← Back to Profitr

Privacy Policy

Effective 2026-05-08

Profitr is a service operated by Optana Ltd. ("Optana", "we", "us"), a company registered in England and Wales under company number 16486606, with registered office at 21 Portman Mews, Aylesbury, HP19 7AX. We are the data controller responsible for your personal data. Our ICO registration is [BACKFILL — ICO registration #]. You can contact our data protection lead at support@profitr.co.uk.

This policy explains what personal data we collect, why we collect it, how we use and protect it, who we share it with, and the rights you have under the UK GDPR and the Data Protection Act 2018.

1. Information we collect

  • Account data: email address, hashed password, account creation date.
  • Subscription data: plan tier, subscription status, billing history (payment card details are handled by Stripe — we never see or store them).
  • Application data: inventory items, sales records, expenses, recurring expenses, expense categories, fixed assets, investment lots, and any other content you create inside Profitr.
  • Usage data: pages visited, features used, error logs, and aggregated analytics events (only when you have consented to analytics cookies).
  • Communications: any emails you send to us at support@profitr.co.uk or support@profitr.co.uk.
  • Bank transaction data — when you upload a CSV bank statement to the reconciliation feature, we ingest the transaction rows (date, amount, description, merchant where present). This data is stored in our database, encrypted at rest, and never shared with third parties. You can delete individual transactions via the reconciliation interface, or all of them via account deletion.
  • eBay seller account data (when connected) — if you connect your eBay seller account via OAuth, we receive your eBay seller user ID, an access token and refresh token, and order/listing data (line items, sold prices, fees, buyer usernames, shipping costs, listing IDs). Tokens are encrypted at rest with AES-256-GCM. We honour eBay's Marketplace Account Deletion notification: if your eBay account is closed, we delete all your eBay-derived data automatically. You can also disconnect at any time from Settings → Integrations, which revokes the tokens and clears the stored data.

2. Lawful bases for processing

  • Contract (UK GDPR Article 6(1)(b)): to provide Profitr and the features your subscription includes.
  • Legitimate interests (Article 6(1)(f)): to keep the service secure, prevent abuse, debug errors, and improve the product. We balance these against your rights.
  • Consent (Article 6(1)(a)): for non-essential cookies (analytics) and any optional marketing communications. You can withdraw consent at any time.
  • Legal obligation (Article 6(1)(c)): to keep tax, accounting, and audit records that UK law requires us to retain.

3. How we share your data (subprocessors)

We rely on a small set of third-party service providers to run Profitr. Each is bound by contract to use your data only as instructed by us:

  • Supabase (Supabase Inc., USA + EU regions) — database, authentication, file storage. UK data is hosted in the EU region.
  • Stripe (Stripe Payments UK Ltd. and Stripe Inc., USA) — subscription billing and payment processing.
  • Postmark (ActiveCampaign LLC, USA) — transactional email delivery (sign-up confirmations, password resets, billing receipts).
  • Vercel (Vercel Inc., USA) — application hosting and content delivery.
  • Google (Google LLC, USA) — Google Tag Manager and analytics, only when you have consented to analytics cookies.

We do not sell your data, and we do not use it to train AI models.

4. International data transfers

Some of our subprocessors are based outside the UK. Where data is transferred out of the UK, the transfer is covered by either an adequacy regulation recognised by the UK government or by the UK International Data Transfer Addendum (UK IDTA) attached to the EU Standard Contractual Clauses. We review these safeguards annually.

5. How long we keep your data

  • While your account is active: we keep your application data for as long as your account exists.
  • After you close your account: we delete or anonymise application data within 30 days, except where we are legally required to keep it.
  • Tax and accounting records: retained for 6 years after the end of the tax year, in line with HMRC requirements.
  • Backups: deleted data persists in encrypted backups for up to 30 days before being permanently overwritten.

6. Your rights

Under UK GDPR you have the right to access, rectify, erase, or port your personal data; to restrict or object to certain processing; and to withdraw consent at any time. You also have the right to lodge a complaint with the UK Information Commissioner's Office (ICO) at ico.org.uk.

To exercise any of these rights, email support@profitr.co.uk and we will respond within one month.

7. Cookies

We use only two categories of cookies: strictly necessary(sign-in, security, basic functionality — always on) and analytics (Google Tag Manager — opt-in only). You can change your choice at any time via the cookie banner shown at the bottom of the site, or by clearing your site data in the browser.

8. Security

Data is encrypted in transit (TLS 1.2+) and at rest. Access to production systems is limited to authorised personnel and protected by multi-factor authentication. We review access logs and conduct dependency audits regularly.

9. Changes to this policy

We may update this policy from time to time. Material changes will be announced in-app or by email at least 14 days before they take effect. The "Effective" date at the top of this page reflects the current version.

10. Contact

Privacy queries: support@profitr.co.uk
General queries: support@profitr.co.uk
Postal: Optana Ltd., 21 Portman Mews, Aylesbury, HP19 7AX