Privacy policy

1. Who we are

Pryvexa is an app for Shopify stores, operated by PSP PANEL LIGHT S.R.L., registered office Strada Mărgăritarului nr. 6, Sat Gruiu, Comuna Gruiu, Județul Ilfov, România, Trade Register no. J2026020055006 (EUID ROONRC.J2026020055006), tax id 54342312 (“we”).

For any question or request about personal data, write to [email protected]. We reply within one month of receiving the request; for complex or numerous requests this can be extended by two more months, and we will tell you if so. We have not appointed a Data Protection Officer (DPO) at present.

This policy covers the Pryvexa app (in the Shopify admin and on the stores that use it) and its website. It is based on Regulation (EU) 2016/679 (“GDPR”), Romanian Law 190/2018 and Law 506/2004, and explains rights in other countries at the end.

2. Our role: controller or processor

• For the data of merchants who install the app (the store account, messages sent to us, billing) we are the controller: we decide why and how it is used.
• For the data of a store’s customers (orders, subscriptions, reviews, conversations) we are a processor (Art. 28 GDPR): we process it only on the store’s behalf and on its instructions, under the Data processing agreement (DPA) with the merchant. The store is the controller.

If you are a store’s customer and want to know what data the store holds about you, or to correct or delete it, contact the store. We will help if you write to us, but the store decides on the request.

Shopify, the platform the stores run on, is an independent controller for the data it processes; see Shopify’s privacy policy.

3. Merchant data

Shopify access tokens and the keys you give us for other services (for example WhatsApp, SMS, Klaviyo) are stored encrypted (AES-256-GCM). The data above is needed to use the app; without it we cannot provide it.

4. Store customers’ data (on the store’s behalf)

Our principle is to keep as little as possible. We do not copy customers’ names, e-mail addresses, phone numbers or postal addresses into our database: we read them from Shopify when a message is sent. Exceptions: the WhatsApp inbox keeps the customer’s WhatsApp number and profile name for 30 days, chat and WhatsApp conversations keep whatever the customer writes (for example an e-mail address or an order number) for 30 days, and e-mail addresses left for “back in stock” or to talk to a person are kept encrypted, as described below.

What we keep, on the store’s behalf:

• customers’ Shopify ids, orders (products, quantities, prices, discounts, refunds, status) and tags;
• marketing consent state (e-mail, SMS, WhatsApp) and whether an e-mail address or phone exists (yes/no);
• figures the app calculates: value group, chance of another order, best sending hour, product recommendations;
• a log of messages sent through the app (delivered, opened, clicked, bounced, complaint), for limits, reports and to stop writing to people who unsubscribed;
• keyed cryptographic hashes of an e-mail address, phone number or browser id, used to count sign-ups, honour unsubscribes and STOP replies (the list of people who sent STOP on WhatsApp is kept while the app is installed, so we never write to them again), check that a reply comes from the right number, recognise a browser and find a person’s records when erasure is requested;
• day and month of birth, if the customer gave them in the sign-up form (never the year), for the birthday e-mail;
• reviews written by customers: rating, text, the display name the customer chose, and attached photos; reviews the store approves are published on the store;
• the score (0–10) and comment a customer gives in the store survey;
• “tell me when it’s back in stock” requests: the e-mail address, encrypted, only until the notice is sent;
• conversations with the store’s virtual assistant and WhatsApp messages exchanged with the store; if the customer asks to talk to a person at the store, the e-mail address left for the answer, encrypted;
• confirmations of cash-on-delivery orders: the order number and total, the answer (confirmed, cancelled, other address) and, if an automatic call was placed, its status and duration.

With the customer’s consent given in the store’s privacy settings (Shopify Customer Privacy), a Shopify module (“web pixel”) sends us products viewed and added to the cart. Links in the store’s e-mails carry a signed code that links the browser to the customer. We keep events only for customers the store knows this way, for abandoned-cart, price-drop and low-stock e-mails; events from unknown browsers are discarded on arrival.

On the store we use the browser’s storage to: remember, in the current tab, that you closed the sign-up window or subscribed (session storage, deleted when you close the tab); only if you accept preference cookies in the store’s banner, remember it after the tab is closed (local storage: 30 days after closing, 365 days after subscribing); only if you accept analytics cookies, which version of the window you saw (local storage, 90 days); keep a chat conversation open (session storage). We do not use advertising cookies and do not track visitors across other sites. The app does not store IP addresses in its database; the hosting provider may keep technical logs for a short time.

