Completion instructions

The Merchant incorporates the text below into its privacy notice and publishes it before activating the assistant. It fills in its legal name and registered office, the store name and address, its privacy contact and the contact of any appointed data protection officer (DPO). It states the date and revision in the full notice. These instructions are not part of the text to be published.

The template concerns the service governed by the Shopify Terms and the DPA “Personal Data Processing Agreement”, version shopify_5.0-en dated 31/10/2026, with its annexes. Valeria communicates the applicable providers and confirms the processing arrangements and retention periods before the notice is published. The Merchant is not required to independently reconstruct information about the service infrastructure.

Optional features require the user’s individual choices. The Merchant may disable intentional use of health information. Other changes to features or processing require an effective service configuration and the corresponding text supplied by Valeria.

References to the assistant on Telegram, human support in chat, recognition of customers by name and external support channels must be retained only for features and services actually available in the store. Documents and web pages selected for answers must be relevant to the store’s business and lawfully usable; customer lists, personnel records and personal data unrelated to that purpose are excluded.

Before production use, the Merchant documents its legitimate interest assessment and completes its own data protection impact assessment (DPIA) for the standard service. A different conclusion on the need for a DPIA requires an effective reduction in processing and a documented assessment. The legal conditions for processing health information must also be verified, including temporary content checks and transcription of dictated messages, and use of purchases that may reveal health information. Supporting documentation is available from support@valeria.food.

Text for the store’s privacy notice

1. Controller and scope of the service

[MERCHANT LEGAL NAME], with registered office at [REGISTERED OFFICE], operates the store [STORE NAME AND URL] and is the controller of customer and visitor data processed through the Valeria assistant. For information and to exercise rights: [PRIVACY CONTACT]. The data protection officer, if appointed, may be contacted at [DPO CONTACT, delete if no DPO is appointed].

Valeria S.r.l., with registered office at Via Roma 38/A, 21018 Sesto Calende (VA), Italy, Italian tax and VAT number 04116360126, provides the service and processes data on the controller’s behalf as processor under Article 28 GDPR. Processing relating to the store’s relationship with Shopify is described in the store’s general privacy notice.

The assistant uses artificial intelligence to answer questions, suggest products, help users build their cart and provide information about their orders. Responses may contain errors: commercial and safety information must be checked against the information published by the store and at checkout. The service is intended for adults and does not provide diagnoses or therapeutic advice.

2. Data processed, purposes and legal bases

Data comes from messages and content submitted by the user, the device used and, depending on the requested feature, the customer account, catalogue, cart and Shopify orders. Codes that contain no name or contact details are used to recognise the user and apply their choices. Data associated with those codes remains personal data.

Where available, users may access the assistant through Telegram. This communication also involves processing Telegram user, chat and message identifiers. The user’s requested link between Telegram and their store account enables recognition and application of their privacy choices in subsequent conversations. The cart and related operations are retained to continue purchases and prevent duplicate operations. This processing relies on the controller’s legitimate interest in providing the requested assistance and protecting the service.

Shopping assistance and security

Providing chat, assisting with purchases and protecting the service involves processing messages, responses, ratings of responses, language, user identifiers, declaration of adulthood, privacy choices, interactions and information about the catalogue and products in the cart. To contact support through the external channels made available by the store, the user may use a message prepared by the assistant from the conversation. On the website, the user may edit or omit the message before opening the link. The user decides whether to send it to the store. Any IP address used to consult the catalogue is processed temporarily and is not retained in statistics linked to the customer. The legal basis is the controller’s legitimate interest in providing shopping assistance and maintaining operation of the service under Article 6(1)(f) GDPR.

Where human support in chat is available, authorised store operators can view the conversation and reply to the customer; the automated assistant is paused. Messages exchanged with the operator are retained in their original form. If the operator returns the conversation to the assistant, the AI provider processes the exchange to identify and mask personal identifiers and health information in the copy used to continue the chat. These checks may fail to identify some data. To recognise signed-in customers, conversations are linked to their store account; authorised operators can consult their first and last names where the integration permits. These names are not retained in a separate archive or included in the assistant’s context. This processing also relies on the legitimate interest in providing and managing the requested assistance.

In the website assistant, customers signed in to the store can submit images and dictate messages where these input methods are available. On Telegram, these input methods are also available without linking a store account. Images are processed to answer the request, and reduced copies and thumbnails may be retained. Dictation audio is transcribed into text and is not retained by Valeria. To identify and resolve malfunctions or incidents, permitted conversation content, transcripts and thumbnails may be retained, along with technical records of service operation. This processing relies on the legitimate interest in providing the requested input method, maintaining the service and managing malfunctions and incidents.

Payment credentials, identity or clinical documents, images whose main subject is an identifiable person and confidential information about third parties must not be submitted. Valeria does not request card numbers or card security codes (CVVs) from Shopify and does not process payments.

