Privacy Policy

1. Who is responsible for your data

RevenuePath is operated by Ahmet Uğur, a natural person based in Türkiye. For purposes of Türkiye's Personal Data Protection Law No. 6698 (KVKK), the operator is the data controller for the merchant and support data described here. Contact privacy@getrevenuepath.com for privacy questions or requests.

2. Data we process

• Shop and installation data: the permanent myshopify.com domain, primary storefront address, display name, installation state, and lifecycle timestamps.
• Monitoring configuration: monitor name, product or landing-page address, device, cadence, selected variant, and optional expected price and currency.
• Run and incident data: check timestamps, journey-step results, duration, failure details, incident status, and a failure screenshot when needed for diagnosis.
• Notification data: the operational email address you enter, whether incident alerts are enabled, and bounded delivery status, retry, and provider-message identifiers used to prevent duplicate notifications.
• Credentials required to provide the service: a Shopify offline access token and, only for a password-protected development storefront, its visitor-facing Online Store password or theme-preview parameters. These values are encrypted, restricted to their purpose, and never returned in merchant-facing API responses.
• Support and security data: the contact details and diagnostic information you choose to send us, plus bounded technical records used to prevent abuse, replay, and stale-installation access.

3. Why and on what basis we process data

We process the minimum data needed to:

• install, authenticate, secure, and provide the monitoring service you request;
• run configured checks and show results, incidents, and evidence;
• send service and incident communications when notifications are enabled;
• prevent misuse, investigate faults, and protect RevenuePath and its merchants;
• meet legal, regulatory, accounting, and Shopify platform obligations.

Depending on the activity, the legal basis may be performance of the service agreement, compliance with a legal obligation, establishment or protection of a right, or a legitimate interest that does not override your fundamental rights. We seek consent where applicable law requires it and do not use consent to disguise processing that depends on another basis.

4. Service providers and international transfers

We disclose data only as needed to operate the service, comply with law, or protect legal rights. Providers may include Shopify for platform authentication and billing; Microsoft Azure for application, database, key, and evidence infrastructure; Resend for transactional email when notifications are enabled; and Cloudflare for DNS or inbound email routing when enabled. Providers may act from countries outside Türkiye.

International transfers are assessed under KVKK Article 9 and are activated for public use only with an applicable transfer condition and required safeguards. We do not sell personal data or share it for third-party behavioral advertising.

5. Retention and deletion

• Failure screenshots and their storage versions are configured to expire within seven days.
• Pending notification payloads expire within seven days; recipient, monitor, and URL snapshots are removed immediately when delivery reaches a terminal state, and the remaining delivery metadata expires within 30 days.
• Uninstalling stops monitoring, cancels queued work, and removes installation and storefront-access secrets.
• A valid Shopify shop/redact request deletes the shop's monitoring records and queues deletion of its evidence.
• Support, billing, and narrowly scoped security records are retained only for their stated purpose or an applicable legal period.
• Notification preferences, incident state, and delivery records are deleted with the shop's tenant data.

When a processing reason no longer exists, data is deleted, destroyed, or anonymized in accordance with applicable law. See the data-deletion page for the request process.

6. Your KVKK rights

You may ask us to:

• confirm whether your personal data is processed and obtain information about it;
• learn the purpose of processing and whether data is used consistently with that purpose;
• learn the third parties to whom data is transferred in Türkiye or abroad;
• correct incomplete or inaccurate data and notify relevant recipients;
• delete or destroy data where the legal conditions are met and notify relevant recipients;
• object to a result against you arising solely from automated analysis; and
• seek compensation where unlawful processing causes damage.

Send a request to privacy@getrevenuepath.com. We may ask for proportionate information to verify identity and authority. We respond as soon as possible and no later than 30 days, normally without charge unless an official tariff permits a cost.

7. Security and changes

RevenuePath uses tenant isolation, encryption for stored secrets, private evidence storage, scoped identities, authenticated delivery, request validation, and data-minimizing logs. No system is completely risk-free. Report a suspected vulnerability to security@getrevenuepath.com without including live credentials or customer data.

We may update this policy as the service or law changes. Material changes will be identified by a new effective date and, where appropriate, an in-app notice.