Privacy statement

This statement explains which personal data WinWatcher collects, why, where it goes, how long it is kept and what your rights are. It covers both parts of WinWatcher: the website getwinwatcher.com (with the web dashboard) and the WinWatcher Chrome extension.

Summary

• WinWatcher is a research tool for public Shopify stores. It does not track your browsing, does not show ads and does not sell or share your data for advertising.
• Without an account, the extension keeps everything in your own browser and sends nothing to us.
• With an account, your WinWatcher data (followed stores, labels, scans, settings) is stored with your account so it syncs between your browsers and the web dashboard.
• Payments go through Mollie; we never see card or bank details.
• You can download or delete your data at any time, and delete your whole account yourself (Account → Your data), or email us.

Who is responsible

Ettekoven-IT, trading as WinWatcher, Molenstraat 28, 8081 BC Elburg, the Netherlands (Chamber of Commerce / KvK 76729249), is the controller for the data described here. Contact: [email protected].

1. The Chrome extension

What the extension reads in your browser

• The address (URL) of the page you open, to see whether it is a Shopify store or a product page, so it can show store information, the bestseller position and the badge on the icon. For this it requests public files of that store (such as /meta.json, /products.json and the store's public Storefront API) directly from your browser. The addresses of the pages you visit are not sent to us and not stored, except for the stores you choose to follow (see below).
• Meta Ad Library pages you open yourself: on facebook.com/ads/library the extension reads the number of results shown on the page right after a search for a store, to save the number of active ads of that store. It does not read your Facebook account, messages, friends or anything else.
• Public Meta Ad Library, Similarweb and Trustpilot pages, only when you chose the free "in your browser" method for active ads, visits or reviews: the extension opens the public page of a store in a background tab, reads the number (ads, monthly visits, review score) and closes the tab again.
• Public data of stores you research: product lists, prices, best-selling order, theme, checkout and installed apps, read from the store's public pages. This is information about businesses, not about you.
• Your browser and operating system (for example "Chrome 141 on Windows 11"), only when you connect the extension to your account, so you can recognise your connected browsers.

The extension does not collect your browsing history, passwords, form contents, keystrokes, messages, location, health or financial information, and it does not read the content of pages other than Shopify stores, the Meta Ad Library and the public Similarweb and Trustpilot pages described above.

Auto-follow (you can switch it off in Settings): when a Shopify store you open matches the rules you set (for example a number of products or a country), the extension adds it to the stores you follow. Only such Shopify stores are added (their address, name and the date); other websites you visit are never recorded.

All code of the extension is in the package you install from the Chrome Web Store; it does not load code from elsewhere. Its fonts are included too, so opening WinWatcher does not contact other servers.

What the extension stores

In your own browser (Chrome's extension storage): the stores you follow, your labels and lists, scans and their history, product catalogues, the scan log, your settings, and any keys you enter (Apify API tokens, a Discord webhook address, a Google Sheet link). To show "new since your last visit", the extension also remembers when you last opened a Shopify store in WinWatcher; that stays only in your browser and is never sent to us.

What the extension sends, and to whom

• To getwinwatcher.com, only when you are logged in (connected to an account): your licence check, the data listed under "Your WinWatcher data" below, and scans of the stores you follow (shared store data, see section 3). Without an account nothing is sent to us.
• To Apify (apify.com), only if you add your own Apify API token: the web addresses of the stores you look up, to get their ads, visits (Similarweb) or reviews (Trustpilot). The request is made with your own Apify account; Apify's terms and privacy statement apply.
• To Discord, only if you set up Discord alerts with your own webhook: a message about products that climb or ads that rise in stores you follow, posted to your own Discord channel, with the Discord user or role id you chose to tag. When you are logged in, our server sends the same alerts after its own scans, using your rules.
• To your own Google Sheet, only if you set one up (with your own Google Apps Script): the product you choose to save, with the columns you linked (such as name, link, store, price and currency, photo link, reason, market, research method and status).
• To open.er-api.com (a free exchange-rate service), only if you chose to convert prices in your sheet to another currency: the currency code of the store (for example "AUD"), to get today's exchange rate. Nothing about you or the product is sent.
• To the stores themselves and Meta: the normal requests your browser makes when it reads their public pages.

Permissions the extension asks for

• Access to websites: to recognise Shopify stores and read their public store data on any domain (Shopify stores use their own domain names), and to read the Meta Ad Library count.
• Tabs: to know which store or product page is open, and to open the dashboard, Ad Library or getwinwatcher.com in a tab when you click.
• Scripting: to show the store information bar and the small WinWatcher button on Shopify store pages.
• Storage and unlimited storage: to keep your data in your browser.
• Side panel and alarms: to show WinWatcher next to the page, and for scheduled syncing and scans.

Chrome Web Store: Limited Use

The use of information received from the extension complies with the Chrome Web Store User Data Policy, including the Limited Use requirements. Data is only used to provide and improve WinWatcher's single purpose (researching Shopify stores and products). It is not sold, not used or transferred for advertising, not used to determine creditworthiness or for lending, and not read by people except with your permission, for security (abuse, fraud), to comply with the law, or in aggregated, anonymous form for internal operations.

