Privacy notice
- Who we are
- Two situations, two different roles
- What we process and why
- Legal bases
- Where the data comes from
- How long we keep it
- Who else is involved
- Transfers outside the EEA
- How the data is protected
- Data you must never send us
- Counters on this site
- The private statistics page
- Requests from third parties
- Automated decisions
- Children
- If something goes wrong
- Your rights
- Complaints
- Changes to this notice
- Contact
1. Who we are
DK Automation is a trading name currently used by an individual resident in Bulgaria, operating the supplier-feed service described at dkautomation.dev/feed-audit. One person does the work; there are no staff and no offices.
Contact for anything in this notice, including rights requests: hello@dkautomation.dev. We have not appointed a data protection officer, because the scale of processing does not require one.
2. Two situations, two different roles
These are not the same in law, and confusing them is the usual source of trouble in white-label work.
Your own details — we are the controller
When you fill in the form on this site or write to us, we decide how those details are used. Most of this notice is about that.
Files you send us for work — we are a sub-processor
When an agency sends a supplier file, the chain is: the merchant who owns the store is the controller, the agency is the processor, and we are a sub-processor. We act only on the instructions we are given. We do not decide what happens to that data, do not use it for any other purpose, do not enrich it, do not train anything on it, and do not keep it beyond section 6.
If your client asks you for a list of sub-processors, we are the sub-processor and the services we rely on are listed in section 7. If a formal data-processing agreement is required, we will sign a reasonable one; where it conflicts with this notice, that agreement wins on data-protection matters.
3. What we process and why
| Category | What it is | Why |
|---|---|---|
| Enquiry details | Name, work email, phone if you give it, the message, the store URL, and which of agency / merchant / other you selected | To answer you, prepare a trial and agree scope |
| Correspondence | Emails between us and any attachments | To run the engagement and to have a record of what was agreed |
| Supplier files | Product data: article numbers, titles, prices, stock, image URLs. Normally no personal data at all | To perform the work you ordered |
| Billing records | Invoice details, the fact and amount of payment | Accounting and tax obligations |
| Site counters | Anonymous totals, described in section 11 | To tell whether the page works |
| Optional updates | Your email, if you tick the second box | Occasional notes about new free tools |
Card details are never seen or stored by us: payment goes to Stripe directly.
4. Legal bases
Where the GDPR applies, we rely on:
- Steps at your request before a contract, and performance of the contract (Art. 6(1)(b)) — for enquiry details, correspondence and delivery of the work.
- Legal obligation (Art. 6(1)(c)) — for invoices and payment records kept for accounting and tax.
- Legitimate interests (Art. 6(1)(f)) — for keeping a limited record of what was agreed, for protecting the service against abuse, and for the anonymous counters in section 11. Our interest is running a small service honestly and being able to show what was agreed; we have weighed it against your interests and consider the impact minimal, because the data is ordinary business-contact data and is not combined, profiled or sold. You may object at any time (section 17).
- Consent (Art. 6(1)(a)) — only for the optional service updates. Ticking that box is separate from sending the form, leaving it unticked changes nothing else, and you can withdraw at any time without affecting anything already done.
For supplier files we process on the documented instructions of the agency, as sub-processor, and the legal basis for that processing is the controller’s to determine, not ours.
5. Where the data comes from
Everything comes from you: what you type into the form, what you write in email, and the files you choose to send. We do not buy contact lists, do not scrape personal data, and do not enrich what you give us from third-party sources.
Where we contact an agency first, we use a business contact form published on their own website for that purpose, and the message identifies who we are and why we are writing.
6. How long we keep it
| What | Kept for |
|---|---|
| Enquiry that did not become work | No longer than 30 days after the last contact |
| Supplier files and the outputs made from them | Deleted no later than 30 days after delivery |
| Files under paid monitoring | Current file and last comparison snapshot, for as long as monitoring runs, then deleted 30 days after it ends |
| Correspondence about a paid engagement | Up to 3 years after the last order, to be able to answer questions about work done |
| Invoices and payment records | As long as accounting and tax rules require; not deleted on request |
| Site counters | Up to 400 days, as anonymous totals only |
You can ask for earlier deletion at any time. If you do, monitoring stops with it, and we cannot afterwards reproduce or re-supply a deliverable that has been deleted.
7. Who else is involved
These are the only third parties, and each sees only what it needs:
| Service | What it does | What it sees |
|---|---|---|
| Cloudflare | Hosts the site and the form, routes incoming mail | The request itself, including your IP address, as any host does |
| The mailbox that receives forwarded mail | The correspondence | |
| Stripe | Payments | Billing and card data, directly — never through us |
| placehold.co | Two placeholder images on the demo page | Your IP address and standard browser data when that page loads |
| Matrixify | The import app inside your own Shopify store | Nothing from us — it is your contract with them, and we send them no data |
Nothing is subcontracted to any other person. If that ever changes, this list changes first, and we will tell you before it applies to your data. We do not sell personal data, do not use it for advertising, and do not use client files to train any model.
8. Transfers outside the EEA
The work is done in Bulgaria, inside the EEA. Some of the providers above are established in the United States and may process data there or in other countries.
Where that happens, the transfer is covered by the providers’ own standard contractual clauses and equivalent safeguards, which we accept as part of their terms. We do not initiate any other transfer, and we do not move client files outside the providers listed in section 7.
You can ask us which provider holds what, and we will answer plainly.
9. How the data is protected
Plainly, and without pretending to be an enterprise:
- All connections to the site and the form are encrypted; the site is served over HTTPS only.
- Enquiries are stored in Cloudflare’s key-value storage with an automatic 30-day expiry, so deletion is not dependent on anyone remembering.
