Privacy Policy

Last updated: June 18, 2026

RankPilot (“RankPilot”, “the app”, “we”, “us”) is a Shopify application that helps merchants automatically merchandise their storefront by analyzing product, order, traffic, and (optionally) advertising performance data. This Privacy Policy explains what data the app processes, why, how long it is kept, and how it is protected. RankPilot is operated by BusinessUp.

1. Who this policy is for

This policy applies to the Shopify merchants who install RankPilot and to the end customers and visitors of those merchants’ stores whose data may be processed through Shopify’s APIs. Merchants are the data controllers of their store data; RankPilot acts as a data processor on the merchant’s behalf and only on their instruction.

2. Data we process

To provide its functionality, RankPilot accesses and stores the following data from the merchant’s Shopify store:

• Store and product data: shop domain and settings, products, variants, collections, and inventory levels.
• Order data (aggregate / performance only): order totals, order dates, the products contained in orders, and marketing attribution (UTM source / medium / campaign). This is used to measure which products perform and to rank/sort collections.
• Storefront events: aggregate web-pixel / customer-event signals used to measure product and traffic performance.
• Advertising data (optional):if the merchant connects Meta Ads, Google Ads, or Google Analytics 4, we process advertising and analytics performance metrics for the merchant’s own accounts.

We do not collect or store customer personal fields. RankPilot does not request, store, or use customer names, email addresses, phone numbers, or postal addresses. We work with order totals, dates, purchased products, and marketing attribution only.

3. How we use data

• Analytics: measuring product and sales performance.
• Personalization / merchandising: automatically sorting collections and recommending product placement based on real performance.

We limit our use of data strictly to these purposes. We never sell personal data, and we do not use it for advertising to customers, profiling individuals, or any purpose unrelated to the merchandising functionality of the app.

4. Data retention and deletion

Data is retained only while the app is installed on the merchant’s store. When the merchant uninstalls RankPilot, the associated store data is deleted. We also honor Shopify’s mandatory data-protection webhooks: customers/redact, shop/redact, and customers/data_request. When a redaction request is received, the corresponding records are removed from our systems.

5. Security

• In transit: all data is transmitted over encrypted HTTPS/TLS connections.
• At rest: data is stored in an encrypted database. Access credentials and third-party integration tokens are additionally encrypted at the application layer before storage.
• Access control: access to production data is limited to authorized personnel, and merchant-facing write operations are logged in an audit trail.

6. Sub-processors

We use a small number of service providers to operate the app. They process data only to provide infrastructure to RankPilot and are bound by appropriate data-protection terms:

• Cloud hosting / database: the server and database that run the application.
• Advertising platforms (only if connected by the merchant): Meta, Google Ads, and Google Analytics, for the merchant’s own accounts.

7. Consent

Merchants grant access to their store data when they install the app. RankPilot respects end-customer consent and deletion decisions as relayed by Shopify, including data-redaction requests. Because RankPilot does not market to customers or sell data, it does not make automated decisions that produce legal or similarly significant effects on individuals.

8. Your rights

End customers should direct data-access or deletion requests to the merchant whose store they interacted with; the merchant can fulfill these through Shopify, which relays them to RankPilot. Merchants may request access to or deletion of their data by contacting us.

9. Changes to this policy

We may update this policy from time to time. Material changes will be reflected by updating the “Last updated” date above.

10. Contact

For any privacy questions or data requests, contact us at businessuptr@gmail.com.