Torgly privacy policy
Torgly is a Shopify app that connects your store to marketplaces such as Tradera, CDON and Fyndiq. Torgly is a brand provided by Ewelina Och Mattias Gyllensvaan AB (org.nr 556683-7042, momsnr SE556683704201), Prästgränd 6D, 563 31 Gränna, Sverige (“we”). This policy explains what data the app processes, why, and for how long.
In short
- We store no customer personal data. Name, address, phone and, where provided, email from marketplace orders go straight into your Shopify order and are not stored by us.
- Data is used only to provide the app’s functionality – never for marketing, analytics or sale to third parties.
- When you uninstall, marketplace credentials are deleted immediately and all other store data within 48 hours.
Roles
For your customers’ data you are the controller and we are the processor. For data about you as a merchant we are the controller. Our data processing agreement applies automatically when you install the app. See also security and incident response.
Data we process
| Data | Source | Purpose | Stored by us |
|---|---|---|---|
| Customer name, shipping address, phone and – if the marketplace shares it – email | The marketplace | Create the order in your Shopify store so you can ship it | No – passed directly to Shopify |
| Order lines (SKU, quantity, amounts, order id, status) | The marketplace | Prevent duplicates, show status, notify the marketplace when shipped | Yes, 12 months |
| Product data (title, description, images, price, stock) | Your Shopify store | List and update products on marketplaces | Last sent version, while installed |
| Marketplace API credentials or sign-in token | You / the marketplace | Connect to the marketplace on your behalf | Encrypted (AES-256), deleted on uninstall |
| Store domain and settings | Shopify / you | Operate the app | While installed |
| Access log (event, time – no customer data) | The app | Security and troubleshooting | 12 months |
Most marketplaces do not share the buyer’s email. If one does, it is only used to create the order in Shopify and is not stored by us.
Legal basis
Processing is necessary to perform our contract with you. Customer data is processed only on your instructions as processor.
Sharing
- Shopify – the app runs in your Shopify store and creates orders there.
- The marketplaces you connect (e.g. Tradera, CDON, Fyndiq) – we send product data and shipping status (tracking numbers).
- Resend – email service (EU region) that sends notifications to you as the merchant. Contains your email address and the notification text, no customer data.
- Hosting provider – servers and database within the EU/EEA.
We never sell data or share it for marketing.
Security
- All traffic is encrypted (HTTPS/TLS). API credentials are encrypted with AES-256-GCM.
- Only authorised staff have access, using two-factor authentication.
- Events involving credentials and orders are logged.
- In case of a personal data breach we notify affected merchants without undue delay and within 72 hours.
Your rights
You and your customers may request access to, correction or deletion of personal data. As we store no customer data, most requests are handled in Shopify; we respond to Shopify’s GDPR requests automatically. Contact info@torgly.com. You may also lodge a complaint with the Swedish Authority for Privacy Protection (IMY).
Changes
We update this policy when needed. Material changes are announced in the app.