Privacy policy
Last updated 5 November 2026
This policy explains what data Tollo collects through this website and through the Shopify app Tollo Profit Tracker and its browser extension, why we collect it, who we share it with and how you can have it deleted.
- Who we are
- Our role
- What we collect
- What we don't collect
- How we use data
- Google API data
- Who we share it with
- Transfers outside the EU
- Security
- How long we keep it
- Your rights
- Shoppers of our merchants
- Cookies
- Changes and contact
Who we are
Tollo is a software studio run by MB Driblas, a small partnership registered in Lithuania.
MB Driblas
Company code 304746648
V. Nagevičiaus g. 3, LT-08237 Vilnius, Lithuania
Email: support@tollo.studio
In this policy "Tollo", "we" and "us" mean MB Driblas. "You" means a merchant who uses our app, or a visitor to this website.
Our role
For data about you as a merchant (your store, your account settings, your ad accounts and your messages to us), we are the data controller.
For data about your store's customers that arrives with your Shopify orders or supplier data, you are the controller and we process it on your behalf, only to provide the app to you. Our data processing terms are in the Data processing section of our terms of service.
What we collect
From your Shopify store
When you install Tollo Profit Tracker, you allow it to read data from your store through Shopify's API:
- Store details: store name, myshopify domain, the store's country, when the store was created, currency, time zone, plan, and the store owner's name and email address, which we use only to contact you about your account and the service.
- Orders, including past orders: order number and date, line items, prices, discounts, taxes and whether prices include tax, shipping charges, refunds, payment gateway, payment status, payment transactions and their fees, fulfillment status, whether it has a payment dispute, whether it's a test order, and the shipping country.
- Products and variants: titles, SKUs, prices, images and any cost already saved in Shopify.
The app only reads this data. It never creates, edits or deletes anything in your store.
From ad platforms you connect
If you connect Meta (Facebook and Instagram ads), Google Ads or TikTok Ads, you sign in with that platform and choose which ad accounts to share. We then read:
- The ad account IDs, names and currencies you select.
- Campaign, ad set and ad names and IDs, the countries they target, and the links ads point to, which we use to match ads to your products.
- Daily spend and performance figures such as impressions, clicks and purchases reported by the platform.
We store the access token each platform gives us so we can refresh spend data every day. We only request read access to ads reporting. Google Ads offers just one permission level, so Google's permission screen mentions managing your ads, but Tollo only reads reporting data. Apart from the name or email address of the account you connect, which we show so you can tell accounts apart, we don't read your personal profile, posts, pages, messages, friends or audience lists, and we never create or change ads.
From suppliers you connect
- AliExpress: the orders you placed with suppliers, with their supplier order numbers and product and shipping costs, so we can match costs to your products.
- CJ Dropshipping: the API key you give us, and the product and shipping costs it returns.
- Invoices: supplier invoice files you upload, and the product costs we read from them.
From the Tollo browser extension
If you install the Tollo extension for Chrome, it reads your AliExpress order pages while you're signed in to AliExpress, and sends the supplier order numbers, products, and product and shipping costs to your Tollo account. It works only on AliExpress, and it doesn't read other websites, your browsing history, or your AliExpress login details. It stores nothing on your computer apart from what it needs to stay connected to your Tollo account, and removing it from Chrome stops it straight away.
Supplier orders and invoices can contain the name and delivery address of the shopper. We use only the product, shipping and cost figures from them and discard the rest. Uploaded invoice files are deleted once we've read the costs from them.
What you enter in the app
Product costs, fees for payment providers that Shopify doesn't report, VAT and duty settings, monthly costs, and other settings you save.
When you contact us
Your name, email address and anything you write to us, including screenshots.
Technical data
Our hosting providers keep standard server logs, such as IP address, browser type and the time of a request, to keep the service running and secure.
What we don't collect
- We don't keep your shoppers' names, email addresses, phone numbers or street addresses. From each order we keep only what's needed to work out profit, such as amounts and the shipping country, and we discard shopper details that arrive with supplier data.
- We never see or store payment card details. Shopify handles all billing.
- We don't use advertising or tracking cookies, and we don't sell or rent data to anyone.
