Privacy policy

SKUmargin is a profit analytics product operated by JMF Dynamic Global (FZCO), a company registered in Dubai, United Arab Emirates. In this policy, "we", "us", and "SKUmargin" refer to JMF Dynamic Global (FZCO).

We collect the minimum data needed to provide the service:

• Account data. Email address, name, password hash, preferred locale and timezone.
• Organization and billing data. Organization name, country, currency, Stripe customer and subscription identifiers, plan tier.
• Store credentials. If you connect a Noon store via API, the credentials are encrypted at rest using AES-256-GCM before they touch our database. We never log or display them in plaintext.
• Business data. Orders, settlements, returns, ad spend, products, and COGS that you upload via CSV or that we sync from your Noon store on your instruction.
• Operational data. Session tokens, IP addresses on authentication requests for rate limiting and abuse protection, and server-side error logs.

• To provide, operate, and maintain the service.
• To calculate the profit metrics you sign up to see.
• To process subscription payments via Stripe and send billing receipts.
• To send transactional email (account verification, password resets, invoice delivery) via Resend.
• To investigate and respond to security incidents, abuse, and support requests.

We do not sell your data. We do not use your business data to train machine-learning models outside the service you signed up for.

We use a small set of infrastructure providers to run SKUmargin. Each receives only the data needed to perform its role:

• Stripe (payments): email, organization name, billing address if you provide one, and subscription metadata.
• Resend (transactional email): email address and the contents of the messages we send you.
• Replit (application hosting): runs the SKUmargin application that processes your requests.
• Neon (managed PostgreSQL database): stores your account and business data at rest. Data is encrypted in transit over HTTPS, and sensitive credentials such as Noon API keys are additionally encrypted at the application level with AES-256-GCM before they are stored. Data is currently processed and stored in the provider's United States region; UAE-region data residency is on our roadmap.
• Noon Partners API (optional): when you opt in to API sync, we connect to Noon on your behalf using your credentials.

We retain account, organization, and business data for as long as your account is active. On account deletion we remove or anonymize your data within 30 days, with the exception of records we are legally required to retain (for example VAT invoices). Operational logs are retained for up to 90 days.

You can, at any time, request access to the data we hold about you, a copy of that data in a portable format, correction of inaccurate data, or deletion of your account. Write to privacy@skumargin.com and we will respond within 30 days.

We use one first-party session cookie to keep you signed in, and local storage to remember your active store and UI preferences. We do not set third-party advertising cookies on the SKUmargin application.

We run two analytics tools across the SKUmargin website and application to understand how the product is used and to diagnose problems. Both run on every page once you visit skumargin.com.

• Google Analytics 4 (measurement ID G-VL33Q432FS), provided by Google Ireland Limited. Captures page views, referrer, approximate location derived from IP, device and browser characteristics, and a randomly generated client identifier stored in a first-party cookie. We do not enable Google Signals, advertising features, or cross-property tracking.
• PostHog (EU Cloud, hosted at eu.i.posthog.com), provided by PostHog Inc. Captures page views, in-app interactions (clicks, form submissions, navigation) for our Product Analytics and Web Analytics products, and Session Replay recordings of user interactions. Replay masks all input fields and any element tagged sensitive by default; we do not record passwords, tokens, payment details, or business data values.

Neither tool is used to build advertising profiles, sell data to third parties, or share data with any party other than the processor itself. Both processors host EU end-user data within the EU.

Legal basis. Legitimate interest under GDPR Article 6(1)(f) and the corresponding provisions of UAE PDPL and KSA PDPL: the analytics are necessary to operate, debug, and improve the service, and the data captured is limited to what is needed for that purpose. We will move to consent-based tracking via a cookie banner before the public beta exits.

How to opt out. You can disable analytics in your browser by enabling Do Not Track or Global Privacy Control (we honour both as opt-out signals where supported by the processor), by installing a privacy-focused ad blocker such as uBlock Origin, or by using a browser that blocks third-party trackers by default such as Brave or Firefox in strict mode. To request deletion of analytics data already tied to your account, write to privacy@skumargin.com .

Passwords are hashed with bcrypt at 12 rounds. Noon API credentials are encrypted at rest with AES-256-GCM. Connections to the service use HTTPS. We review access to production data on a need-to-know basis.

We will update the "Last updated" date at the top of this page when we make changes. Material changes will be emailed to active account holders at least 30 days before they take effect.

JMF Dynamic Global (FZCO), Dubai, United Arab Emirates. privacy@skumargin.com for privacy enquiries, support@skumargin.com for product support.