Legal
Privacy policy
provisional textThis version describes what the site does today and will be reviewed by a lawyer before launch.
Who is responsible
ShopGuru is an independent brand of Recanto do Pensamento, Lda., which is the controller of the personal data collected on this site.
- Company
- Recanto do Pensamento, Lda.
- VAT no.
- PT517013657
- Address
- Rua José de Mello e Castro, n.º 15, 4.º Dto., 1750-132 Lisboa, Portugal
- hello@shopguru.bot
- Phone
- +351 91 2473303
We have not appointed a data protection officer, because Article 37 of the GDPR does not require one for the processing we carry out. For any privacy question, write to us at hello@shopguru.bot.
This policy applies to the ShopGuru website and to the Diagnostic. The data your store entrusts to us during the Implementation, and while we keep watching and improving the agent afterwards, is processed under the contract and the data processing agreement we sign with you.
What data we collect and why
We only collect the data you give us in the forms below or when you contact us. We do not ask for sensitive data and we do not need it.
Contact form
On the Contact page: name, email, store address (optional), subject and message. We use this data to reply to you.
Call request
On the Diagnostic page: name, email, store address (optional) and message (optional). We use this data to arrange the 30-minute call with you and to prepare for it.
When you send one of these forms, the site's server turns the data into an email and sends it to our inbox, hello@shopguru.bot. It is sent through an email server run by Made2Web, which provides our email hosting and processes this data only on our behalf. From then on, we handle the email we receive like any other contact request.
Email, phone and WhatsApp
You can also talk to us directly, by email, by phone or on WhatsApp. In that case we process your name, your contact details and the content of the conversation, in order to reply to you. The WhatsApp buttons on the site are just links: when you tap one, WhatsApp opens with a pre-written message, and you decide whether to send it. From then on the conversation takes place on WhatsApp, a Meta service, and is also subject to WhatsApp's terms and privacy policy.
Buying the Diagnostic
At checkout, the Stripe payment page asks for your email, name, company, tax number (NIF) or VAT number, billing address and phone number, to issue the invoice, apply the correct VAT and arrange the kick-off meeting with you. Your card or other payment details are entered directly on the payment provider's page and never reach us.
Kick-off meeting and files
After the purchase, we hold a kick-off video call with you. In it we collect information about the store (address, platform, what you sell, markets, order volume and team size), the name, role, email and phone number of the people taking part, and information about the store's processes, tools, policies and goals. We use this data to prepare the sessions and the plan of the Diagnostic.
You can send us files, such as exports of conversations, emails or the catalogue, in a Google Drive folder we share with you. These files may contain personal data about your store's customers. In that case, the store is the controller of that data and we process it on the store's behalf, only to carry out the Diagnostic.
The Diagnostic does not need your customers' data. That is why we ask you to send exports of conversations and emails anonymised, without names, email addresses or phone numbers. The catalogue contains no personal data. The data processing agreement under Article 28 of the GDPR is signed at the Implementation, before the agent has access to the store's real data.
Diagnostic sessions and meetings
The kick-off meeting, the sessions with the store's team and the final meeting take place by video call on Google Meet and are booked in Google Calendar. We use the participants' names and emails to schedule them. The meetings and sessions are not recorded.
Technical data
Like any website, the server that hosts it logs technical data about each request, such as the IP address, the date and time and the browser used. This keeps the site running and secure.
The site does not use traffic analytics or advertising tools. See the Cookie policy.
On what legal basis
We process your data on the basis of Article 6 of the GDPR:
- Pre-contractual steps and performance of the contract (point (b)): replying to contact and call requests about the service, and processing the purchase of the Diagnostic, the kick-off meeting, the sessions and the delivery of the plan.
- Compliance with legal obligations (point (c)): issuing and keeping invoices and accounting records.
- Legitimate interest (point (f)): replying to messages that are not about a contract, keeping the site secure and defending our rights in any dispute.
We do not send marketing communications. If we ever do, we will ask for your consent first.
