Privacy and data policy

Last updated: 4 November 2026

Ferry Metrics ("we", "us") is a weekly profit-reporting service for online stores, run by Md. Farhan Islam. Contact: farhan@ferrymetrics.com.

This policy covers (1) client data we access to produce reports, and (2) people who visit ferrymetrics.com or receive email from us.

1. Client data

What we access

• Shopify (through a custom app the client creates for their own store with read-only scopes: read_orders, read_all_orders, read_products, read_inventory, read_shopify_payments_payouts): orders, line items, refunds, discounts, shipping charged, products and variants, inventory item cost ("cost per item"), and Shopify Payments payouts and balance transactions.
• Ad platforms (Meta, Google Ads, TikTok) through view-only / read-only partner or user access: campaign-level spend, impressions, clicks, and the platform's own reported conversions and conversion value.
• Costs the client gives us: cost per item in Shopify, or a Google Sheet the client owns or shares with us.
• Bookkeeper clients only: payout, settlement and bank-deposit exports (CSV) that the firm sends us, and the firm's chart-of-accounts mapping.

What we never ask for

• Passwords to any account.
• Bank logins or direct bank access.
• Write access of any kind. We cannot create, edit or delete products, orders, prices, customers, ads or campaigns.

Customer personal data (your shoppers)

Shopify order data can include shopper names, emails and addresses. We do not need these to calculate profit, so we do not keep them. When order data is pulled, we keep only order IDs, dates, amounts, line items, country/region and a one-way hashed customer ID (used to tell new customers from returning ones). Names, emails, phone numbers and street addresses are discarded at import and are not stored in our reports, sheets or backups.

Why we use it

Only to produce the reports the client has asked for (the Monday memo, profit leak audit, profit packs, reconciliations and journal files) and to answer the client's questions about them. We do not use client data for anything else.

No selling, no sharing

We do not sell, rent or share client data. We do not use one client's data in another client's reports. We do not publish client names, logos or results without the client's written permission. Sample reports on our website use synthetic data for fictional stores.

Where it is stored

• Our processing server (a private virtual server we run; Oracle Cloud), protected by SSH keys and a firewall.
• A Google Sheet owned by, or shared with, the client, if the client chooses that option.
• Our email inbox (Zoho Mail), for reports we send and messages the client sends us. App credentials and access tokens are stored encrypted on our server and are never sent by plain email. They are used only by the reporting job.

Service providers

We use a small number of providers to run the service: Oracle Cloud (server), Zoho Mail (email), Cloudflare (website and DNS) and Google (Sheets, if the client uses them). If we use an AI model to help word a memo, we send it only aggregated weekly figures (for example, totals per product or campaign), never shopper personal data or access tokens.

Retention and deletion

• We keep client data only while the client is subscribed.
• When a client cancels, we stop pulling data at the end of the paid period and delete the client's data, tokens and copies of reports from our server and inbox archives within 30 days, then confirm by email. Invoices and basic billing records are kept as required for tax and accounting.
• The client should also uninstall the Shopify custom app and remove our ad-account access. We will remind them, and we can walk them through it.
• A client can ask us to delete their data at any time by emailing farhan@ferrymetrics.com.

Security incidents

If we learn that client data has been accessed without authorisation, we will tell the affected client within 72 hours of finding out, with what happened and what we are doing about it.

Revoking access

Clients can remove our access at any time without asking us: uninstall the Ferry Metrics custom app in Shopify (Settings → Apps → find the app → Uninstall), and remove the Ferry Metrics partner/user from each ad account.

2. Website visitors and email recipients

• Website. ferrymetrics.com is a static site. It uses no analytics, no tracking pixels, no advertising cookies and no forms. Our hosting provider (Cloudflare) may process technical data such as IP addresses to deliver and secure the site.
• Email. If we email you about our service, we use your business contact details from your public website for that purpose (legitimate interest in business-to-business contact). Every email tells you how to opt out. If you reply "no thanks" or "unsubscribe", we stop contacting you and keep your address only on a do-not-contact list so that we don't email you again.
• Your rights. You can ask what data we hold about you, ask us to correct or delete it, or object to being contacted, by emailing farhan@ferrymetrics.com. If you are in the UK or EU you may also complain to your data protection authority.

Changes

If we change this policy we will update the date above and tell active clients by email before the change takes effect.