Privacy Policy
This policy explains how 7K Ritual Unipessoal Lda, Rua Eça de Queiroz 8, 2.º Esq., 2790-059 Carnaxide, Portugal, NIPC 518310248 (“we”), handles personal data in the K-Routine Skincare Advisor app for Shopify stores (the “App”). Contact: ops@7kritual.pt.
1. Two roles
- For shoppers using the advisor on a store, the store is responsible for their personal data, and we process it on the store’s behalf under our Data Processing Agreement. Section 3 summarises what that involves; for anything else about your data as a shopper, contact the store.
- For the merchants who install the App, we are responsible for the data described in section 2.
2. Merchants: what we hold, and why
| Data | Why | Legal basis | Kept |
|---|---|---|---|
| Your store’s Shopify address, the App’s settings you choose, and the access Shopify gives the App to your store (encrypted) | Providing the App | Contract | While installed; deleted within 48 hours of Shopify’s erasure request after uninstalling |
| Your store’s name and its owner’s email address, as Shopify gives them to the App (encrypted) | Contacting you about the App: service and billing matters, including after you uninstall it | Contract; legitimate interest in managing our relationship with you | While installed; deleted within 48 hours of Shopify’s erasure request after uninstalling |
| Monthly totals of the sales that started in the advisor, and the App’s AI usage for your store | Showing you the advisor’s results, and billing | Contract; legal obligation (accounting) | As long as accounting and tax law requires. These totals contain no shopper data. |
| Your Shopify billing subscription for the App, and the charges made | Billing | Contract; legal obligation | As above |
| Messages you send us | Support | Legitimate interest in answering you | As long as needed to resolve your request |
Apart from the owner’s email above, we do not collect the names or contact details of you or your staff through the App, and we do not use your data for advertising.
3. Shoppers: what the advisor does with your data
- What you type to the advisor is sent to our AI provider, Anthropic, PBC (USA), only to generate the replies. We do not store your conversations. Please do not share health information or other personal data in the chat.
- Your IP address is used only to keep the service secure and prevent abuse: held briefly in server memory, and stored only as a one-way keyed hash for up to one hour.
- No cookies, and nothing stored on your device.
- If you add products to your cart through the advisor, that cart, and an order placed from it, is marked as coming from the advisor, so the store can measure how useful it is. We read the order’s date, status and totals, never your name, email or address.
4. Who else processes it
| Provider | Role | Location |
|---|---|---|
| Anthropic, PBC | AI that generates the advisor’s replies | USA |
| Vercel Inc. | Application hosting | EU: Paris, France |
| Upstash, Inc. | Database | EU: Paris, France |
| Shopify | The store platform, and the App’s billing | Under each store’s agreement with Shopify |
| Resend, Inc. | Email notices to us about merchants’ accounts (merchant data only, never shoppers’) | USA |
Transfers outside the European Economic Area are to the AI provider and the email provider in the USA, relying on the EU–US Data Privacy Framework where the provider is certified, and otherwise on the European Commission’s Standard Contractual Clauses. We never sell personal data.
5. Security
All data is encrypted in transit (HTTPS). Store records, including the App’s access to each store, are encrypted at rest with AES-256-GCM. Every request from Shopify is verified by its signature before the App acts on it, and the App asks Shopify only for the permissions it needs.
6. Your rights
Under the GDPR you can ask for access to, correction or erasure of your personal data, restrict or object to its processing, and receive it in a portable form. Merchants: write to ops@7kritual.pt. Shoppers: contact the store, which is responsible for your data; we help it answer. You can also complain to the Portuguese data protection authority, the Comissão Nacional de Proteção de Dados (cnpd.pt), or the authority where you live.
7. Changes
We will update this policy when the App changes how it handles personal data, and show the new effective date above. Merchants are told of a material change in advance, by email or in the App.