Privacy Policy

Who we are

This Privacy Policy explains how Jan Thér, sole trader (IČO 01465694, VAT ID CZ9010073479), registered in the Czech Republic ("AppVitals", "we", "us") collects and processes personal data when you use our website and application (the "Service"). For your account data we act as the data controller. For the Shopify Partner data you connect, we act as a data processor on your behalf, as described in section 6 and in our Data Processing Addendum.

If you have any questions, contact us at [email protected].

Data we collect

• Account data: your name, email address, hashed password, organization name and membership, and preferences. If you sign in with Google we receive your basic Google profile (name, email and avatar).
• Connected Shopify Partner data: when you add a Partner API token we read your apps, subscriptions, transactions and event history read-only, and store derived analytics. This data belongs to you.
• Billing data: handled by Paddle as Merchant of Record. Paddle collects your payment details and billing address directly; we receive only limited information such as your plan, subscription status and invoice metadata. We never see or store full card numbers.
• Technical and usage data: basic log data such as IP address, browser type and requests, used to operate and secure the Service.
• Cookies: strictly-necessary and preference cookies, plus Google Analytics if you accept non-essential cookies, as described in our Cookie Policy.

How we use your data

We use personal data to: provide and maintain the Service and its analytics; authenticate you and keep your account secure; process subscriptions and billing through Paddle; send transactional emails such as password resets, invitations and notifications you enable; provide support; and comply with our legal obligations. We do not sell your personal data, and we do not use your connected Partner data for advertising.

Legal bases (GDPR)

Where the GDPR applies, we process personal data on these legal bases: performance of our contract with you (to provide the Service); our legitimate interests (to secure, maintain and improve the Service); compliance with legal obligations (such as tax and accounting, largely handled by Paddle); and your consent where required, for example for any non-essential cookies we may introduce in the future.

Cookies

We use strictly-necessary and preference cookies, plus Google Analytics loaded only after you accept non-essential cookies. We use no advertising cookies. Full details, including how analytics is gated on your consent, are in our Cookie Policy.

Sub-processors and sharing

We share personal data with the trusted sub-processors below, who process it only to provide their part of the Service. We may also disclose data where required by law or to protect our rights. We do not sell personal data.

For details of our controller/processor roles and safeguards, see our Data Processing Addendum.

International transfers

Some of our sub-processors are located outside your country, including in the United States. Where personal data is transferred internationally we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses or an equivalent mechanism.

Data retention

We keep account and connected data for as long as your account is active. If you delete your account or an organization, we delete or anonymize the associated personal data within a reasonable period, except where we must retain certain records (for example, invoice and tax records held by Paddle) to meet legal obligations.

Your rights

Depending on your location, you have rights over your personal data, including the right to:

• Access: request a copy of the personal data we hold about you.
• Rectification: correct inaccurate or incomplete data (you can edit most account data in the app).
• Erasure: request deletion of your account and associated personal data.
• Portability: request an export of your data in a portable format.
• Restriction and objection: restrict or object to certain processing.
• Withdraw consent: where processing is based on consent, withdraw it at any time.

To exercise any of these rights, contact us at [email protected]. You also have the right to lodge a complaint with your local data-protection authority.

Security

We protect your data with measures including encrypted transport (HTTPS), hashed passwords, signed session cookies, strict per-organization data isolation and access controls. No method of transmission or storage is completely secure, but we work to protect your data and to promptly address any incident.

Children

The Service is intended for business use and is not directed to children under 16. We do not knowingly collect personal data from children.

Changes to this policy

We may update this Privacy Policy from time to time. If we make material changes we will provide reasonable notice. The "last updated" date above reflects the latest revision.

Contact

For privacy questions or to exercise your rights, contact us at [email protected]. Our data-protection contact is [email protected], and our legal operator and address are on our Legal notice page.

Operator

See also