Privacy Policy
Last updated: 7 July 2026
This policy explains how SKUvio (“we”, “the app”) — an application that synchronises product and order data between Etsy and Shopify on behalf of the merchants who install it — collects, uses, retains, and protects personal data, and the rights you have under the EU General Data Protection Regulation (GDPR) and the French Loi Informatique et Libertés.
1. Data controller & contact
The merchant store that installs SKUvio is the data controller for the buyer personal data processed through their store; SKUvio acts as a data processor on the merchant’s behalf, under the merchant’s instructions.
For the SKUvio application itself, the operator and point of contact is:
- Operator: SKUvio, operated by The Originea. The registered legal entity name, SIRET, and registered address will be published here upon completion of company registration.
- Privacy contact: privacy@skuvio.app
You also have the right to lodge a complaint with the French supervisory authority, the CNIL.
2. What personal data we process, and why
SKUvio processes only the data needed to synchronise orders and listings between a merchant’s sales channels. We do not sell personal data, and we do not use buyer personal data to train AI models. (Our AI features generate listing tags and translations from product text only — never from buyer data.)
| Data category | Examples | Purpose |
|---|---|---|
| Buyer identity & contact | Name, email, phone | Importing & fulfilling orders across channels; order notifications to the merchant |
| Shipping / billing address | Street, city, postcode, country | Order fulfilment & the legally-required invoice |
| Order content | Items, quantities, prices, SKUs, dates, buyer messages / gift notes | Synchronising and fulfilling the order |
| Merchant account data | Store domain, access tokens (encrypted) | Authenticating the app to the merchant’s store |
3. Legal basis (Art. 6 GDPR)
- Performance of a contract / legitimate interest — processing order data to provide the synchronisation service the merchant subscribed to, and to keep the merchant’s channels consistent.
- Legal obligation — retaining transaction and invoice-related records for the periods French law requires (see §4).
4. How long we keep data (retention)
We keep personal data only as long as necessary for the purpose it was collected for, and then either delete or anonymise it — except where French law requires longer retention. French accounting and consumer law obliges retention of invoice and contract records (which include the buyer’s name and address) for up to 10 years; these are moved to restricted intermediate archiving once the order is closed, separate from active use, in line with the CNIL’s guidance.
| Data category | Retention |
|---|---|
| Invoice / accounting records (incl. buyer name & address on the order) | 10 years (Code de commerce L123-22; Code de la consommation L213-1) — held in restricted intermediate archiving after the order closes |
| Tax-relevant documents | 6 years (LPF L102 B) |
| Buyer contact data used for marketing / prospection | Up to 3 years after the last contact, then deleted or anonymised (CNIL référentiel 2021-131) |
| Merchant access tokens | Deleted when the merchant uninstalls the app (and on a shop redaction request) |
| Data subject to a redaction request | Identifying fields removed on request, except records we are legally required to retain (above) |
Legal bases for the durations above: Code de commerce art. L123-22 (accounting records, 10 years); Code de la consommation art. L213-1 (e-commerce contracts over €120, 10 years); Livre des procédures fiscales art. L102 B (tax documents, 6 years); CNIL référentiel n°2021-131 (commercial relationship / prospection, 3 years after the last contact).
5. Your rights
Under the GDPR and the Loi Informatique et Libertés you have the right to: access your data; rectify inaccurate data; request erasure (“right to be forgotten”); restrict or object to processing; and data portability. To exercise these rights for data held by a store, contact that merchant (the controller); SKUvio will action the merchant’s instruction.
Note that where we are legally required to retain certain records (e.g. invoice data for 10 years), an erasure request may be honoured for the data not subject to that obligation, while the legally-required records are retained in restricted archiving until their statutory period ends — as the GDPR and Shopify’s data-deletion rules both permit.
SKUvio handles Shopify’s mandatory data-subject webhooks (data request, customer redaction, shop redaction): on a redaction request we remove the buyer’s identifying data (name, email, phone, address, messages) from the affected orders while preserving the non-identifying commercial record required by law.
6. Security & sub-processors
Data is encrypted in transit (HTTPS) and access tokens are encrypted at rest. We use the following sub-processors to operate the service:
- Railway — application hosting & PostgreSQL database, hosted in the EU (EEA), Amsterdam region.
- Shopify & Etsy — the sales platforms the data synchronises between.
- Anthropic (Claude) — AI generation of listing tags & translations, fed product text only (no buyer data).
- Resend — transactional email to the merchant (e.g. order notifications, data-request fulfilment).
7. Changes to this policy
We may update this policy; the “last updated” date above reflects the most recent change. Material changes will be communicated to merchants.
See also our Terms of Service. This page is provided to meet transparency obligations under Art. 13 GDPR. It is not legal advice. The data controller is responsible for ensuring its accuracy for their specific processing.