Who we share it with
We do not sell personal data. We only share it with service providers that process it on our behalf, under a contract that requires them to protect it and to use it only for the stated purpose:
- Vercel, hosting of the website and of the server's technical logs;
- Made2Web, email hosting, through which the form messages pass;
- Stripe, payments, through the Stripe Checkout payment page;
- InvoiceXpress, invoicing, using software certified by the Portuguese Tax Authority;
- Google (Google Workspace): Google Calendar, to book the meetings and sessions, Google Meet, for the video calls, and Google Drive, for the files you send us.
We may also disclose data to public authorities when the law requires it, for example to the Portuguese Tax Authority (Autoridade Tributária).
Transfers outside the EEA
We prefer providers that process data within the European Economic Area. If a provider processes data outside the EEA, the transfer only takes place with one of the safeguards in Chapter V of the GDPR: an adequacy decision by the European Commission (including the EU-US Data Privacy Framework, when the provider is certified) or standard contractual clauses approved by the Commission.
- Vercel: Vercel Inc. is based in the United States. The transfer relies on the EU-US Data Privacy Framework, under which Vercel is certified, and on the standard contractual clauses in its data processing agreement.
- Stripe: the contract is with Stripe Payments Europe, Ltd., in Ireland. When data passes to Stripe, Inc., in the United States, the EU-US Data Privacy Framework and the standard contractual clauses apply.
- Google: the contract is with Google Ireland Limited, in Ireland. When data passes to Google LLC, in the United States, the EU-US Data Privacy Framework and the standard contractual clauses apply.
How long we keep it
| Data | Period |
|---|---|
| Contacts and call requests that do not lead to a contract | 12 months after the last contact |
| Notes from the meetings and sessions, and files you send us | During the Diagnostic and, if you go ahead, during the Implementation and the ongoing service that follows it. If you do not go ahead, 12 months after the plan is delivered |
| Contract data | For the duration of the contract and, afterwards, for the limitation period of the rights arising from it |
| Invoices and other tax and accounting records | 10 years, as required by tax law |
| Server technical logs | Up to 30 days |
At the end of these periods, the data is deleted or anonymised.
Your rights
Under Articles 15 to 22 of the GDPR, you can ask us at any time for:
- access to the data we hold about you and a copy of it;
- rectification of inaccurate or incomplete data;
- erasure of the data, when it is no longer needed or there are no grounds for keeping it;
- restriction of processing, for example while we check a request for rectification;
- portability of the data you gave us, in a commonly used format;
- objection to processing based on our legitimate interest.
We do not make decisions about you based solely on automated processing. Where processing relies on your consent, you can withdraw it at any time, without affecting what was done before.
To exercise these rights, write to us at hello@shopguru.bot or use the Contact page. We reply within one month, which may be extended by a further two months for complex requests, as provided in Article 12 of the GDPR. We may ask you to confirm your identity.
Complaining to the CNPD
If you believe we have processed your data in breach of the law, you can lodge a complaint with the Comissão Nacional de Proteção de Dados (CNPD), the Portuguese data protection authority, at www.cnpd.pt. We would appreciate it if you spoke to us first: it is often resolved more quickly.
Security
We apply technical and organisational measures appropriate to the risk, as required by Article 32 of the GDPR: an encrypted connection (HTTPS) across the whole site, access to data limited to the team members who need it, a separate Google Drive folder for each store, shared only with that store, and providers chosen for the security guarantees they offer.
If there is a data breach that poses a risk to you, we notify the CNPD within 72 hours and, if the risk is high, we inform you directly.
Legal framework
- Regulation (EU) 2016/679, the General Data Protection Regulation (GDPR).
- Law No. 58/2019 of 8 August, which implements the GDPR in Portugal.
- Law No. 41/2004 of 18 August, as amended by Law No. 46/2012 of 29 August, on privacy in electronic communications and cookies.
Changes to this policy
We update this policy when the way we process data changes, for example when we start using a new provider. The date at the top shows the latest version. If a change matters to people who have already given us data, we will let them know by email.