How we use data
| Purpose | Legal basis under the GDPR |
|---|---|
| Calculating and showing profit, costs, ad spend and insights for your store | Performing our contract with you (Art. 6(1)(b)) |
| Contact details of people who work for a merchant that is a company | Our legitimate interest in providing the service to that company (Art. 6(1)(f)) |
| Keeping data in sync with Shopify, ad platforms and suppliers | Performing our contract with you (Art. 6(1)(b)) |
| Answering support requests | Performing our contract, or our legitimate interest in helping you (Art. 6(1)(b), (f)) |
| Keeping the service secure, fixing bugs and preventing abuse | Our legitimate interest in a safe, working service (Art. 6(1)(f)) |
| Sending service emails, such as a daily summary you turn on, or notice of changes to these terms | Performing our contract with you (Art. 6(1)(b)) |
| Keeping business and accounting records | Legal obligation (Art. 6(1)(c)) |
We don't use your data for advertising, we don't build profiles of shoppers, and we don't use your store's data to train AI models.
You need to give us your store and connection data to use the app, because without it we can't calculate profit. We don't make decisions about anyone by automated means that have legal or similarly significant effects.
Google API data
Tollo Profit Tracker's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
In particular, we use Google Ads data only to show you your own ad spend and profit inside the app and in summary emails you choose to receive. We don't transfer it to others except as needed to provide the app, to comply with the law, or, as part of a merger, acquisition or sale of assets, only after you give your explicit prior consent. We don't use it for advertising, and no person reads it unless you ask us to for support, it's needed for security, or the law requires it.
Who we share it with
We share data only with the service providers that run Tollo, under data processing agreements, and only as much as they need:
| Provider | What they do | Where |
|---|---|---|
| Supabase | Database and file storage | Data hosted in Stockholm, Sweden. Support access from Singapore and the US under Standard Contractual Clauses |
| Vercel | Runs the app and this website | App servers in Stockholm, Sweden. Pages delivered through a global network. US company |
| Hostinger | Domain and email for support@tollo.studio | EU |
We'll add any new provider to this list before it receives your data, and tell merchants 30 days in advance.
Shopify runs the platform the app lives in and handles billing, as an independent company under its own privacy policy. The ad platforms and suppliers you connect (Meta, Google, TikTok, AliExpress, CJ Dropshipping) receive our requests for your data under their own terms and privacy policies.
We may also disclose data if the law requires it. If Tollo is merged or sold, we'll tell you first, and for Google user data we'll ask for your explicit consent first.
Transfers outside the EU
Our database is in the EU. Some providers, such as Vercel and Supabase, may access or process data outside the EU, for example in the United States or Singapore. Those transfers rely on the EU–US Data Privacy Framework, EU adequacy decisions or the European Commission's Standard Contractual Clauses. You can ask us for a copy of the safeguards we rely on.
Security
Data is encrypted in transit and at rest. Access tokens and API keys are stored encrypted. Each store can only see its own data, and access to our systems is limited to the people who run Tollo.
How long we keep it
- Store, order, cost and ad data: while the app is installed. When you uninstall, we delete it within 30 days, after Shopify sends us its deletion request 48 hours after uninstall.
- Ad platform tokens and supplier keys: deleted straight away when you disconnect that account. Ad data already pulled from a platform is deleted within 30 days. Costs already saved to your products stay until you clear them or uninstall.
- Uploaded invoice files: deleted once we've read the costs from them.
- Encrypted backups roll over and are gone within 30 days of deletion. So everything, including backups, is gone within 60 days of uninstalling.
- Server logs: up to 30 days.
- Support emails: up to 24 months after the conversation ends.
- Accounting records: as long as Lithuanian law requires, usually 10 years.
See Data deletion for the ways to have your data removed.
Your rights
Under the GDPR you can ask us to give you a copy of your data, correct it, delete it, limit how we use it, send it to you in a portable format, or stop using it where we rely on legitimate interests. Email support@tollo.studio and we'll reply within one month. For complex requests this can take up to two more months, and we'll tell you if it does. We may ask you to confirm you own the store.
You can also complain to the Lithuanian data protection authority, the State Data Protection Inspectorate (vdai.lrv.lt), or to the authority where you live.
Shoppers of our merchants
If you bought from a store that uses Tollo, that store controls your data. Contact the store to make a request. When a store asks Shopify to share or delete a shopper's data, Shopify passes the request to us and we act on it within 30 days.
Cookies
This website doesn't use cookies or analytics, and it doesn't load scripts or fonts from other companies. Inside Shopify, the app uses only the session tokens Shopify needs to sign you in. There are no advertising or tracking cookies.
Changes and contact
If we change this policy, we'll update the date at the top, and for important changes we'll tell merchants by email or in the app first.
Questions about privacy: support@tollo.studio, or MB Driblas, V. Nagevičiaus g. 3, LT-08237 Vilnius, Lithuania.