Privacy policy

1. Who this policy covers

Wolvi Apps ("we", "us") publishes Google Shopping Feed by Wolvi, an app that builds product feeds for online stores. Wolvi Apps is a trading name used by an independent business based in Warabi-shi, Saitama, Japan.

There are two groups of people this policy is written for:

• Merchants who install the app in their online store. For the personal data inside your catalog and your store account, you are the controller and we act on your instructions as a processor. The terms of that arrangement are in Annex A of the terms of use.
• Visitors to this website. For the little that happens here, we are the controller. Section 5 is the whole of it.

2. What the app receives from your store

When you install the app, the platform you installed from passes us:

• the address of your store;
• the email address of the store owner or of the person who installed the app;
• a signed installation identifier. The app exchanges it for a short-lived permission to read your catalog when it needs one; it is not a password, it does not let us sign in as you, and no long-lived token for your store is stored on our side.

The app then reads the parts of your catalog a feed is built from:

• product and variant titles, descriptions, images, prices, sale prices, stock levels, weights and dimensions;
• identifiers such as SKU, barcode and brand, plus any identifier you map yourself;
• categories, tags, attributes and custom fields;
• the settings you create in the app: which channels you feed, the filters, the category mapping, the price rules and the field mapping.

The app does not read your orders and does not read your customers. It has no use for them, and it does not ask the platform for access to them.

Our servers also keep ordinary technical logs: the time of a request, the IP address and user agent it came from, the feed or page it asked for and whether it succeeded. These exist so a failing feed can be diagnosed.

3. What we do with it

• Build the feed files you configure, and rebuild them when your products change.
• Host those files so the channels you chose can fetch them.
• Answer your support messages, including looking at the feed that went wrong.
• Keep the service working and secure: monitoring, backups, fixing faults, stopping abuse.
• Count installs, removals and plan changes, so we know how the app is doing. That count carries your store's own identifier and nothing from your catalog.
• Meet our own legal obligations, such as keeping tax records of what the app market paid us.

We do not sell your data. We do not use your catalog to train anything, build a cross-store dataset, or advertise to you or to your customers.

4. Feed files are public to anyone with the URL

A shopping channel fetches your feed on its own schedule, as a machine, without signing in. For that to work, the feed file has to be readable by any request that carries the right URL. The URL contains a long random identifier and is not listed anywhere, but it is not a secret in the way a password is: anyone you send it to, and anyone who finds it in a channel's own logs or settings, can read the whole file.

So treat a feed URL as a shared link, and put in a feed only what you are willing to publish. The file holds the product fields you mapped. It does not hold your store credentials, your orders or your customers.

If a feed URL gets out and you want it closed, write to support@wolviapps.com: a feed can be regenerated at a new URL, and the old one stops answering.

5. This website

This website has no analytics, no advertising pixels and no social media trackers. It sets no cookies of its own, and nothing here follows you to another site.

• Live chat. Support chat is provided by Crisp, which sets its own cookies. It does not load until you ask for it in the notice at the bottom of the page. If you never turn it on, no Crisp script runs and no Crisp cookie is set.
• Your answer to that notice is stored in your own browser, in local storage, so you are not asked twice. Clearing your browser data clears it.
• Fonts and images are served from this site. Nothing is loaded from a font or content network run by anyone else.
• Server logs. The web server records requests the same way it does for the app: time, IP address, user agent and page.

The app inside your store is a separate matter. It reports an install, a removal or a plan change to our analytics, as described in sections 3 and 8, and that has nothing to do with your visit to this website.

6. Where the data is held

Your catalog data, your settings and our technical logs sit on servers and a database run by our hosting provider. The feed files a shopping channel downloads are stored with Amazon Web Services in the United States. Support messages are held by Crisp in France. Section 8 is the full list, and we do not copy data anywhere else.

