Privacy Policy

Controller

The controller responsible for data processing on this website under the GDPR is Piotr Jerzy Jania (Einzelunternehmer), c/o Smarvo, Südstraße 31, 47475 Kamp-Lintfort, Germany. Contact: support@rivalscraper.com or our contact form. Full provider details are in the Impressum.

1. Information We Collect

We collect the following types of information:

• Account information — your name, email address, and authentication credentials when you sign up.
• Usage data — how you interact with the Service, including pages visited, features used, and actions taken, collected through product analytics only after you accept analytics cookies.
• Early-access and pilot requests — your work email and, where applicable, the optional business type, country, and exact Shopify product URL you submit when joining the waitlist or requesting pilot access after a compatibility check.
• Payment information — billing details are processed and stored by Stripe. We do not store your credit card information on our servers.

2. How We Use Information

• To provide and maintain the Service, including competitor product price and stock monitoring and change alerts.
• To send transactional emails (account verification, password resets, alert notifications).
• To send occasional product updates and marketing emails. You can unsubscribe at any time.
• To record and assess your early-access or pilot request, contact you about access, and take steps you request before a possible subscription. The legal basis is your consent (Article 6(1)(a) GDPR) and, where applicable, steps at your request before entering a contract (Article 6(1)(b) GDPR).
• To improve the Service through anonymized and aggregated usage analytics after you accept analytics cookies.
• To respond to support requests and provide customer service.
• To answer messages sent through our contact form. The form collects your name, email address, and message; they are delivered to the operator and kept in our internal notification log until you ask us to delete them.

3. Data We Collect from Public Pages

RivalScraper reads publicly available information from exact compatible Shopify product pages on behalf of our users. This includes the product name, displayed price, currency, and store-reported stock status. We do not intentionally collect personal information, private data, or any content that requires authentication to access. We respect robots.txt directives, apply public-only/no-PII controls, and record collection decisions in a compliance ledger.

4. Third-Party Services

We use the following third-party services to operate the platform:

• Supabase — EU-hosted database and user authentication.
• Vercel — application hosting, serverless functions, and scheduled jobs.
• Resend — transactional email delivery.
• Stripe — payment processing and subscription management. When you make a purchase, your payment information is shared directly with Stripe. We do not store credit card numbers on our servers. Stripe may use your data in accordance with their privacy policy.
• Sentry — error monitoring and operational debugging.
• PostHog — product analytics. PostHog runs only after you accept analytics cookies.
• Cloudflare — content delivery, security, and Cloudflare Web Analytics: cookieless, aggregated page-view statistics that do not track individual visitors across sites.
• Firecrawl — optional public-page fetch fallback when configured.

Each third-party service has its own privacy policy governing how they handle data. We encourage you to review their policies.

5. Cookies & Analytics

We use essential cookies to maintain your authentication session and keep the Service secure. PostHog analytics cookies and local storage run only after you accept analytics cookies in the banner. If you decline, PostHog is not initialized. The successful early-access form event, including the selected business type and country, is sent to PostHog only when analytics consent is active. We do not use advertising cookies or sell your data to third-party advertisers.

6. Data Retention

We retain your account data and competitor tracking data for as long as your account is active. If you delete your account, we will delete your personal data within 30 days. Contact-form messages are kept until your request is resolved and deleted on request. Unauthenticated waitlist and pilot-request records are kept until early access ends or you ask us to delete them, and never for more than 24 months. Anonymized and aggregated data may be retained indefinitely for analytics and product improvement purposes.

7. Your Rights

You have the right to:

• Access your personal data that we hold.
• Delete your account and associated data from your account settings.
• Export your data — contact us to request an export of your account data.
• Correct inaccurate personal data by updating your account settings.
• Object to processing of your data for marketing purposes by unsubscribing from emails.

8. Security

We take reasonable measures to protect your information. All data is stored on Supabase with row-level security enabled. Data is encrypted in transit using TLS and at rest. Access to production systems is restricted to authorized personnel. However, no method of electronic transmission or storage is 100% secure, and we cannot guarantee absolute security.

9. Children's Privacy

The Service is not intended for use by children under the age of 16. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us and we will delete it promptly.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify users of material changes via email or an in-app notice. Continued use of the Service after changes take effect constitutes acceptance of the updated policy.

11. Contact

If you have any questions about this Privacy Policy, please contact us through our contact form.