Privacy policy

1. Scope and controller

Genius Nutrition S.R.L. operates the Portugal SDR Deposits application. The merchant determines the purposes of processing its store and order data; the operator acts as service provider/processor for that processing and as controller for its own account, billing and support data. The app is independent and is not the official operator of the Portuguese SDR system.

2. Data we process

We process the shop domain; Shopify OAuth credentials and session data, including merchant-user identifiers, name, email and locale when Shopify supplies them; subscription status; deposit configuration; selected variants; Shopify order and line identifiers; EANs; product names; SKUs; quantities; and merchant-entered evidence references. We do not request or store order-customer names, email addresses, phone numbers, postal addresses or payment data.

Raw webhook payloads are not stored. We retain only a SHA-256 digest and minimal delivery metadata to prevent duplicate processing.

The evidence reference is a free-text field for merchant document identifiers. Do not enter customer names, contact details or other personal data in that field.

We store a strictly necessary language preference in a cookie and browser local storage for up to one year so the interface remains in the selected language.

3. Purposes and legal basis

Data is used only to authenticate the installation, apply the merchant-selected configuration, synchronize eligible lines, produce monthly reports, fulfill privacy requests and provide support. Processing is necessary to provide the merchant-requested service and meet applicable obligations.

4. Retention

Order snapshots are deleted after 90 days and technical webhook receipts after 30 days. Data-request exports remain available for 30 days. OAuth sessions and configuration data remain for the active installation and are deleted after uninstall or an applicable request. Aggregated reports and evidence references without customer profile fields remain as merchant records until account deletion or an applicable request.

5. Providers and transfers

Shopify provides the platform, authentication, billing and store data. Railway provides application hosting and database infrastructure. These providers may process data outside the European Economic Area under their applicable terms and transfer mechanisms.

6. Security

We use HTTPS, Shopify authentication, webhook HMAC verification, shop-level segregation, server-side access controls, minimization and scheduled deletion. Railway states that databases are encrypted at rest and transmission is protected with TLS/SSL and WireGuard. No security measure eliminates all risk.

7. Rights and contact

Customers should first contact the Shopify merchant that controls their order. The merchant or data subject may send requests for access, correction, deletion, restriction or objection to gdpr@obsedia.ai. You may also complain to the competent supervisory authority.