Store owners
Privacy notice for owners of stores LeakBrief reads
How LeakBrief processes public data about your Shopify store under Art. 14 GDPR: what we read, why, how long we keep it, who sees it and how to object.
Who is responsible for this processing?
Luis Tschurtschenthaler, Italy, operates LeakBrief and is the controller of this processing.
Write to the address below about anything in this notice. privacy@leakbrief.com
Which data about my store does LeakBrief collect?
Only facts from your store's public pages: its domain and name, product titles and prices, a few counts, and whether key information shows on a product page.
- Your store's domain, name, currency and country
- From the public product catalog: product titles and handles, prices, how many variants show as sold out, and how many products have one image or a short description
- From up to two product pages: whether they show shipping costs, returns, pay-later options, ratings or reviews, and how much text they show
- Whether your shipping, refund and terms of service pages answer
- Google's public real-user speed data for your home page
We do not collect reviewer names, review text, customer data, email addresses, phone numbers or images of people.
When a store trades under a person's name, its name and domain can be personal data, which is why this notice exists.
Where does this data come from?
From pages anyone can open on your store without an account, and from Google's PageSpeed Insights API.
Why does LeakBrief process this data, and on what legal basis?
To let an agency prepare one short, evidence-based observation about your store before contacting you, based on legitimate interests under Art. 6(1)(f) GDPR.
The interest is business-to-business prospecting with a specific reason to get in touch that you can check yourself.
We keep the impact on you low: public pages only, a dozen polite requests at most, no profiling of people, briefs that are never public or indexed, and an opt-out that works at once.
We do not sell this data, train models on it or republish your catalog; a brief quotes only short evidence values.
How long does LeakBrief keep this data?
Raw page copies for 72 hours, teaser links for 30 days, and findings only as long as an agency's account needs them.
- Raw HTML copies of the pages, kept for debugging only: deleted after 72 hours
- Teaser links: they expire 30 days after the scan
- Briefs that no agency account claimed: deleted after 30 days
- Briefs in paying agency accounts: kept for up to 12 months
- Opt-out requests: kept for 12 months as a record, then deleted
- Your opt-out itself: kept for as long as LeakBrief runs, so your domain is never scanned again
Who receives this data?
The agency that asked for the brief, anyone that agency shares its teaser link or PDF with, and the providers that host LeakBrief.
Does this data leave the European Union?
Briefs are stored in the EU, but some providers process data outside it.
The database runs on Neon in Frankfurt, and files sit in Cloudflare R2's EU jurisdiction. Cloudflare serves the site from its global network, and Google receives your home page address to return its speed data.
What are my rights, and how do I object?
You can object at any time with the opt-out form, which stops all processing of your domain at once.
You also have the rights of access, rectification, erasure and restriction. Write to privacy@leakbrief.com to use them.
You can lodge a complaint with the Italian data protection authority, the Garante per la protezione dei dati personali, or with the authority where you live or work.
Is this your store? Request removal or correction at leakbrief.com/opt-out. We delete the brief and suppress future scans of your domain within 72 hours.
Does LeakBrief make automated decisions about me?
No: LeakBrief scores storefront signals to pick one observation, which has no legal or similarly significant effect on anyone.