Privacy policy

Who is responsible

DIGITAL CRAFTERS SL, tax ID B56660947, Calle Doctor Gómez Ulla 20, 1A, 28028 Madrid, Spain, is the data controller for the data described in this policy. You can reach us at hello@savvy.so.

When a store connects savvy.so to Shopify or to other services, the data of that store's customers (orders, names, addresses, emails) is processed on behalf of the store. For that data, the store is the controller and savvy.so is a processor, under the terms of service and the data processing terms agreed with the store.

What data we process and why

We process the following data, for the purposes stated:

• Account data (name, email, password, organization) to create your account, let you log in and manage your organization. Legal basis: performance of the contract.
• Store data you connect (products, collections, stock, locations, orders, customers' names, addresses and contact details, expenses and invoices) to provide the platform's features: the profit dashboard, catalog enrichment, product feeds, conversion tracking and ERP synchronisation. Legal basis: performance of the contract.
• Marketing and analytics accounts you connect (Google Ads, Google Merchant Center, Google Analytics, Meta Ads, idealo) to import your spend and campaign results and to send back the conversions and profit of your orders. We store the access tokens encrypted and only use them for the features you enable. Legal basis: performance of the contract.
• Conversion data of your store's orders (order id, amounts, items, and, where your store's customer consented, hashed email and phone, click ids and cookie ids) to attribute orders to campaigns in Google Ads, Meta and Google Analytics, as configured by the store. Legal basis: the store's legitimate interest in measuring its campaigns and the consent its customers give in the store.
• Usage data of the website (pages visited, device and browser, approximate location) through Google Analytics, only if you accept analytics cookies. Legal basis: your consent.
• Emails you send us, to answer you. Legal basis: our legitimate interest in replying to your requests.

AI processing

To enrich product catalogs, savvy.so sends product information (titles, descriptions, attributes, images, brand documents) to AI providers chosen by the store: Anthropic (Claude) and OpenAI. Product data is not personal data. We never send your customers' data to AI providers.

Who we share data with

We do not sell personal data. We share it only with the providers we need to run the platform, under contracts that bind them to protect it:

• Vercel (hosting of the application, Frankfurt region) and Supabase (database, authentication and file storage, European Union).
• Shopify, Google, Meta, idealo and your ERP (Microsoft Dynamics 365 Business Central or other), when you connect them: the data flows between savvy.so and those services as the integration requires.
• Anthropic and OpenAI, for AI enrichment of product data.
• Google Analytics, for website usage data, if you accept analytics cookies.
• Authorities, when the law requires it.

International transfers

Some of these providers are established in the United States. Transfers are covered by the EU-US Data Privacy Framework where the provider is certified, or by the European Commission's Standard Contractual Clauses.

How long we keep data

Account and store data are kept while your organization uses savvy.so and deleted within 30 days after the organization is deleted or the contract ends, except what we must keep for legal obligations (invoicing, tax) for the periods the law sets. Access tokens of connected services are deleted as soon as you disconnect the service. Conversion data of orders is kept for 90 days. Website analytics data is kept for 14 months.

Your rights

You can ask us to access, correct, delete or port your data, to restrict or object to its processing, and to withdraw consent at any time, by writing to hello@savvy.so. We answer within one month. If you are not satisfied, you can file a complaint with the Spanish Data Protection Agency (AEPD, www.aepd.es).

If you are a customer of a store that uses savvy.so, please address your request to the store: it is the controller of your data, and we will help it answer.

Security

Data is transmitted encrypted (TLS), stored in the European Union, isolated per organization in the database, and credentials of third-party services are stored encrypted. Access is limited to the people who need it to run the service.

Changes

We may update this policy. The date at the top says when it last changed. If a change is significant, we will tell you by email or in the platform.