1. Who is responsible for your data
Copywatch, which operates Copywatch (“we”, “us” or “our”), is the controller of personal data processed through this website and the Copywatch service.
If you have a privacy question or want to exercise a right, email us at hello@copywatch.io.
2. The data we collect
Account and billing data
We collect your email address, authentication records, account identifiers, subscription status, plan and billing references. We also store the controlled onboarding choices you make about the problem you face, how often it occurs and the size of the catalogue you want to protect so we can personalise setup and recommend an appropriate plan. Stripe collects and handles your full payment-card details; Copywatch does not receive or store them.
Store, product and monitoring data
During onboarding, the optional sample scan reads your public store URL, catalogue size and one example product image, then sends that image to a visual-search provider to return a possible-match count. We retain the store URL, catalogue and match counts, recommended plan, and sampled product title and image for up to 90 days so the same browser can return to its result. We do not retain the sample’s individual match URLs. If you later sign in on that browser, the sample record may be linked to your account. The sample does not import the store or start ongoing monitoring.
When you connect a store during account setup, we collect its public URL and catalogue information, including product names, descriptions, images and product links. We save which products you choose before checkout, but monitoring and provider searches do not begin until your subscription is active. We also store scan status, search results, possible matches, source URLs, dates and the review decisions you make.
Material you add
We store private notes, case details, contact information you choose to record, message drafts and edits, contact attempts, notification preferences and support communications. Please do not add sensitive personal data or third-party data that is not needed for your investigation.
Technical and security data
We receive information needed to operate and secure the service, such as IP address, browser and device information, request times, authentication cookies, logs, and error or abuse signals. A secure Copywatch return token remembers an anonymous sample-scan record for up to 90 days; the token itself does not contain the store URL or scan result.
Activity analytics
We use DataFast to understand page views, referral sources, progress through onboarding and whether key parts of the monitoring workflow are useful. Controlled events cover question completion, sample-scan success or failure, registration milestones, site import, product-count bands, plan selection, checkout and activation, scan-result views, review decisions, message preparation, recorded contact and case outcome states. We do not send the Shopify store URL, product title, match URLs, email address, account or record identifiers, free-text notes, message content or checkout identifier in these events. Our implementation uses DataFast’s cookieless script and disables automatic payment detection. It does not set a long-lived DataFast visitor cookie.
DataFast may still process your IP address, browser user-agent, site domain, page and referrer information, device details and activity events. It may use session-only browser storage and creates a pseudonymous identifier from technical signals using a salt that rotates approximately every 24 hours. This means analytics activity is not intended to build a persistent, named profile across days.
3. Why we use personal data
- To create and secure your account, provide monitoring, display results and save your work.
- To run the onboarding sample scan and recommend monitoring capacity based on the public catalogue size and store count you provide.
- To process subscriptions, enforce plan limits and administer billing.
- To run product-image and name searches, generate review-first message drafts and improve result quality.
- To send service messages and the match alerts you have enabled.
- To understand service usage, diagnose faults, prevent misuse and improve Copywatch.
- To meet legal, tax, accounting and regulatory obligations and establish or defend legal claims.
4. Our lawful bases
Where UK or European data-protection law applies, we process data as necessary to perform our contract with you, for our legitimate interests in operating, securing and improving Copywatch, to comply with legal obligations, and with consent where the law requires it. You may object to processing based on legitimate interests; we will assess your request against any compelling lawful reasons to continue.
5. Who processes data for us
We use carefully selected providers to deliver the service:
- Supabase for authentication, database and file-related infrastructure.
- Stripe for checkout, subscription billing and the customer billing portal.
- Vercel for website and application hosting.
- Resend for service and match-alert emails.
- DataFast for cookieless activity analytics.
- SerpAPI and Google Cloud Vision for visual and web-search results.
- OpenAI for assisted product-name searches and message drafting. Only the information needed for the relevant request is sent.
We may also disclose data to professional advisers, regulators, courts, law enforcement, or a buyer of the business where permitted by law. We do not sell your personal data.
6. Public sources and third-party websites
Copywatch searches public store and web content. Search results may contain information controlled by another website. Those sites have their own privacy practices, and opening a result or using a platform reporting route takes you outside Copywatch.
7. International transfers
Some providers may process data outside the United Kingdom or your home country. Where required, we rely on recognised adequacy decisions, approved contractual safeguards or another lawful transfer mechanism. You can contact us for more information about the safeguards relevant to your data.
8. How long we keep data
Anonymous onboarding sample-scan records are configured to expire after 90 days. We keep account and workspace data while your account is active and for a reasonable period afterwards so that we can provide the service, handle disputes and meet legal obligations. Retention depends on the type of record, why it was collected, legal requirements and security needs. Billing and transaction records may be kept for longer where tax or accounting law requires it. We delete or anonymise data when it is no longer needed.
9. Security
We use access controls, server-side credentials, encryption in transit, row-level database security and operational safeguards designed to protect your data. No online service can guarantee absolute security. Keep access to your email account secure and tell us promptly if you believe your Copywatch account has been compromised.
10. Your rights
Depending on where you live, you may have rights to access, correct, delete or obtain a copy of your data; restrict or object to processing; and withdraw consent without affecting earlier lawful processing. You may also complain to your local supervisory authority. In the UK, this is the Information Commissioner’s Office at ico.org.uk.
We may need to verify your identity before acting on a request. Some data may be retained where the law permits or requires it.
11. Children
Copywatch is a business service and is not directed to children. You must be at least 18 to create an account. If you believe a child has provided personal data, contact us so we can investigate.
12. Changes to this policy
We may update this policy as the service or law changes. We will post the revised version here, update the effective date and provide additional notice where a change materially affects your rights.