Privacy Policy

To send your order, we give the brand that sells it your name, phone number and delivery address, and what you ordered, and the brand keeps them with the order in its own systems, such as its online shop. The brand is responsible for its own use of these details. Under our Merchant Terms it may use them only to deliver your order, deal with returns and meet its legal duties, and not for marketing unless you agree to that with the brand yourself.

The company that runs the brand's online shop, such as Shopify or WooCommerce, may store the order details above for the brand. Its own privacy policy covers its use of them.

Stripe processes payments, checks them for fraud, checks the identity of brands and creators, and makes their payouts. Stripe is responsible for its own use of payment data. If you choose another payment method that Stripe offers at checkout, that provider gets what it needs to take the payment.

• Contabo GmbH hosts our servers, in France, in the European Union.
• Brevo, a French company, sends our emails and holds our waitlist mailing list.
• Cloudinary stores and delivers images and videos.
• IONOS provides our email mailboxes.

They may use the data only to provide their service to us.

If you use Sign in with Google, Google confirms who you are and shares your name, email address and profile picture with us. Google's privacy policy covers Google's own use of your data.

Meta Platforms, Inc. (USA) receives the pages you visit on OraSpot, your IP address and browser details, and whether you joined a waitlist or applied to sell, so we can measure our Facebook and Instagram adverts. Meta may link this to a Facebook or Instagram account. Meta's pixel can also send Meta a scrambled (hashed) copy of contact details you type into our forms, such as your email address.

We and Meta are joint controllers for collecting and sending this data; Meta's privacy policy covers what Meta does with it afterwards. See our Cookie Policy for how to say yes or no.

Reviews are shown with your name. If you are a creator, your creator profile and videos are public.

If you sell on OraSpot, anyone who views your products can see your business's legal name, business type, business address and email address, and its company and VAT numbers if you give them. Buyers also get them at checkout and in their order confirmation. UK law requires this. For a sole trader the legal name is their own name, and the business address is wherever the business is based, which may be their home.

Our professional advisers (such as accountants and lawyers), and the police, regulators, courts or tax authorities where the law requires it. If we sell or reorganise our business, the new owner would receive the data it needs to carry on the service under this policy.

• The products in your store: titles, descriptions, images, options, variants, prices, SKUs, product type, vendor, tags and stock levels, to list your catalogue on OraSpot and keep it up to date. Each catalogue sync (the first when you link your store, and any you start again) reads the products you publish to the OraSpot sales channel. If nothing is published to the channel, it reads your whole catalogue, including draft and archived products, so you can see it in your OraSpot dashboard, but lists none of it. When the OraSpot sales channel is first created in your store, Shopify itself publishes your active products to it. After that, we list only the products you publish to OraSpot in Shopify, and a product you unpublish leaves OraSpot. If Shopify refused to add the OraSpot sales channel to your store, or we cannot read which products are published to it, we list nothing new. Draft and archived products are never shown, and gift cards are never copied or listed.
• Which of your products are published to the OraSpot sales channel.
• Your store's currency, so we can show prices in pounds and, when we create orders in your store, create them in your currency.
• Fulfilment updates on orders OraSpot created (tracking number, tracking link, carrier and status), so we can tell the buyer their order is on its way.
• The status of orders OraSpot created (whether they are fulfilled, delivered, cancelled or refunded, and their payment records), read when we record a refund or cancellation on them, when we check whether an order has been delivered, and when we check whether an earlier attempt already created an order.
• If Shopify sends us an update about an order OraSpot did not create, we ignore it and do not store it.

• The OraSpot sales channel, created when you first link your store. It stays in your store, with your publishing choices, if you disconnect, so linking it again lists only what you have published to it. It is removed when you link a different store to your OraSpot account or uninstall OraSpot.
• Notices in your Shopify admin: whether your store is linked to OraSpot, and on each product you publish to OraSpot that we cannot sell, the reason.
• New orders: we may create each OraSpot order from your store in your Shopify admin, marked as paid, with the items, prices and delivery charge, and the buyer's name, phone number and delivery address, so you can send it. When we do not, your orders reach you as our Merchant Terms explain.
• Refunds on orders we created, when OraSpot refunds the buyer. These are records only: no money moves in Shopify.
• Cancellation of an order we created that you have not started to fulfil, when its buyer is refunded in full.
• We never change or delete orders OraSpot did not create.

• Your store's customer records, or orders OraSpot did not create.
• Your marketing lists, analytics or storefront traffic.
• Your Shopify payments or payouts.
• Your staff accounts.

Buyers and visitors see your listings on oraspot.co.uk. Contabo hosts our servers. Brevo sends buyers their order and shipping emails, which include the tracking details from your store. We do not sell your store's data or share it for anyone else's marketing.

On servers we rent from Contabo GmbH in France, in the European Union. All traffic to and from them is encrypted (HTTPS). Your Shopify access token is kept encrypted on our servers and never sent to browsers.

While OraSpot is linked to your store. If you disconnect, we delete our access tokens straight away and keep your product data, hidden from buyers, until you uninstall OraSpot or close your OraSpot account. If you uninstall OraSpot or close your OraSpot account, we delete your store's data (products, images, prices, stock levels, store details and the record of the connection) within 30 days, except records of orders sold on OraSpot, which we keep as set out in How long we keep it.

Shopify sends us three kinds of privacy request, and we act on each within 30 days. If one of your customers asks your store for their data, we send you what we hold about that customer's OraSpot orders from your store. If your store asks us to delete a customer's data, we delete or anonymise it, except order and payment records the law requires us to keep, which we keep only for that purpose. 48 hours after you uninstall OraSpot, Shopify asks us to delete your store's data, and we do so as described above.