Two roles, explained
Storvilo acts in two roles. For store owners and their team we are the one who decides how account data is used (the controller). For the shoppers, customers and messages that a store collects, the store decides what happens and we process that data on the store's behalf (the processor).
If you are a shopper, the store you bought from is responsible for your order data and answers to your requests about it. This policy still describes how we protect that data.
What we collect from store owners and their team
Your name, email, phone number if you give one, a securely hashed password, two step verification settings, the store details and settings you enter, billing and payment records for your plan, and the actions you take in the admin, which we keep in an audit log.
Technical data such as your IP address, browser, device and the pages and features you use, so we can keep your account secure, prevent abuse and fix problems.
What a store collects from its shoppers
Through your store the service handles what shoppers enter or create: name, phone, email, delivery address, orders, wishlists, reviews, saved wallet numbers if they choose to save one, and their messages and comments when they write to your store on Facebook or Instagram.
We never store card numbers. Cards are entered only on the payment provider's own page.
Why we use it
To provide the service you asked for: running your store, taking orders and payments, sending order and account emails, syncing messages and delivery updates, and billing your plan.
To keep the service safe: detecting fraud and abuse, enforcing our terms, protecting accounts with sign in limits and two step verification, and keeping logs.
To improve the service and support you: understanding which features are used, answering your questions and fixing faults. We do not sell personal information and we do not use shoppers' data to advertise to them.
Who else handles data
We use a small set of providers who process data only on our instructions: hosting and storage, email delivery, payment and subscription providers, and the AI model providers behind the optional assistant. A store's own connections, such as its payment providers, couriers, Facebook and Instagram, and any ad tracking you switch on, receive the data needed for that connection.
If a store turns on server side tracking, purchase and shopping events are sent to the tracking service and to the ad platforms that store has configured. The store must tell its shoppers about this.
We may disclose information when the law requires it, to protect people or the service, or as part of a sale or reorganisation of our business, in which case this policy continues to apply.
The AI assistant and your data
The assistant is off unless a store switches it on. When it is on, the customer's message and the shop details and catalogue entries needed to answer are sent to the AI provider to produce a reply. We keep a record of each reply and its cost for the store.
Where data is stored and moved
Data is stored with our hosting providers and may be processed in other countries than yours. Where we move personal data across borders we use safeguards that the law of the place the data comes from allows, such as contractual protections.
How long we keep it
We keep data while an account is active. When a store is closed we keep its data for a short period in case it returns, then delete or anonymise it. We keep some records for longer when the law requires it, for example billing and tax records, and security logs for a limited period to protect the service.
How we protect it
Each store's data is kept apart from every other store by the database itself. Saved wallet numbers and payment provider keys are encrypted, passwords are hashed, sign in attempts are limited, and two step verification is available. Important actions are written to an audit log. The security page describes this in more detail.
No system is perfectly secure. If we learn of a breach that affects you we will tell you and the right authorities as the law requires.
Your choices and rights
You can ask us for a copy of your data, to correct it, to delete it or to close your account. Store owners can export products, orders and customers from the admin. Shoppers can download their data and close their account from their account page on the store.
Depending on where you live you may have further rights, such as objecting to some uses or complaining to a data protection authority. If you are a shopper, please contact the store first; we will help the store answer you.
Children
The service is for businesses and is not aimed at children. Do not use it if you are too young to enter a contract where you live.
Changes to this policy
When we change this policy we will update the date at the top and tell account owners by email if the change is material.
Contact
Questions or requests about your data? Use the support option inside your admin, or reply to any email we send you.