Privacy Policy

Version 1.0 | Last updated: April 5, 2026

This privacy policy explains what data ERPkit collects, how it is stored and protected, who it is shared with, and what rights you have over your data.

1. What Data We Collect

Account Data

When you register for ERPkit, we collect and store:

Email address — used for login, notifications, and support communication
Password — securely hashed; never stored in plaintext
Terms of Service acceptance timestamp — records when you agreed to the Terms of Service

ERP Credentials

Dolibarr API URL and API key — encrypted at rest using authenticated encryption on ERPkit servers. The encrypted key is only decrypted during sync operations. It is never exposed in API responses.

Marketplace Credentials

Marketplace API keys and secrets (Shopify, WooCommerce, etc.) are stored in your own Dolibarr instance, not on ERPkit servers. ERPkit retrieves them temporarily during each sync cycle and discards them immediately afterward.

Sync Configuration

Marketplace type, sync frequency, phase toggles (product sync, order import, invoice creation, fulfillment, Factur-X)
Carrier mappings and shipping rules
Batch size and concurrency settings

Sync Logs

Sync results: counts of items processed, created, updated, skipped, and failed
Errors and warnings with item identifiers and messages
Sync duration, timestamps, and status

Sync logs contain operational metrics only. They do not store the content of your products, orders, or customer data.

Sync Hash Cache

ERPkit stores one-way hashes of product data payloads to detect changes between sync cycles (delta sync). These hashes cannot be reversed to recover the original product data. Hash caches are deleted when the associated sync configuration is deleted or when your account is deleted.

Order and Product Data

Transient only — product and order data is read from your ERP and marketplace during sync operations. It is not stored long-term on ERPkit servers.

2. How Data Is Stored and Protected

All data is stored in MongoDB on a secured VPS
Passwords are securely hashed using a one-way hash that cannot be reversed
Dolibarr API keys are encrypted at rest using authenticated encryption
Marketplace credentials are stored in your own Dolibarr instance, not on ERPkit servers
Refresh tokens are securely hashed
Password reset and email verification tokens are securely hashed with expiration timestamps
The refreshToken cookie is set with httpOnly, secure (HTTPS in production), and sameSite: strict attributes

Sensitive fields (password hashes, token hashes, encryption metadata) are never included in API responses.

3. Third-Party Processors

ERPkit uses the following third-party services to operate:

Paddle — payment processing, billing, and tax compliance. Paddle is the Merchant of Record for all ERPkit purchases. Paddle collects and processes your payment information directly; ERPkit does not see or store your card details. Paddle's privacy policy applies to all payment data.
Resend — transactional emails only (email verification, password reset, subscription confirmation, support notifications). Your email address is shared with Resend solely for email delivery.
Cloudflare — CDN, DDoS protection, and DNS. Cloudflare processes request metadata (IP addresses, headers) per their privacy policy.

ERPkit does not sell, share, or transfer your data to any other third parties.

4. Your Rights (GDPR)

If you are located in the European Union or European Economic Area, you have the following rights under the General Data Protection Regulation (GDPR):

Right to access — you can view your account data on the Account page at any time
Right to rectification — you can update your email address and password via the Account page
Right to erasure — you can delete your account via the Account page. Account deletion permanently and immediately removes all of your data, including subscriptions, sync configurations, sync logs, and hash caches. This action cannot be undone.
Right to data portability — you can request an export of your data by contacting support
Right to object — you can cancel your subscriptions and stop all data processing at any time

To exercise any of these rights, use the Account page or contact us via the Support page.

5. Cookies

ERPkit uses one functional cookie:

refreshToken — an authentication cookie used to maintain your login session. It is set with httpOnly (not accessible by JavaScript), secure (transmitted only over HTTPS in production), and sameSite: strict (not sent on cross-site requests). It expires after 7 days.

This cookie is strictly necessary for authentication. No consent banner is required.

ERPkit does not use tracking cookies, advertising cookies, or analytics cookies.

6. Data Retention

Sync logs — retained for the duration of your subscription
Unverified accounts — automatically deleted after 7 days
Account deletion — all user data is permanently and immediately cascade-deleted (subscriptions, sync configurations, sync logs, hash caches)
Encrypted ERP credentials — deleted when the associated sync configuration is deleted
Password reset and verification tokens — expire automatically (1 hour and 24 hours respectively) and are cleared on use

7. Data Location

All ERPkit data is stored on a VPS located in Frankfurt, Germany (EU), hosted by OVH SAS. This ensures your data remains within the European Union, in compliance with GDPR data residency requirements.

8. Changes to This Policy

We may update this privacy policy from time to time. When we do, we will update the "Last updated" date at the top of this page. Continued use of ERPkit after changes constitutes acceptance of the updated policy.

9. Contact

For privacy inquiries, data requests, or questions about this policy, contact us via the Support page or email the ERPkit admin team.

See What ERPkit Can Do for Your Business

Automate your ERP-to-marketplace sync. Products, orders, invoices, and fulfillment — all in one platform.

See Features View Pricing