Privacy policy

Last updated: 31st October 2026

PIDReady is a Shopify app that helps merchants prepare the product identifiers EU customs ask for. This policy explains what information it collects when a store uses it, why, how long it is kept and the choices you have.

Who we are

PIDReady is provided by Alejandro Oberogo, Beechwood Grove, Manchester, M9 4ND, United Kingdom (“we”, “us”), the controller of the personal data described here. You can contact us at support@pidready.com.

What we collect

PIDReady only asks Shopify for permission to read and edit products and inventory. It cannot see your customers or your orders. We store:

• Store details: your store's myshopify.com address and name, the country of the store address in Shopify (so the app can mention your country's carriers, such as Royal Mail), the language of your Shopify admin, your PIDReady plan and settings, and when you installed and last opened the app.
• Store owner's email address: only if you say yes to PIDReady's emails, the address Shopify holds for the owner of your store, so we can send you the few emails described below, and a record of which of them we sent to your store (not what they said). If you stop the emails, we delete the address.
• Access credentials: the tokens Shopify issues so PIDReady can work with your store. They are stored encrypted.
• Product data: for each product variant, what is needed to check and export customs identifiers: product and variant titles, status, vendor, product type, collections, SKU, manufacturer reference (and, to suggest a missing one, the MPN entered for the Google & YouTube channel or the metafield you choose in Settings), barcodes, HS code, country of origin, whether it needs shipping, your exclusions, the status PIDReady works out and, if you ask for them, the customs codes suggested for them by Anthropic's Claude (below).
• Work records: catalogue scans, the changes you make through PIDReady (so they can be undone), the files you import (Excel or CSV) and background tasks.
• Technical records: our server logs each request (time, page address without its parameters, result, duration and store address) and any errors. We don't log IP addresses, access tokens or what you send. To protect the service from abuse, requests to public pages are counted per IP address in memory for one minute; that count is not stored. Our hosting provider also keeps its own request logs, which can include IP addresses and browser details.
• Store check (pidready.com/check): the store address you type is used to read that store's public product list. We keep the result in memory for one hour, so a link you share opens fast, and then it is gone; it is not saved in our database and our logs and error reports don't record it. Checks are counted per IP address in memory for one minute to stop abuse. Our hosting provider's own request logs may include the address in the page link.
• Support messages: if you email support@pidready.com, we receive your email address and what you write.
• Suggestions: what you write in “What should we build next?” on the app's Home page, with your store's address and the date. They are not logged.

Product data is information about products, but it can identify a person when a store is run by one (for example, a store named after its owner), so we treat all of it with the same care.

Cookies

The app. PIDReady sets one cookie, pidready_locale, which remembers the language of your Shopify admin for up to a year so the app opens in that language. It is not used for tracking, and the app has no advertising or analytics trackers. It runs inside your Shopify admin and uses Shopify's own scripts (App Bridge and Polaris), which Shopify's privacy policy covers.

This website (pidready.com). A banner asks for your choice. Until you choose, nothing from Google or Meta is loaded and no analytics or advertising cookie is set. “Reject all” and “Accept all” are equally easy, and “Choose” lets you allow analytics and advertising separately. Your choice is saved for 180 days in one cookie of our own, pidready_consent, which is strictly necessary to remember it. You can change it at any time with “Cookie settings” in the footer of every page: withdrawing consent deletes the cookies listed below and stops the tags. If your browser sends a Global Privacy Control signal, the advertising tags stay off. The legal basis is your consent.

• Analytics: Google Analytics 4 (Google). Cookies _ga and _ga_ followed by the measurement ID, for up to two years. It tells us which pages are viewed, how often the install buttons and the done-for-you link are clicked (and where on the page), and how often the pricing page is viewed, with browser, device and approximate location details.
• Advertising: Google Ads (Google). Cookies such as _gcl_au and _gcl_aw, for up to 90 days. It tells us whether visits and install clicks came from our ads, and may be used to show you our ads elsewhere.
• Advertising: Meta Pixel (Meta). The cookie _fbp, for about three months, and _fbc if you arrive from a Meta ad. It sends Meta the pages you view and the same button clicks, so we can measure our ads and Meta may use them to show you our ads.

Google and Meta may process this data outside the UK and the EU, under their own terms and privacy policies. We receive reports from them; we do not sell the data.