7. How long we keep it

• While the app is installed: for as long as you keep it, because the feed has to stay current.
• After you remove the app: your catalog data, your settings and your feed files are deleted within 30 days. Feed URLs stop answering when the app is removed, not 30 days later.
• Technical logs: up to 30 days.
• The install record: we keep a short record of the install itself, which is your store's identifier, the dates the app was installed and removed, and the plan, for our own statistics and for tax records. It holds nothing from your catalog.
• Support messages: kept while they are useful as support history, and deleted on request.
• Records we must keep by law, such as what the app market paid us, for as long as the law requires.

Backups are overwritten on their own cycle, so a copy of deleted data can survive in a backup for a short period after deletion. Backups are not used for anything except restoring the service.

8. Who else processes it

These are the companies that process data on our behalf, and the only ones:

Our hosting and database provider

Runs the servers, the database and the cache where your catalog data, your settings and our technical logs live.

Amazon Web Services (United States)

Stores the feed files themselves, which is what a shopping channel downloads when it fetches your feed URL.

Google Analytics (United States)

Receives one event when a store installs the app, removes it or changes plan, carrying the store's own identifier. It never receives your catalog, your feed files or your support messages.

Crisp (France)

Runs our support inbox, the help center and the optional chat widget on this website. It processes what you write to us and the email address you write from.

Canny (United States)

Runs the feature request board inside the app. When you open that board it receives your store name and the email address of the person who installed the app.

Customer.io (United States)

Sends product and service email about the app. It receives the email address of the person who installed the app and events about the install itself.

The app market you installed from is not our processor. Each store platform runs its own app market and its own billing under its own privacy terms, and what it does with your data is covered by that policy, not by this one.

If we add or replace a processor we will update this page before the change takes effect.

9. International transfers

We are based in Japan, the feed files are stored in the United States, and the companies in section 8 are in the United States and in France. If your store is in the European Economic Area, the United Kingdom or Switzerland, your data is therefore transferred out of your own region.

For those transfers we rely on the European Commission's Standard Contractual Clauses, with the United Kingdom's International Data Transfer Addendum where the UK GDPR applies. The clauses are built into Annex A of the terms of use, which forms part of the agreement as soon as you install the app. A copy is available on request.

Japan is recognized by the European Commission as providing an adequate level of protection, so data held by us in Japan needs no further mechanism.

10. Your rights

Wherever you are, you can ask us to show you what we hold about you, correct it, delete it, or send it to you in a portable form. Write to support@wolviapps.com with "privacy" in the subject. We answer within one month and ask for nothing beyond what is needed to be sure the request is yours.

If the GDPR or the UK GDPR applies to you, you also have the right to restrict or object to processing, the right to withdraw consent where we relied on it, and the right to complain to your own supervisory authority. Our lawful bases are: performance of a contract, for running the app you installed; legitimate interests, for keeping the service secure and diagnosing faults; consent, for the chat widget; and legal obligation, for records we must keep.

We do not make automated decisions about you and we do not profile you.

If you are a merchant, requests from your customers about their data are yours to answer, because you are the controller of that data. Tell us and we will help you find or delete whatever we hold.

Under Japan's Act on the Protection of Personal Information you have equivalent rights of disclosure, correction and deletion, through the same address. We do not sell personal information and do not share it for cross-context behavioral advertising, under any law.

11. Security

Data is encrypted in transit, including between the app and its own database. No long-lived password or token for your store is kept: the app asks the platform for a short-lived permission when it needs one. Access to production systems is limited to the people who operate the service, over individual accounts with multi-factor authentication, and is logged. The database is backed up by the provider named in section 8. The specific measures we commit to are listed in Annex A of the terms of use.

If a breach affects your data we will tell you without undue delay, with what happened, what it affects and what we are doing about it.

12. Children

The app is sold to businesses and is not intended for anyone under 16. We do not knowingly collect data about children. If you believe we hold such data, write to us and we will delete it.

13. Changes to this policy

When this policy changes, the date at the top changes with it. For a change that affects what we do with your data, we will email the address we have for your store before it takes effect.

14. Contact

Wolvi Apps
Warabi-shi, Saitama, Japan
support@wolviapps.com