Privacy Policy

This notice covers the 100 Rocks merchant console (get.100.rocks) and our processing of storefront shopper data on your instructions. Marketing site visitors should read 100.rocks/privacy.

Who we are and our roles

100 Rocks is operated by Karen Charykov, Entrepreneur individuel (EI), trade name 100 Rocks. We provide storefront analytics, adaptive interface testing, and design-token tooling for Shopify merchants. For merchant console accounts we are the data controller. For shopper analytics on your storefront we act as your data processor under GDPR Art. 28 (see our Data Processing Addendum in Terms of Service). Privacy requests are handled through help@100.rocks; no separate data protection officer is appointed today.

Merchant account data

We process the following categories for console users:

• Identity and contact: email, display name, avatar
• Authentication: credentials, session tokens, sign-in metadata
• Account settings: language preference, organization and project configuration
• Compliance records: terms acceptance version and timestamp, store ownership and design-rights attestations
• Billing references: Stripe customer, subscription, product, price, and entitlement identifiers (payments, invoices, tax IDs where configured, and refunds handled by Stripe)
• Support and product telemetry: operational logs linked to your user id where needed to run the service

Shopify app data

When you connect the 100 Rocks Shopify app, we process store and install data needed to provide the app: shop domain, Shopify shop identifiers, OAuth/install status, app scopes, Web Pixel setup status, theme app embed status, and commerce events made available through Shopify's Web Pixel sandbox. We do not intentionally collect payment card data through the app.

Purposes and legal bases (GDPR)

• Provide and secure the console (account data, auth, project settings) — contract (Art. 6(1)(b)) and legitimate interests in security (Art. 6(1)(f)).
• Billing and subscription management (Stripe references) — contract (Art. 6(1)(b)) and legal obligation for tax/accounting records where applicable (Art. 6(1)(c)).
• Compliance and audit (terms acceptance, attestations, deletion audit rows) — legal obligation and legitimate interests (Art. 6(1)(c) / (f)).
• Support and service improvement (support correspondence, limited telemetry) — legitimate interests (Art. 6(1)(f)); you may object where applicable.

Retention — merchant account

• Profile, projects, and settings: until you delete a project or your account.
• Terms acceptance metadata: deleted with your account; minimal deletion audit may retain an opaque user id.
• Stripe invoices, payment history, tax IDs where configured, and refund records: retained by Stripe under their legal obligations.
• Product telemetry: user identifier removed when your account is deleted.

Storefront shopper analytics (processor)

When you install the tracker, we process shopper traffic on your instructions. You are responsible for your storefront privacy notice and consent mechanism. Tier 1 (audience-only) runs without behavioral signals; Tier 2 (behavior-capable) runs only after explicit shopper consent where required.

Data categories include page URLs, navigation paths, device and browser class, viewport, locale, truncated IP (IPv4 /24 or IPv6 /48), and an opaque per-tab session key in sessionStorage. We do not set HTTP analytics cookies. Behavioral tier adds pointer metrics, scroll depth, hesitation signals, and session replay after consent.

Shopify compliance webhook requests and storefront shopper requests should be routed through you as controller. We support merchant DSAR and deletion workflows, including Shopify privacy requests where the app receives them, according to the DPA and applicable law.

AI-assisted design tooling

When a merchant triggers a design-token or site scan, 100 Rocks may process public storefront page content, screenshots, computed styles, fonts, and derived design evidence to suggest brand-safe interface changes. This workflow is merchant-initiated and is not intended to send shopper names, emails, payment data, or cart identity to AI subprocessors. Merchants review generated outputs before applying them.

Retention — storefront analytics

• Raw events: 90 days
• Sessions and session metrics: 12 months
• Daily rollups and page layout references: 24 months
• Consent log (behavior tier): 25 months

Automated monthly pruning runs on EU-hosted database infrastructure. Aggregated rollups do not hold per-session behavioral scalars.

Sub-processors

We use Supabase (database and authentication), Vercel (application hosting and CDN), Stripe (payment processing, subscription billing, invoices, refunds, and tax IDs where configured), Shopify (app install, admin APIs, and Web Pixel), and AI/compute providers for merchant-initiated design tooling. Our primary application functions and database/auth storage are configured in Paris/EU regions where supported by these providers. These providers are bound by data processing terms where applicable. CDN, security, support, logging, billing, Shopify, payment, or AI/compute operations may still involve transfers outside the European Economic Area; where a transfer requires safeguards, we rely on adequacy decisions, data processing terms, and Standard Contractual Clauses or equivalent safeguards.

Your rights

Depending on your jurisdiction you may have rights to access, rectify, erase, restrict, object to, or port your personal data, and to lodge a complaint with a supervisory authority.

• Merchant account: download your data or delete your account from Account → Data.
• Storefront shoppers: direct requests to you (controller); we assist via the console DSAR purge tool.

You may also withdraw consent where processing is based on consent. You can lodge a complaint with your local supervisory authority; in France, this is the CNIL.

We do not sell personal data. Contact help@100.rocks — we aim to acknowledge within 72 hours and respond within 30 days.