Privacy policy

PirateCheck is run by Nodehub OU, Sepapaja 6, Tallinn 15551, Estonia.

For your merchant account, Nodehub OU is the controller. For the shop data we handle on your behalf, such as your products and photos, your shop is the controller and Nodehub OU is the processor.

• Your shop's name and domain, the access keys Shopify gives us so the app can read your products (stored encrypted), the times you installed and removed the app, your plan and your Shopify subscription id.
• Your product titles, your product photos and a short code made from each photo, which helps us match copies.
• Your brand names, which we use to spot new websites with a name like yours.
• Which of your products sell best, when we last checked, and how many of your best sellers we search the web for.
• The copies we find, the cases we open, your decisions (Mark as pirate or Not a pirate) and the sites you allow to use your photos.
• The details you type in for takedown notices: name, postal address, email, phone and the name of the person who signs.
• The notice PDFs we build for you and the screenshots in them.

• No customer or order data. The app can only read your products.
• No card details. Shopify handles all billing.
• No tracking or advertising cookies on our website.

When you ask for a free scan on our website, we keep the store address, the email address and the IP address you send us. We use them only to send you that one report and to stop people from abusing the free scan. We never use them for marketing or send you other emails.

We keep them until you ask us to delete them. To ask, see "Your rights" below.

To find copies, we read public product pages and photos of other online stores and marketplaces. We read them slowly and politely, and we follow each site's robots.txt file, where a site says what it does not want read.

• To provide the service you installed (performance of a contract).
• To read public pages and find copies of your products (our legitimate interest in detecting copies).

• Shopify: installs the app, bills you and sends us your product data.
• Anthropic: compares pairs of photos to tell if one is a copy.
• Google Cloud Vision: searches the web for the photos of your best sellers.
• Cloudflare: stores files, takes the page screenshots for your notices, loads public web pages for us and checks that a free scan request comes from a person.
• Page-loading services (Geonode, CrawlFox, ScrapingBee): load public web pages only.
• eBay: shows us public eBay listings. We send it only the numbers of public listings.
• Our hosting provider: runs the app and its database.

Some of these companies are in the United States. They protect the data under the European Commission's standard contractual clauses or the EU-US Data Privacy Framework.

Data	How long
Shop account, product titles, photos, photo codes, copies found, cases, decisions and allowed sites	While the app is installed. When Shopify asks us to erase your shop's data, about 48 hours after you remove the app, we erase it. If our file storage is down at that moment, we try again over the next few hours.
Shopify access keys	Deleted as soon as you remove the app.
Notice details you typed in, notice PDFs and screenshots	While the app is installed, then erased with your shop's data as above. You can also ask us to delete them sooner, as "Your rights" below explains.
If you install the app again	If you install the app again before Shopify asks us to erase your data, we erase nothing and you continue where you left off.
Free scan requests: store address, email address and IP address	Until you ask us to delete them.
Background job records	7 days.
Server logs	Up to 30 days.
Database backups	Up to 30 days, then overwritten.
Support emails	Up to 2 years after the last message.
Data about other stores (public pages, photos and photo codes)	We keep it while PirateCheck runs. When a page is taken down, we mark it as gone.

You can ask to see the data we hold about you, to correct it, to delete it or to object to how we use it. You can also complain to the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon) at www.aki.ee.

To ask for any of these, write to Nodehub OU, Sepapaja 6, Tallinn 15551, Estonia.

When we change this policy, we update this page and the date at the top.