Privacy policy

Last updated October 17, 2026

ProfitLupa is a browser extension (for Chrome, Edge, Brave, Opera and Arc), a web hub at profitlupa.com and ProfitLupa for Mac, an app that includes a Safari extension. All three are operated by Bluebana LLC ("ProfitLupa", "we"), a company registered in the United States. This page explains what the extension reads, what our servers receive when you connect a marketplace account, what we keep, and how to get it deleted.

1. The browser extension

The extension runs on the marketplace sites it supports and nowhere else: Amazon (amazon.com, amazon.ca, amazon.co.uk, amazon.de), Walmart (walmart.com), TikTok Shop, Alibaba (alibaba.com) and eBay (ebay.com). On Amazon search results and product pages it reads the public product information shown on the page: titles, prices, ratings, review counts, Best Sellers Rank, "bought in past month", badges, images, bullet points, product descriptions, dimensions, weight, product identifiers (UPC) and seller information. On search results it also records which products appeared at which positions for the search term, and reads Amazon's public search suggestions for the words you look up.

That product data is sent to our servers, where it is stored without any link to who viewed it and shared with all users as a product database, price and rank history and keyword data. The extension also sends your account key and an anonymous installation id, so we know which plan applies. It never reads or transmits your Amazon login, password, payment details, cart or personal order history, and it does not click, buy, review or change anything on Amazon. You can turn the extension off at any time from its icon.

The extension also runs on profitlupa.com, only to pass your sign-in and your language choice between the website and the extension.

Walmart pages you browse

On walmart.com search, browse and product pages the extension reads the public product information Walmart shows — titles, prices, ratings, review counts, "bought since yesterday", badges, images, seller and fulfilment, and on product pages specifications such as dimensions and weight — to compute estimates and Walmart Fulfillment Services fees. It is stored the same way as Amazon product data: without any link to who viewed it, shared with all users.

TikTok Shop pages you browse

If you are signed in and the extension's contribution switch is on, the extension reads the public product cards on TikTok Shop search, category and product pages you open (product id, title, price, sold count, rating, shop name, image and link) and the search phrase the page was showing, and sends them to ProfitLupa's shared catalog, exactly as it does on Amazon. It never reads or sends your TikTok account, profile, cart, orders, messages or anything behind a login. On TikTok's Creative Center trending-hashtag page it reads the public hashtag list the same way. Turn the switch off in the extension to stop all of it.

Alibaba and eBay pages you browse

On alibaba.com the extension reads the supplier prices, minimum order quantities and supplier badges shown on the page to compute landed costs in your browser; it sends nothing about Alibaba pages to our servers except, when you use "Find suppliers", the search phrase and the product it was for (an Amazon, Walmart or TikTok Shop product). On ebay.com search pages it reads listing prices and sold counts to show eBay's fee and an Amazon comparison, entirely in your browser; nothing from eBay pages is sent to our servers. When you open an Amazon product page, the extension may look up sold listings for that product on ebay.com from your browser to show the comparison.

Keeping the extension working

To notice when a marketplace changes its page layout, the extension sends us counts only: how many products were on a page and how many of them gave us each fact (a price, a rating, a rank). These counts contain no product data and nothing about you. When a page cannot be read at all, the extension may send one anonymised fragment of that page's product markup — scripts, styles and link parameters removed, size capped, at most one per field per day — which we keep for a few days to work out a fix. Those fragments come from the product area of the page only and never include your account, address, cart or order details.

To work out a fix we may send such a fragment to Anthropic's Claude API, an AI service; it is not used for any other purpose and Anthropic does not use API data to train its models. You can see whether this is on in our admin controls, and it is off entirely when our team has paused it.

2. ProfitLupa for Mac

ProfitLupa for Mac shows the hub in its own window and includes the ProfitLupa Safari extension, which reads the same pages and sends the same data as the browser extension described in section 1. The app keeps your sign-in in the macOS Keychain and shares it with its Safari extension through an app group on your Mac, so the extension is signed in as well. While it runs, it checks your tracker alerts every few minutes to show notifications; you can switch notifications off in its Settings.

