfitRoot from your Shopify admin, deletes the order economics synced from that store. We honor Shopify's customer data-request, customer-redact, and shop-redact webhooks.

9. Children. ProfitRoot is a business tool and is not directed to children under 13.

10. Changes. We may update this policy; material changes will be reflected here with a new date.

11. Governing law. This policy is governed by the laws of the State of Tennessee, USA.

12. Contact. admin@tryprofitroot.com.