How we handle your data.

Flintmere is a trading name of Eazy Access Ltd, a company registered in England and Wales. Flintmere is the data controller for personal data you share with our website, the public scanner at audit.flintmere.com, and the Shopify app at app.flintmere.com.

Questions, access requests, or complaints: privacy@flintmere.com. Founder: John Morris.

We collect three categories of data:

• Scanner input. The Shopify store URL you submit, the IP address that submitted it (for rate limiting and abuse prevention), and the public data we then fetch from that store (/products.json, sitemap, JSON-LD samples).
• Lead capture. If you submit your email for the full report, we store that email, the scan ID it relates to, and your stated consent flags. That’s it — we do not ask for your name, company size, or phone number.
• Shopify app data. If you install the Shopify app, we receive an OAuth access token, your shop domain, and — scope-limited to read_products and write_products — your product catalog, variants, and metafields. We do not request customer, order, or financial scopes.

We do not collect special-category data, children’s data, or payment card data (Stripe handles payment data directly; we only see the payment reference).

• Scanner (public fetch + results display): legitimate interest — you actively entered a URL to have it analysed.
• Lead capture emails: consent — you tick the box before we send the report.
• Shopify app: contract performance — we cannot deliver the service you installed without processing the catalog data.
• Sub-processor sharing: necessary for performance of the contract above.

• Scanner results: 90 days, then deleted.
• Email leads: until you unsubscribe (one-click RFC 8058 in every report email), then purged within 30 days.
• Shopify access token: scrubbed within 60 seconds of the app/uninstalled webhook.
• Shopify catalog snapshot + scores: 30-day grace window after uninstall (so a reinstall is seamless), then fully purged.
• Stripe concierge audit records: kept for 7 years (HMRC requirement for invoices).
• Server logs: 90 days hot, then archived to cold storage for up to 13 months for fraud and abuse investigations.

We use the following processors. Each is bound by a written data processing agreement. None receive more data than required.

• Google Vertex AI (europe-west1) — LLM inference for Tier 2 enrichments.
• Microsoft Azure OpenAI (swedencentral) — LLM fallback.
• Resend (EU) — transactional email (report delivery, app alerts).
• Stripe (UK/Ireland) — payment processing for concierge audits, Agency, and Plus tiers.
• Sentry (EU) — error tracking. PII scrubbed at source.
• Plausible Analytics (Plausible Insights OÜ, Estonia · EU) — cookieless product analytics. No IP storage, no cross-site tracking, no advertising profile. Per ADR 0013.
• BetterStack (EU) — uptime monitoring (no user data).
• Digital Ocean (UK) + Coolify — infrastructure.
• GS1 GEPIR (optional, rate-limited) — GTIN verification.

Most processing is within the UK/EU (including our Vertex AI region pin to europe-west1). Any transfer outside the UK/EEA happens only under an adequacy decision or Standard Contractual Clauses (SCCs) as published by the European Commission, supplemented where required. We do not transfer data to countries without adequate safeguards.

Under UK GDPR you have the right to:

• Ask what we hold about you (subject access request)
• Have inaccurate data corrected
• Have your data deleted (right to be forgotten)
• Restrict or object to our processing
• Receive your data in a machine-readable format (portability)
• Withdraw consent at any time

Email privacy@flintmere.com. We respond within 30 days and usually within three working days.

If you’re not satisfied with our response you can complain to the Information Commissioner’s Office (ICO): ico.org.uk/make-a-complaint.

Shopify access tokens are encrypted at rest with AES-256-GCM using a key stored outside the database. All webhooks are HMAC-verified. All traffic uses TLS 1.2 or higher. We run regular dependency scans and follow a documented incident-response procedure. Full details: flintmere.com/security.

We use one functional cookie on audit.flintmere.com for CSRF protection. We do not use tracking, analytics, or advertising cookies on the marketing site. Full details: flintmere.com/cookies.

If we make material changes, we’ll email Shopify app users 30 days in advance and update the “Last updated” date at the top of this page. Non-material corrections (typos, clarifying language) are pushed without notice but always reflected in the date.