The version downloaded from profitlupa.com checks profitlupa.com for updates; the Mac App Store version is updated by the App Store. The app contains no advertising or analytics libraries, and it does not track you across other apps or websites.

3. Connecting your Amazon seller account

If you choose to connect your Amazon seller account, you authorize ProfitLupa in Seller Central through Amazon's own Selling Partner API. We then receive, for your account only: sales and order data, inventory, fees and financial events, your listings (titles, bullets, images, identifiers, prices, stock) and Buy Box status. This lets us show you your real profit, inventory, alerts and listing tools.

Seller Central hub (optional). If you switch on the Seller Central hub in the extension's Settings, your browser asks you to allow ProfitLupa on Seller Central, and the extension then shows your ProfitLupa data (your synced Amazon sales, fees, stock and listings, with ProfitLupa's estimates) in a panel on Seller Central pages. It does not read, record or send anything from those pages. Switching the hub off removes the permission.

We do not store buyer personal information. Names, addresses, phone numbers and email addresses that may appear in order data are discarded when we sync and are never stored or displayed. Your authorization tokens are encrypted at rest (AES-256-GCM) and are used only to sync your account and to perform actions you request, such as sending a review request. We also keep anonymous calibration points (a product's rank against real daily units, with no account reference) to improve sales estimates for everyone. Disconnecting in ProfitLupa or revoking the app in Seller Central deletes the tokens and all data synced from that account immediately.

4. Connecting your TikTok Shop

If you choose to connect your TikTok Shop, you authorize ProfitLupa through TikTok Shop's own authorization page. We then receive, for your shop only: your products, orders (order id, date, status, line items and amounts), fulfillment and logistics information, and finance statements (fees and payouts). This lets us show your TikTok orders, revenue and payouts next to your Amazon numbers, and, when you ask us to, create draft products in your TikTok Shop from your Amazon listings.

Exactly as with Amazon, buyer personal information returned by TikTok Shop order data (recipient names, addresses, phone numbers, email addresses) is discarded at sync time and never stored or displayed. TikTok Shop tokens are encrypted at rest and used only for the sync and for publishing listings you choose. Disconnecting in ProfitLupa, or revoking ProfitLupa in TikTok Shop, deletes the tokens and all data synced from that shop immediately. We do not share TikTok Shop data with any third party, and we use it only to provide the features described here.

5. Your Walmart reports

Instead of connecting through an API, you can upload the Orders, Items or Returns reports you download from Walmart Seller Center. We keep only the columns ProfitLupa uses: order and item numbers, products and SKUs, quantities, prices, dates, statuses, and return reasons and amounts. Every other column is ignored, so buyer names and addresses are never stored. The data is used only for your own hub. You can delete it at any time with "Delete my Walmart data" on the Walmart page of the hub, and it is deleted with your account.

6. What we store about your ProfitLupa account

Your email address, your account key, your plan, your settings (tracked products, watched keywords, saved keywords, saved calculator scenarios, dashboard layout, notification preferences), whether two-step verification is on (and, if so, the secret your authenticator app shares with us, stored encrypted), your feature-usage counts (see section 10), and, if you subscribe, a Stripe customer reference. Payment card details are handled by Stripe and never reach our servers. Extension settings (theme, columns, window position) stay in your browser.

We also keep: a random device identifier that the extension creates on your computer (and ProfitLupa for Mac creates for itself, and the sign-in page creates in your browser), saved with your account so that it is used on one computer at a time; your language, if you choose one, and the language ProfitLupa last showed you, so emails reach you in it; your security question and its answer, the answer stored only as a one-way hash like your password; the support tickets and suggestions you send us, with our replies; the searches you choose to share as public links, until you delete them; and a record of each "Find suppliers on Alibaba" click (the product, the search phrase, the time and, if Alibaba reports one, whether it led to an order), so we can measure supplier referrals.

Security log. To protect your account, we record sign-ins, failed sign-in attempts, password changes, two-step verification changes and marketplace connections, with the IP address and browser type they came from. Only ProfitLupa's administrators can see it; you can ask us for your own entries, and they are deleted with your account.

