Friendzy Privacy, Data Access and Terms

Privacy notice

Responsibility for personal data

We act as a controller when we determine how information is used to operate Friendzy accounts, provide our service, administer merchant relationships, respond to enquiries and protect the service. Store owners separately control their storefronts, orders and customer relationships; please also read the store's privacy notice.

Where we process personal data solely on a merchant's instructions, the merchant is the controller and we act as its processor. Those activities require appropriate data-processing terms. This notice does not replace a data-processing agreement.

Information we process

• Merchant information: store identifiers and domain, installation credentials, settings, subscription information and support correspondence.
• Accounts and profiles: user identifiers, names, email addresses, password credentials, avatars and biographies where provided. Guest identities and generated names are not necessarily anonymous: they can remain associated with session activity.
• Sessions and chat: room and participant identifiers, message text, timestamps, delivery and read information, invitations, shared URLs and profiles. Messages are stored to support delivery and message history, not merely aggregated as anonymous words.
• Shared browsing: page content and structure, navigation, mouse movements, scrolling and other events used to display shared activity, subject to the active sharing mode and privacy settings.
• Voice messages: recordings you choose to create where available, and information needed to store and deliver them. Recording requires microphone permission.
• Live calls: when you start or join a call, your browser uses your microphone and, if you turn it on, your camera. Audio and video travel directly between the participants' browsers, encrypted in transit, and are not recorded or stored by us. To connect a call, our server passes connection details between the participants; these include each participant's IP address. Your browser also contacts public STUN servers run by Cloudflare and Google to find a route for the call, and those servers see your IP address.
• Technical and usage data: IP addresses in server logs, browser and request information, authentication events, errors and counts of activities such as sessions, messages, pages and invitations.
• Website activity and enquiries: contact details and messages you send us, and, if you accept analytics, website usage information collected through Google Analytics as described below.
• Prospective merchants: store names and addresses, and business contact details such as names, work email addresses and public professional profile links, gathered from public sources and data providers so we can contact stores that may want Friendzy.

Information comes from you, Shopify when a merchant authorises access, session participants and browser communications with our service. Registered-account features require account information; guest features can be used where available. Optional profile details, messages and recordings are provided at your choice.

Purposes and legal bases

We process information to provide accounts, sessions, chat, recordings, settings and subscriptions. Where you are a party to the service contract, this relies on performance of that contract or steps requested before entering it. For security, abuse prevention, troubleshooting, support and business relationship administration, we rely on legitimate interests in operating a reliable service, balanced against your rights. Processing required by applicable accounting or other laws relies on legal obligations. Contacting stores that may want Friendzy relies on our legitimate interest in business outreach; you can object at any time and we will stop.

Where optional analytics, marketing or other processing requires consent, consent is the required basis. Reading this notice or using Friendzy does not itself give consent to optional tracking or marketing.

Sharing with other participants

Participants receive shared profile information, messages, recordings and browsing activity. In a call, the other participants hear you and, while your camera is on, see you, and their browsers receive your IP address as part of the connection. Keep invitation links private: recipients may forward them, allowing others to join subject to session controls. Participants may copy information they receive.

Merchants should configure and test private-page and element exclusions for their theme, especially account, cart, checkout and order pages. These controls are not a guarantee that every sensitive element is automatically excluded. Stop sharing before entering confidential information and do not send passwords, payment-card details or sensitive personal information in chat. A private session does not imply end-to-end encryption or automatic deletion when the session ends.

Providers and international processing

We use these providers, each for its part of the service:

• Amazon Web Services (United States, Ohio): chat messages, voice recordings, temporary upload credentials for recordings, and backups; and email delivery (Sweden, Stockholm).
• Oracle Cloud (United States, Virginia): the real-time server that connects sessions, chat and calls.
• Fly.io (United States, Chicago): our website, the merchant app and the account service.
• Aiven (United States): the database for merchant and shopper accounts.
• MongoDB Atlas (United States): usage counts per store and page.
• Loggly (United States): error and operational logs, which can include user and store identifiers.
• Cloudflare: our domain's DNS and email forwarding, and a public STUN server used to connect calls.
• Google: Google Analytics on our website, only if you accept it; a public STUN server used to connect calls; fonts loaded by the Friendzy widget; and the mailbox that receives our email.
• jsDelivr: scripts and stylesheets loaded by the Friendzy widget and our website, so it receives your browser's requests for them.
• Shopify: app installation, permissions, billing and privacy requests, under Shopify's own terms.
• Finding prospective merchants: Apollo, StoreLeads and Google Custom Search provide store and business contact details; Reoon checks that business email addresses exist; OpenAI drafts introductions from a store's public web pages. No shopper data is sent to these providers.

Data can be processed outside Romania and the European Economic Area, including in the United States. Transfers subject to the GDPR require an applicable mechanism, such as an adequacy decision or appropriate contractual safeguards. Contact us for the destinations, providers and safeguards relevant to your information, including how to obtain information about those safeguards.

We may disclose information when required by law or necessary to investigate abuse, respond to security incidents or protect legal rights.

