Privacy policy

The file you upload. A Shopify or Amazon settlement export. It contains your order references, amounts, fees and SKUs. Some Shopify exports also carry the customer’s first and last name. Those two columns are dropped as the file is read and are never stored with your audit; they remain only in the uploaded file until it is deleted. It is used to produce your audit. Our audit log keeps only its size, a fingerprint of it (a SHA-256 hash) and counts such as how many findings it had, never the contents, as the data retention page explains.

An anonymous session identifier. A random value in a cookie so you can see the audits you started on this device. It identifies a browser, not a person.

Your email address and payment reference, if you pay. Your email is collected by our payment provider at checkout, who send your receipt. When a payment succeeds, they tell PayoutCheck your email and the payment reference, and both are stored with the record of your payment. This is so for a single report as well as for a 3-Month Pass. The email is erased 120 days after payment; the payment reference is kept. PayoutCheck sends no email at all and never has: your audit link and, if you buy one, your pass code are shown to you on screen and are never posted to you.

If you buy a 3-Month Pass, your email and payment reference. Stored against the pass for one purpose: a pass is reached by a code, there is no email to re-send it with, and somebody who loses their code otherwise has no way back to what they paid for. These two let us find your pass from your payment receipt when you ask us to. The code itself is stored only as a one-way hash, so nobody here can read it back out - recovering a lost pass issues a new code and retires the old one.

Basic request information. IP address and timing, used to apply rate limits and to investigate abuse. Addresses kept with a record are erased after 30 days, and the access log of the web server, which records every request, is deleted within 15 days.

No card details, which go to our payment provider and never reach our servers. No advertising or analytics trackers. No third-party fonts, so loading a page does not tell anyone else you visited. Nothing from your store beyond the file you chose to upload, because PayoutCheck never connects to your platform account.

Hostinger, for hosting and support email. PayoutCheck runs on a Hostinger server, which Hostinger also backs up every week, and our support email, support@payoutcheck.online, is a Hostinger mailbox. Hostinger therefore holds everything stored on that server, and the emails you send to that address.

Dodo Payments, for payments only. Dodo is the merchant of record for the sale and receives the email address and payment details you give them at checkout. From us, Dodo is given which product you are buying, an internal id for your audit or pass, and your audit link (or your pass code) as the address to send you back to. We never see your card.

PayoutCheck itself sends no email. Nothing is sold, to anyone, ever.

Your uploaded file is deleted within 25 hours of the audit finishing. Audit results include a copy of every row of your file with its original text, less any customer name columns. A free check is deleted within 25 hours of the audit finishing. A paid report is kept 3 days after payment, and a report opened with a 3-Month Pass until the pass ends, and at least 3 days. If you pay, your email is erased from our records 120 days after payment. IP addresses kept with a record of an upload or a deletion are erased after 30 days. A copy of the database is taken before each update to the software and the newest 5 are kept, so deleted data can remain in one until it is replaced. Our hosting provider also keeps weekly backups of the whole server, the latest few (currently two), so deleted data, including an uploaded file and the key that decrypts it, can remain in one of them for up to about two weeks. The full schedule, and the reason for each window, is on the data retention page.

You can delete any audit and its file immediately from the audit page. A copy already in a backup is removed later, as explained above. You can ask what is held about you and ask for it to be erased, by writing to the address below. Where the law gives you rights over your personal data, including the UK and EU General Data Protection Regulation, those rights apply here and we will not ask you to justify using them.

Two, both strictly necessary, and each set only when it is needed. pc_anon is a random identifier, set when you first upload a file, so this browser can find the audits it started; it lasts a year. pc_pass is set only if you open a report with a 3-Month Pass: it holds your pass code so you do not have to paste it again on this device, and it lasts 90 days, the length of a pass. Neither can be read by scripts on the page, and neither is sent anywhere but this site. There are no advertising or analytics cookies, so there is no consent banner to click through.

PayoutCheck is run by Muhammad Afzal Ubbais, a sole proprietor in India. Contact: support@payoutcheck.online

Write to support@payoutcheck.online for anything on this page, including a request to see, correct or delete what is held about you.