7. Emails we send

Emails your account needs: verification codes, password resets and replies to your support tickets. If you track products, a daily summary on days when something changes; you can choose what it covers, or switch it off, in the tracker's Alerts tab. Updates about ProfitLupa and its plans only if you agreed to them; every one of those carries an unsubscribe link, and you can switch them off under Account. Emails are written in your language when ProfitLupa is shown in one of its supported languages. We send them from our own mail server and never share your address.

8. Service providers

We use a small number of providers to run ProfitLupa: our hosting company in the United States, which stores the data described here; Stripe, for payments (card details go to Stripe, not to us); Cloudflare, which carries traffic to our website and API and runs the sign-up form's security check; Anthropic's Claude API, only for the page-reading fixes described in section 1; and Google Fonts, from which our pages load their typefaces, so Google receives your IP address as it would for any web request (for Chinese and Japanese, an additional font is loaded the same way). Amazon, TikTok Shop and Walmart receive what is needed when you connect your accounts or upload your reports. We don't sell data or share it for advertising.

9. Where data is kept and for how long

All data is stored and processed in the United States on managed hosting. Data from a connected marketplace account is kept while the connection is active and deleted when you disconnect. Account data is deleted within 30 days of an account deletion request. Aggregated product data (which carries no reference to any user) is kept as part of the shared database.

10. Cookies, analytics and feature usage

The website uses local storage to keep you logged in and to remember your appearance, dashboard and language settings. We don't run advertising trackers and we don't sell data.

Feature usage counts. To see which parts of ProfitLupa people use and improve them, the extension, the hub and the Mac app record which features and buttons are used: the surface (extension, hub or app), the area (for example the panel, a product strip, or a hub page), the control's label, an optional choice made in a dropdown, and the time, linked to your account. These counts contain no page content, no product data, no search terms and nothing you type. They are used only in aggregate to rank features and decide what to improve, are visible only to ProfitLupa's administrators, and are deleted with your account.

Database statistics. We keep aggregate counts about the shared product database — how many products it holds, where each product first came from (a user's extension or our own catalog crawl) and when, and how many product sightings users contribute per day. Individual sightings are linked to the contributing account only as a count; the products themselves carry no reference to any user.

11. Your rights and deleting your data

You can delete your account yourself: Account → "Delete my account" on the website or in ProfitLupa for Mac. This deletes your account, tracked products, saved keywords, connected stores and their data, and tickets, and cancels any subscription. You can also disconnect a marketplace account and delete tracked products, saved keywords, scenarios, shared searches and your Walmart data inside ProfitLupa at any time. To access, correct or delete anything else, email support@profitlupa.com from the address on your account; we answer within 30 days. Uninstalling the extension removes all its local settings.

Refund records. When a payment is refunded, we keep a record so the money-back guarantee is used once per person: the date, the email address, and one-way codes made from the email, the card's identifier from Stripe and the device identifier. The codes can't be turned back into a card number or a device. This record is kept after the account is deleted.

Keeping bots out. To tell people from automated programs, sign-up and fast use of the product database run a short calculation in your browser, and an account that searches unusually fast may be asked for a code we send to its email. If the sign-up form shows a security check from Cloudflare (Turnstile), Cloudflare receives your IP address and details about your browser to make that check; it runs in a separate frame that cannot see what you type.

12. Security and incidents

Connections use HTTPS; marketplace tokens are encrypted at rest; session keys are stored hashed; production access is limited to the operator and protected by multi-factor authentication. If we become aware of a security incident affecting your data, we will notify you and the relevant marketplace without undue delay. Details are on the security page.

13. Children

ProfitLupa is a tool for businesses and is not directed to children. We don't knowingly collect data from anyone under 16; if you believe a child has created an account, write to us and we will delete it.

14. Changes to this policy

When we change this policy we update the date at the top. If a change materially affects how we use your data, we email account holders before it takes effect.

15. Contact

support@profitlupa.com · Data protection contact: Lewis Mora, ProfitLupa.