5. Artificial intelligence

Some features use Claude language models provided by Anthropic:

• e-mail texts and segment conditions written at the merchant’s request (based on the store’s texts and products, without customer data);
• the virtual assistant on the store and first replies in WhatsApp conversations: we send the conversation’s messages, including any details the customer writes (for example an e-mail address), the merchant’s text about the store, the catalogue and, only if the customer gives an order number and the e-mail address or phone number used for that order, their order’s payment and delivery status with the parcel’s tracking details.

The virtual assistant shows that its answers are written by AI, and AI replies on WhatsApp are marked “🤖 AI”. Anthropic’s commercial terms state that it does not use data sent through its API to train its models; Anthropic may keep it for a limited period for safety and abuse monitoring. We make no decisions based solely on automated processing that produce legal or similarly significant effects (Art. 22 GDPR): the app recommends marketing messages within limits the merchant sets.

6. Who receives data

We do not sell or rent personal data. We use these providers (Shopify as an independent controller, the others as processors or sub-processors):

When a merchant connects their own accounts, we send those services the data needed, at the merchant’s request and on their behalf: Klaviyo (e-mail), Meta / WhatsApp Business (WhatsApp messages), Twilio, Infobip, SMSLink or SMSO (SMS and confirmation calls). These are the merchant’s providers, under their own policies.

We disclose data to authorities only when the law requires it.

7. Transfers outside the EU and the comparison network

Data is hosted in the European Union. The transfer to Anthropic (United States) is based on the Standard Contractual Clauses (Art. 46(2)(c) GDPR) in Anthropic’s data processing terms, and for the UK on the UK Addendum. Support e-mails held by Google may be processed in the United States under the EU-U.S. Data Privacy Framework (Art. 45 GDPR). You can ask for a copy of the safeguards at [email protected].

The comparison network is optional: a store that joins contributes only store-level totals (for example the repeat-order rate), combined across at least 5 stores, without customer data and without identifying the store.

8. How long we keep data

9. Security

• encrypted connections (HTTPS/TLS), including to the database;
• database encrypted at rest, encrypted backups;
• tokens and keys encrypted with AES-256-GCM;
• each store sees only its own data, enforced by the database (Row-Level Security) and checked by automated tests;
• internal access limited to the operator’s administrators, with their own sign-in; actions in the administration console are recorded.

If a personal data breach occurs, we notify the affected stores without undue delay, so they can meet their own obligations, and the supervisory authority where the law requires it.

10. Your rights

Under the GDPR you have the right of access, rectification, erasure, restriction of processing, data portability, objection (including at any time to direct marketing), and to withdraw consent without affecting the lawfulness of processing based on consent before its withdrawal.

For merchant data write to [email protected]. For data as a store’s customer, contact the store (see section 2). You can unsubscribe at any time with the link in every e-mail or by replying STOP to SMS and WhatsApp.

You have the right to lodge a complaint with the Romanian supervisory authority (ANSPDCP), B-dul G-ral Gheorghe Magheru 28-30, sector 1, Bucharest, www.dataprotection.ro, or with the authority of the EU country where you live or work.

11. Users outside the EU

• United Kingdom: the same rights under the UK GDPR; you can complain to the Information Commissioner’s Office (ico.org.uk).
• California (CCPA/CPRA): to the extent the CCPA applies, we do not sell or “share” personal information for cross-context behavioural advertising. The categories of data, sources, purposes and retention periods are those in sections 3, 4 and 8. For store customers’ data we act as the store’s service provider, so store customers should contact the store. You have the right to know, correct and delete, and not to be discriminated against for using these rights.
• Other countries (for example Canada, Brazil, Switzerland): we respect the rights your local law gives you; write to [email protected].

12. Children

The app is meant for merchants. We do not knowingly collect data about children under 16; stores selling to minors are responsible for obtaining any consent required.

13. Changes

We may update this policy when the app or the law changes. The effective date appears at the top. We tell merchants about important changes in the app or by e-mail at least 30 days before they apply.

The policy is published in English; the English version is the one that applies.