Why we use it

• To provide PIDReady to your store: scanning your catalogue, showing what is missing, saving your changes to Shopify, undoing them, exporting files and keeping the report up to date. Legal basis: performing our contract with you.
• To keep PIDReady secure and working: logs, error reports and abuse protection. Legal basis: our legitimate interest in running a secure, reliable service.
• To email the owner of your store, only if you say yes in PIDReady (on its Home page or in Settings, where you can also say no again): a quick start when you say yes on Home, an offer of help the next day if nothing has been fixed yet, a thank-you when you choose a paid plan, one email when every product you ship is ready for EU customs, at most one a week when products you add need customs data, and one question about what was missing if you uninstall PIDReady. Each has a one-click unsubscribe. Legal basis: your consent.
• To answer your support requests. Legal basis: our contract with you, or our legitimate interest in helping you.
• To decide what to build next, from the suggestions you send. Legal basis: our legitimate interest in improving PIDReady.
• To keep business and tax records. Legal basis: legal obligation.

We don't sell personal data, use your store's data for advertising or make automated decisions about you with it.

Payments

If you subscribe to a paid plan, Shopify bills you and processes the payment. We never see your payment details. We receive your store's name and the amounts in Shopify's payout records and keep them for as long as UK tax law requires.

Who we share it with

We use these providers, who process data only on our behalf and under data processing terms:

• Railway Corporation: hosting and database. Our servers and database are in Railway's EU West region (Amsterdam, the Netherlands).
• Sentry (Functional Software, Inc.): error monitoring. Error reports contain your store address and technical details of the error, not IP addresses, what you send or access tokens.

Railway and Sentry are based in the United States; where they transfer personal data there, their data processing terms include the safeguards data protection law requires, such as standard contractual clauses.

Support emails: our domain registrar, Namecheap, forwards the emails you send to support@pidready.com to Gmail (Google), where we read and answer them. Namecheap and Google handle these emails under their own terms and privacy policies.

Emails we send you: we send them through Zoho Mail (Zoho Corporation), and a copy of each goes to our support inbox in Gmail, where your replies arrive too. Zoho and Google handle these emails under their own terms and privacy policies.

Customs code suggestions: when your store has no similar product to learn from, PIDReady looks up a product's type, or a few words of its name, in the UK Government's public Trade Tariff service (HM Revenue & Customs). Only those words are sent, never your store's name or anything about a person, and the answers are kept for 30 days, shared by every store, so the same words are not asked again.

Suggested customs codes from Claude (Starter and Pro, only when you ask for them on the Fixes page): for the products with nothing in your store to copy a code from, PIDReady sends what each product says about itself (its title, product type, vendor, variant and option names, tags and description, read from Shopify at that moment) to Anthropic, PBC, whose language model Claude suggests a code. Nothing about your customers or your orders is sent. Anthropic processes it on our behalf under its commercial terms: it does not use it to train its models and deletes it within 30 days, unless its safety systems flag it for misuse. Anthropic is based in the United States, and its terms include standard contractual clauses for such transfers. We keep the code it suggested for each product (not what was sent) with your product data.

PIDReady works through Shopify, which handles your store's data under its own terms and privacy policy. We may also disclose information when the law requires it.

How long we keep it

• Store details (including the store owner's email address and the record of the emails we sent), product data, access credentials and your suggestions: while PIDReady is installed.
• History of changes: 30 days. Imported files: 7 days.
• Catalogue scans: 90 days (the latest one is kept while PIDReady is installed). Records of background tasks: 3 to 30 days.
• When you uninstall PIDReady, its access tokens are deleted at once. Shopify asks us to erase your store's data 48 hours later and we delete everything we hold about your store then (if that request never arrives, we delete it after 30 days). The values you saved in Shopify stay in your store.
• Database backups: deleted automatically after at most 90 days.
• Server logs: up to 30 days. Error reports: up to 90 days.
• Support emails, and the emails we send you with your replies: up to two years after the conversation ends.
• Billing records: as long as UK tax law requires.

Your customers

PIDReady does not process personal data about your customers. Shopify's privacy requests about customer data (data requests and erasure) are answered automatically: there is nothing to return or delete.

Security

All connections use HTTPS. Access tokens are encrypted in the database (AES-256-GCM), and each store's data is kept separate and deleted as a whole. Access to the systems that hold your data is limited to us.

Your rights

Under UK and EU data protection law you can ask us for a copy of your personal data, and ask us to correct or delete it, to limit or stop using it, or to send it to you or someone else in a common format. Email support@pidready.com and we will reply within one month. Uninstalling PIDReady deletes your store's data as described above.

If you are unhappy with how we handle your data, please tell us first. You can also complain to the Information Commissioner's Office (ico.org.uk) or, in the EU, to the data protection authority where you live or work.

Changes to this policy

We will post any changes on this page and update the date at the top.