Retention

• Chat messages and voice recordings: deleted automatically 90 days after they are sent.
• Shopper accounts: kept until you delete your account or ask us to, or until a store asks Shopify to erase your data and no other store holds data for you.
• Merchant data: deleted when Shopify asks us to erase a store's data, normally 48 hours after the app is uninstalled. This includes the store's messages, recordings and usage counts.
• Usage counts: daily counts per store and page do not identify shoppers and are kept while the store uses Friendzy. The daily lists of guest identifiers used to count unique guests are deleted after 45 days.
• Logs: kept by Loggly for 7 days.
• Backups: kept for 30 days, so deleted data can remain in a backup for up to 30 days.
• Copies in browsers: copies of messages kept in your browser, or in other participants' browsers, stay until that browser's storage is cleared (see Cookies and browser storage).

Leaving a session, clearing browser storage or uninstalling does not by itself erase server records. Contact us to request deletion or retention information for particular data. Legal obligations can limit deletion; we cannot erase copies independently retained by other participants.

Your rights

Subject to applicable conditions, you can request access, correction, erasure, restriction and portability, object to processing based on legitimate interests, and object to direct marketing. You can withdraw consent without affecting the lawfulness of processing before withdrawal.

Email privacy@friendzy.online, or use our contact form and identify your message as a privacy request. Include the relevant account, store or session, but never passwords or payment details. We may request proportionate identity verification. GDPR requests must be answered without undue delay, ordinarily within one month; permitted extensions require notice and reasons within that first month. For merchant-controlled records, you can also contact the store.

You may complain to a competent supervisory authority, including where you live, work or consider an infringement occurred. Romania's authority is the National Supervisory Authority for Personal Data Processing (ANSPDCP).

Security and children

Security measures include authenticated access and encrypted network connections. No internet service guarantees absolute security. Protect credentials and invitations and report suspected unauthorised access.

Friendzy is not intended to solicit children's personal information. Contact us if a child has supplied personal data without any authorisation required by applicable law so we can review the situation and take appropriate action.

Shopify permissions

The Shopify authorisation screen determines the access granted. The current integration requests:

• Read discounts: to select existing discount codes for rewards. This does not authorise creating or changing discounts.
• Read themes: to support storefront integration. This scope does not grant permission to write theme files.

Additional access requiring Shopify authorisation must be approved through Shopify. Merchants control activation and privacy configuration. Purchases, payments, delivery and returns remain the responsibility of the merchant and its providers.

Cookies and browser storage

The Friendzy widget uses browser storage that it needs to work:

• a sign-in cookie, friendzyAuthToken, and a guest identity token, each valid for up to one year;
• your name as the store provided it, if you are signed in to the store;
• preferences such as language, theme and sound;
• a copy of your rooms and messages, and voice messages that haven't finished sending, so a session survives a page reload;
• temporary credentials and session state, kept only for the browser tab's session.

Apart from the tab-session data, these stay until you clear your browser's storage or sign out. The sign-in pages use a session cookie that lasts two hours.

Our website loads Google Analytics only if you accept it in the cookie banner. It then sets cookies and sends Google device, browser, page and network information so we can see how the website is used. If you decline, or make no choice, it is not loaded. We remember your choice in your browser's local storage. You can change it at any time with "Cookie settings" at the bottom of every page; declining also removes Google Analytics cookies. The website also loads stylesheets and scripts from jsDelivr, which receives your browser's requests for them.

Microphone and camera permissions are requested by your browser when you use voice messages or calls, and are separate from analytics consent.

You can clear or block browser storage and revoke microphone and camera permission through browser settings. Blocking storage may prevent sign-in or shared sessions from working. Clearing local storage does not delete server records. A merchant's own cookies and analytics are covered by its notice.

Service terms

These terms cover Friendzy's shared-shopping, account and communication features. Merchants must have authority to install and configure the app. Users must have the capacity or authorisation required by applicable law. Paid plan prices and billing periods are those accepted in the subscription flow, with Shopify billing terms applying where relevant. Separately agreed merchant contracts continue to apply.

You retain rights in content you contribute and permit us to process, store and transmit it as needed to provide the features you use. Share only information you are entitled to share. Do not use Friendzy for unlawful conduct, harassment, impersonation, spam, malicious code, unauthorised access or harm to children. Software and branding remain the property of their respective owners.

We may send necessary service, security and billing communications. Creating an account does not automatically subscribe you to marketing; applicable consent and opt-out requirements apply.

Maintenance, faults and changes can affect availability. We do not promise uninterrupted operation or increased sales. Access may be restricted where reasonably necessary to address misuse, security threats, legal requirements or material breach, with notice where appropriate and practicable.

You may stop using Friendzy; merchants may uninstall through Shopify. Contact us for account or data-deletion requests. Stopping use does not erase retained data or obligations already incurred.

Romanian law governs these terms, subject to mandatory protections under applicable law. Nothing here excludes rights or liability that cannot lawfully be excluded, including mandatory consumer protections and access to competent courts.

Contact and changes

Contact SWARMSOFT S.R.L. at privacy@friendzy.online, or through the Friendzy contact form, for questions or privacy requests. We will revise this page and its date when practices or terms change, provide additional notice where required and obtain consent for new processing that requires it.