2. Your account on getwinwatcher.com

• Account: name, email address and password (stored only as a secure hash), when you confirmed your email and when you finished the welcome steps. To give you access and to contact you about your account. Legal basis: performance of the contract.
• Security: if you switch them on, two-step verification (an encrypted secret and recovery codes) and a list of IP addresses you allow to log in. To protect your account. Legal basis: contract and legitimate interest.
• Billing details: company name, VAT number, address, postal code, city and country. For invoices and to calculate VAT. Legal basis: contract and legal obligation (tax law).
• Subscription and payments: plan, status, amounts, dates, invoice numbers and the name of the payment method. Payments are processed by Mollie B.V.; we never receive your card or bank account number. Legal basis: contract and legal obligation.
• Connected browsers: for each browser where you connect the extension: a key (stored as a hash), the name you give it, the browser and operating system, the extension version, the IP address and the time it was last used. So you can see and disconnect your browsers, and to enforce the number of browsers in your plan.
• Your WinWatcher data (synced): the stores you follow with your labels, paused and hidden stores, scans and their history, your product lists and pinned items, the scan log, your settings and your dashboard layout. Your Apify API tokens and Discord webhook address are stored encrypted. So the same data is in every browser you use and in the web dashboard. Legal basis: performance of the contract.
• Activity log: logins and failed logins, connected and disconnected browsers, syncs (which kind of data and for which stores, from the extension or the website), scans you sent, alerts sent, payments and changes by administrators, with the time and IP address. For security, support and abuse prevention. Legal basis: legitimate interest.
• Emails: account emails (email confirmation, password reset), invoices, payment and trial notices. We keep a copy of each email we sent (to which address, when and its content, with password-reset and sign-in links removed), so we can help when an email did not arrive. We do not send newsletters without your permission.
• Technical logs: error logs of the website and the access logs of our host (IP address, browser and time of requests). When an error happens, the administrator gets an email with the error, the page and the email address of the account involved, to fix it quickly. For security and to solve problems. Legal basis: legitimate interest.

The website uses only the cookies it needs to work (your login session and protection against forged requests); see the cookie statement. There are no analytics, tracking or advertising cookies.

3. Shared store data

Information about Shopify stores (product counts, best sellers, catalogues and prices, number of active ads, visits, reviews) is public business information. When you follow a store and scan it while logged in, that store information is stored once and shared with other WinWatcher customers who follow the same store, with the date it was measured. Our server can also scan followed stores itself. When nobody follows a store any more, its store information is kept for a while, so whoever follows it again gets its history; the administrator removes old store information regularly. When you add stores, WinWatcher tells you how many other customers follow a store and since when there is data (only these numbers). Only information about the store is shared, never information about you: other customers do not see who follows or scanned a store, and your labels, lists and settings always stay private. Scans are checked against the store before they are shared.

The same goes for the apps and pixels found on stores: we keep one list of the apps that exist (their name and category), and which store uses which app. Customers only see the apps of the stores they follow themselves.

Who receives data

• Mijn.Host (the Netherlands): hosting of the website, database and email (processor).
• Mollie B.V. (Amsterdam, the Netherlands): payment processing.
• Apify, Discord, Google: only what you send there yourself, with your own account, as described in section 1.
• open.er-api.com: only a currency code, when you chose to convert prices (section 1).
• The tax authorities and other authorities, when the law requires it.

All data we store is stored in the European Union (the Netherlands). We do not sell data, do not share it with advertisers or data brokers, and do not use it for advertising or profiling.

How long we keep data

• Account, settings and synced WinWatcher data: as long as you have an account. You can delete your synced data yourself at any time (Account → Your data). When you delete your account (yourself in Account → Your data, or by asking us), your data is deleted right away; invoices and payments are kept for 7 years because Dutch tax law requires it, without anything else about you.
• Connected browsers: until you disconnect the browser or delete your account.
• Activity log: 60 days; sent emails: 90 days (the administrator can set shorter or longer periods, at most a few years).
• Error logs of the website: at most 14 days.
• Invoices and payment records: 7 years, as Dutch tax law requires.
• Data in the extension: in your browser until you remove it (Settings → Clear data) or uninstall the extension.

Your rights

Under the GDPR (AVG) you may ask to see, correct, export or delete your personal data, to restrict its processing, and to object to processing based on legitimate interest. Email [email protected] (or [email protected]); we answer within a month. You can also file a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens, autoriteitpersoonsgegevens.nl).

Security

The website and all connections from the extension use HTTPS. Passwords and browser keys are hashed; API tokens, webhook addresses and two-step secrets are encrypted. Administrators must use two-step verification and access to the admin panel is limited.

Children

WinWatcher is a business tool and is not meant for people under 16.

Changes

We may update this statement. The date at the top shows the latest version; important changes are announced by email.