- The private statistics page is behind a password and a signed cookie; a forged cookie gets the login form, not the data.
- Access to files is limited to one person on their own equipment. There are no staff accounts and no shared drives.
- Secrets and credentials are held outside the codebase; nothing is committed to a repository.
- Supplier files are not copied to third-party tools, cloud drives or AI services for processing.
No system is perfectly secure, and we will not claim otherwise. What we can say is that the attack surface here is deliberately small: fewer services, fewer copies, shorter retention.
10. Data you must never send us
Send product data only. Do not send store passwords, API tokens or keys, payment-card data, customer lists, order histories, or any personal data of shoppers or staff.
If such data reaches us anyway, we delete it as soon as we notice, tell you that we did, and do not use, copy, retain or transmit it. This is an obligation on both sides, not a disclaimer: yours not to send it, ours to destroy it rather than quietly work around it.
11. Counters on this site
We count how the page is used, so we can tell whether it works: page views, which button was clicked, whether the form was opened, whether someone began filling it in, and whether a request was sent.
Each of these is stored as a number and nothing else. Next to the number we keep the country the request came from as reported by the network, whether the device is a phone or a desktop, the domain you arrived from, and any campaign tag present in the address.
Since 28 August 2026 we also count three further things, each of them a plain total in the same way: the hour of the day in UTC a page was opened, which page of this site it was (the path only, never the query string), and how far down the page someone scrolled, recorded in four steps — a quarter, half, three quarters, and the end. The scroll figure is sent at most once per step per visit and tells us where readers stop, not who they are.
What is never stored: your IP address, the full address of the page you arrived from, and anything that identifies you.
There are no cookies on this site and nothing is written to your browser. One exception exists and it is not about you: the operator can mark his own browser, from his own device, so that his test visits are left out of the counters. That marker is set only by hand, only on his machine, and is never given to visitors. No third-party analytics service is used. The counters are plain totals, so they cannot be traced back to a person, cannot be linked to a request you send through the form, and cannot be used to recognise you on a later visit. That is also why we cannot count unique visitors: doing so would require storing an identifier on your device, and we decided the measurement was not worth it.
How one page opening is recorded. When this page opens, a random identifier is created in the memory of that browser tab. It records one opening of one page — not you, and not a device. It is never stored on your device, never sent to any third party, and disappears when the tab is closed or reloaded; a reload produces an unrelated new identifier. Against it we record which sections were reached, how far the page was scrolled, which button was pressed, and whether the form was opened, started or sent, together with the country reported by the network, whether the device is a phone or a desktop, the domain that linked here, and any campaign tag in the address. We do not record your IP address, the full address you came from, or any fingerprint of your browser, and none of it is linked to the details you send through the form — a sent form appears there as the word “sent” and nothing else. These records are deleted automatically after 14 days. Because nothing is stored on your device, we still cannot tell a returning visitor from a new one, and we do not try to.
12. The private statistics page
The counters above are shown on a page that is not public. It is protected by a password and, after login, a cookie set on that page only. That cookie exists solely to keep the operator logged in; it is not set for visitors of this site and is not used for tracking.
That page also lists enquiries received through the form — date, name, work email, the role you selected and what you asked about — for the 30 days they are retained under section 6. This exists so that an enquiry is not lost if an email fails to arrive or is filtered as spam. It is the same data you sent us, shown to the same one person who would have read the email, and it is not shared, exported or used for anything else. Nothing about site visitors who did not fill in the form appears there.
13. Requests from third parties
If a court, regulator or law-enforcement body asks us for data, we will check that the request is lawful and limited before answering it, provide only what is required, and tell the affected party unless we are legally forbidden from doing so.
We have never received such a request. If that changes, this paragraph will still be true.
14. Automated decisions
We make no decisions about you by automated means, and we do not profile you. The scripts we run analyse product data, not people.
15. Children
This is a business-to-business service and is not directed at children. We do not knowingly collect data about anyone under 16. If such data reaches us, we delete it.
16. If something goes wrong
If data is lost or exposed in a way that could affect people, we tell the agency that sent it without undue delay and give what we know — what happened, when, what data was involved and what we have done — so that the agency and its client can act.
We do not decide on the controller’s behalf whether a notification to a regulator or to affected people is required. That is their call, and our job is to give them what they need to make it quickly.
17. Your rights
Where the GDPR applies you can ask us to:
- confirm what we hold about you and give you a copy (access);
- correct anything inaccurate (rectification);
- delete it (erasure), except where we must keep it for accounting or tax;
- restrict processing while a question is being resolved;
- provide it in a portable format;
- object to processing based on legitimate interests;
- withdraw consent to the optional updates, at any time.
Write to hello@dkautomation.dev. We answer within 30 days, and usually within one business day, because there is not much to look through. We will not charge for a request and will not ask for more identification than we need to be sure it is you.
Where the data in question is a client file, we are the sub-processor: we will pass the request to the agency that sent it and assist them, rather than act on it ourselves, because it is not our data to decide about.
18. Complaints
If you are unhappy with how we handled your data, tell us first — it is usually faster. You also have the right to complain to a supervisory authority.
Ours is the Commission for Personal Data Protection of the Republic of Bulgaria (Комисия за защита на личните данни), cpdp.bg. If you are in another EEA country, you may complain to your local authority instead.
19. Changes to this notice
We may update this notice. Each version carries a number and a date at the top of the page. Changes that materially affect how your data is used will be communicated to active clients by email rather than quietly published.
20. Contact
Anything at all about this notice, including things you think are missing: hello@dkautomation.dev.