Data processing terms

Who these terms are for

These terms apply when you, a merchant, connect a shop to Zelvorm Commerce or its seller apps (Guard, Stock, Listings, Price Lab, Ad Doctor, Customs, Loop and Lens), or import your orders into them. By connecting a shop or importing orders you agree to them, alongside our terms and privacy policy.

You decide why and how your customers' personal data is used, so you are the controller. Zelvorm processes it only on your behalf, to run the apps you use: we are your processor.

What we process

Order details: order numbers, items, totals, payment method, fulfilment and delivery status, and tracking numbers.

Buyer details, only where the apps need them: name, email address, phone number and shipping address. From Shopify, these are read only when Shopify has approved our access to protected customer data.

What your buyers send through the apps: reviews and photos, return requests, and order confirmations or address corrections.

What we use it for

To show you your orders, profit and stock; to check cash-on-delivery orders for fake numbers and incomplete addresses before you ship (Guard); to send one review request after delivery, with a one-click way to stop (Loop); to run your returns portal; to track deliveries; and to give you reports about your own shop.

We don't sell personal data, use it for advertising, or combine it with other merchants' data. We use it only for the purposes above.

How we keep it safe

Data is encrypted in transit and at rest. Database rules stop any customer from reading another's data, and the server checks that a shop is yours before every read and write. Keys for connected services are kept in an encrypted vault, and links sent to buyers are stored only as one-way hashes.

Only the merchant account that owns a shop can see its customers' data in the apps. Zelvorm staff must use two-factor sign-in, and every view of buyer details in the apps is recorded in an access log that is kept for a year.

Sub-processors

We use these providers to run the apps: Supabase (database, sign-in and file storage), Vercel (hosting), Resend (sending review request emails) and AI providers (Groq and Google Gemini). Some AI features send only what they need: for example, Guard's address tidier sends the delivery address, and contact details are removed from review text before a reply is drafted.

Where a provider handles data outside the UK or the European Economic Area, we rely on adequacy decisions or standard contractual clauses. We'll tell you before adding or replacing a sub-processor.

How long we keep it

Guard deletes buyers' names, phone numbers, email addresses and addresses 90 days after an order's delivery result. Review request links stop working after 60 days. When you disconnect a shop and remove it with its data, its orders and products are deleted.

When Shopify tells us a buyer's data must be deleted, we clear it from your orders and from every app that holds a copy. When a shop removes the Zelvorm app, Shopify tells us 48 hours later and we delete everything from that shop.

Your buyers' rights

We help you answer requests from your buyers to see, correct or delete their data: you can see and export their orders in Commerce and Guard, and we act on Shopify's data requests. Every review email has a way to opt out, and opt-outs are kept so the buyer isn't contacted again.

If something goes wrong

If we become aware of a breach affecting your customers' personal data, we'll tell you without undue delay, and within 72 hours, with what we know: what happened, the data and people affected, and what we're doing about it. We'll help you meet any duty to tell regulators or your customers.

Checks and changes

If you need information to show that these terms are being met, ask us and we'll provide it. If we change these terms, we'll update the date above and tell merchants with connected shops before the change takes effect.

Contact

Zelvorm, Office 18077, 182-184 High Street North, East Ham, London, E6 2JA. Email [email protected].