Privacy policy

This policy explains how FlagClear, operated by Khaled ("FlagClear", "we") handles personal data when you use flagclear.com and the FlagClear service. We act as the data controller for account data and as a processor for store data you connect.

What we collect

• Account data: your email address, an optional name, a hashed password and your plan.
• Google Merchant Center data (after you connect with Google): your Merchant Center account ID and name, product data and product statuses (titles, offer IDs, prices, availability, image links, identifiers) and product- and account-level issues. We also receive the email address of the Google account you connect.
• Shopify data (after you connect your store): your shop domain and product and variant data needed to show affected products and apply fixes you approve (titles, barcodes, vendor, prices).
• Billing data: Stripe customer and subscription identifiers and status. Card details are handled by Stripe and never reach our servers.
• Technical data: session cookies needed to keep you signed in, and server logs.

How we use it

• To scan your Merchant Center account, explain issues, list affected products and send the alerts you ask for.
• To apply changes to your Shopify products, only after you preview and approve each change. Every change is logged and can be reverted.
• To run your account, process payments, provide support and send service and product emails (you can unsubscribe from marketing emails at any time).

We do not sell personal data and we do not use your store data for advertising.

Google user data

FlagClear requests the https://www.googleapis.com/auth/content scope to read your Merchant Center product statuses and account issues. FlagClear never modifies your Merchant Center account.

FlagClear's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We use Google user data only to provide and improve the user-facing features of FlagClear; we do not transfer it to others except as needed to provide the service, comply with law, or as part of a merger or acquisition with notice to you; we do not use it for advertising; and humans do not read it unless you give consent, it's needed for security or to comply with law, or the data is aggregated and anonymised.

Service providers

We use these processors to run FlagClear, under data-processing agreements:

• Vercel (hosting), Neon (database), Stripe (payments), Resend (transactional email), ActiveCampaign (email list, if you sign up).

Some providers are located outside the EU/EEA; transfers rely on the EU Standard Contractual Clauses or an adequacy decision.

Security

OAuth tokens are encrypted at rest with AES-256-GCM. Traffic is encrypted with TLS. Access to production data is restricted.

Retention and deletion

Scan results are kept while your account is active so you can see trends. When you disconnect Google or Shopify we delete the stored tokens immediately. When you delete your account we delete your account, scan and change-log data within 30 days, except where we must keep billing records by law. You can revoke FlagClear's Google access at any time at myaccount.google.com/permissions.

Your rights

Under the GDPR you can request access to, correction of, deletion of, or a copy of your personal data, and object to or restrict processing. Email privacy@flagclear.com. You can also complain to your data protection authority (in Sweden: IMY, Integritetsskyddsmyndigheten).

Cookies

We only use strictly necessary cookies (sign-in session and OAuth security state). We don't use advertising cookies.

Contact

FlagClear, operated by Khaled, Sweden.

Privacy and data requests: privacy@flagclear.com. Everything else: support@flagclear.com.