Privacy Statement

This privacy statement explains what personal data ShopReport processes, why, and what rights you have. ShopReport is a dashboard for online store owners who connect their Magento or WooCommerce store to see orders, inventory, and analytics in one place.

1. Who is responsible?

Data controller: 3webapps B.V., registered with the Dutch Chamber of Commerce (KVK) under number 61834890, located at Regulusweg 5, 2516 AC The Hague, the Netherlands. For privacy questions: [email protected].

2. What data we process

We distinguish three categories:

• Account data — name, email address, password (hashed), role (owner/admin), login history and, if enabled, two-factor authentication data.
• Shop data — the data your webshop synchronizes to ShopReport: orders, customer names and email addresses, products, and inventory. API connection credentials (such as Magento or WooCommerce access keys) are stored encrypted.
• Third-party connection data — if you choose to connect Google Analytics, Search Console, Merchant Center, Business Profile, or Google Ads, we receive and process the associated OAuth tokens and synchronized statistics. These connections are always optional and can be enabled or disabled per shop.

3. The Claude/MCP connector

ShopReport offers an optional connector that makes orders, products, and statistics available to Claude (Anthropic) via the Model Context Protocol. This only happens if you activate it yourself — either through an access token you create, or through an OAuth connection that you explicitly approve and for which you choose which shop is granted access.

When the connector is active, ShopReport only shares with Anthropic the data needed to answer the question you (or your AI assistant) asked — for example order overviews, product lists, or revenue figures for the connected shop, limited to what your subscription allows. No password, payment detail, or API key is ever shared. You can revoke the connection at any time via Settings → Connections or, for admins, via the admin panel.

For how Anthropic subsequently processes this data, please refer to Anthropic's privacy policy.

4. Why we process this data

• Providing the service itself (performance of the contract).
• Invoicing and payment processing via Stripe.
• Customer support.
• Security, fraud prevention, and preventing misuse (legitimate interest).
• The optional Google and Claude connections, solely based on your explicit choice (consent).

5. Who we share data with

• Stripe — for processing subscription payments. We do not store credit card details ourselves.
• Google — only if you activate a Google connection, for retrieving the connected statistics.
• Anthropic — only if you activate the MCP connector, and only for the shop you authorize for it (see item 3).
• Hosting provider — Hetzner, for running the application and database.

We never sell personal data to third parties.

6. Retention period

We retain data for as long as your account is active. After cancellation, we retain account data for a maximum of 90 days in case of reactivation and to meet statutory retention obligations (including tax retention periods for invoicing data), after which it is deleted or anonymized.

7. Security

Sensitive fields (API tokens, OAuth tokens, API keys) are stored encrypted. Connections run over TLS. Access to admin functions is restricted and logged in an audit log. We offer two-factor authentication for accounts.

8. Cookies

We use functional cookies to keep you logged in (session) and to prevent CSRF attacks. On our public website we place two first-party cookies (_vuid, _vsid) to measure aggregated visitor traffic — these do not contain personal data and are not shared with third parties.

9. Your rights

Under the GDPR you have the right to:

• Access to the data we process about you.
• Rectification of inaccurate data.
• Erasure ("right to be forgotten"), insofar as statutory retention obligations do not prevent this.
• Restriction of processing.
• Data portability — you can export your shop data from the dashboard.
• Objection to processing based on legitimate interest.
• Withdrawing previously given consent (e.g. disconnecting a Google or Claude connection), without affecting the lawfulness of processing already carried out.

You can exercise these rights via [email protected]. You also have the right to file a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).

10. Changes

We may amend this privacy statement. In the event of material changes, we will inform active users by email or via a notification in the dashboard.

11. Contact

Questions about this privacy statement? Email [email protected] or use the contact form.