Features based on consent

The following features are restricted to authenticated customers, off by default and subject to separate consents under Article 6(1)(a) GDPR:

• Memory across conversations retains the preferences and relevant information supplied by the customer to personalise assistance in subsequent conversations.
• Personalisation and order support allows consultation of the customer’s orders to tailor suggestions and responses to their purchases and answer questions about their orders. A single consent authorises both uses.
• Measurement of purchases following use of the assistant checks whether a conversation preceded an order. This involves processing codes linked to the customer, dates, outcome, amount, currency and the interaction information needed to connect the purchase to the conversation. Order data is examined before such connections are identified. Individual results are retained only while consent is active, without details of products ordered, addresses or payment credentials.

Personalisation and order support involves consulting order identifiers and numbers, dates, products and variants, product codes, quantities, prices, discounts, taxes, amounts and currency. Where available, it also involves payment, cancellation, fulfilment and shipment status, carriers, tracking codes and links, estimated or actual shipping and delivery dates, returns and refunds. Customer addresses, contact details, card numbers, security codes and financial credentials are not requested from Shopify.

Consultation is restricted to orders belonging to the customer’s verified account at this store and to the last 60 days, including when the customer provides an order number or identifier. The assistant does not modify orders or carry out cancellations, returns or refunds. If authentication, consent or integration permissions are missing, it indicates that consultation is unavailable. Intentional use of health information revealed by purchases also requires the separate explicit consent described in section 3.

No separate archive of the consulted orders is retained. Data included in conversations or diagnostics follows the periods in section 4. The 60-day limit concerns accessible orders, not retention of the data obtained.

The store’s aggregate statistics derive from data that can be linked to the user. Users may object to analytics based on legitimate interests. An objection prevents further collection for this purpose and excludes their data from subsequent aggregations.

Privacy choices and rights requests

To document privacy choices and rights requests, the data needed to establish the content of the choice or request, the applicable privacy notice version, the code linked to the user, dates, status and outcome is retained. The legal basis is compliance with GDPR obligations under Article 6(1)(c). Further retention for a specific need to defend a legal claim requires a separate assessment.

Messages and technical data needed for chat are required to obtain a response. Optional features may be declined. Valeria does not use data to train or improve AI models, improve the product for its own purposes or independently reuse it across customers, including in aggregated or derived form.

3. Health information and consent management

Intentional use of allergies, intolerances and other relevant health information is permitted only in stores that enable this purpose and with the signed-in customer’s separate explicit consent under Articles 6(1)(a) and 9(2)(a) GDPR. Retaining this information for subsequent conversations also requires consent to memory.

Health information must not be submitted without health consent. In automated assistance, to identify and reject such content, checks of text and images may involve sending content to one of Valeria’s providers for processing even before consent to its intentional use. For dictated messages, audio transcription takes place before the text check. Retention of content by the provider is described in section 4. Automated checks may fail to identify some health content.

Chat with an operator retains the original messages: unnecessary health information must not be submitted through this method either. Voluntary disclosure does not, by itself, constitute consent to its use. Deletion can be requested using the contact in section 7.

Choices may be changed under “Privacy and data” in the assistant. Refusing consent does not prevent use of essential text chat; without consent to personalisation and order support, the assistant does not consult the customer’s orders. Withdrawal does not affect the lawfulness of processing carried out before withdrawal and results in:

• for memory, stopping use and deleting information retained for subsequent conversations;
• for health information, stopping intentional use, removing health memories and initiating deletion of data retained to diagnose malfunctions that is attributable to the user;
• for personalisation and order support, stopping consultation of orders for both uses, while Shopify orders remain retained by the store;
• for measurement of purchases following chat, stopping connections between purchases and conversations and deleting retained individual results.

Withdrawal of consent to memory, use of health information or personalisation and order support closes the current conversation. Other copies and records of choices follow the applicable retention periods and rights.

Product suggestions and ranking may use the conversation and, where authorised, memory and purchase history. No decisions producing legal or similarly significant effects are made under Article 22 GDPR.

4. Retention periods

Category of data	Ordinary period
Conversations with the assistant and operators, ratings, thumbnails and the link to the authenticated customer	90 days after the conversation closes
Original images and copies used to produce a response	Deleted after completion of the response; uploads not attached to a conversation deleted within 48 hours
Dictation audio	Not retained by Valeria or the transcription provider; copies of voice messages on Telegram follow that platform’s terms
Carts managed through the channel and related operations	90 days from the cart’s last update; for operations with unresolved outcomes, content is deleted and only identifiers and states necessary to prevent duplication remain until resolution or erasure of the customer’s or store’s data
Links between Telegram and store accounts	While active, until revocation or erasure; revoked links and expired requests are deleted after 90 days from revocation or expiry
Archive of requests and responses at the AI processing provider, where used	30 days
Memory and current settings	Until withdrawal, erasure or 365 days of inactivity
Statistics linked to the user, usage counts and results concerning purchases following chat	730 days
Data used to diagnose malfunctions and technical application records	30 days
Records of privacy choices and rights requests	Current choices while active; related records for 5 years after replacement or withdrawal; requests for 5 years after closure
Files prepared for personal data access	Deletion starts after confirmation of download and secure custody; completed within 30 days of generation

Records necessary to document choices and the exercise of rights are retained separately from conversations, personalisation and statistics. Individual erasure requests remain subject to necessary and lawful retention.

Infrastructure backups are deleted in the ordinary deletion cycle when they are more than 14 days old; recovery copies of managed databases have an ordinary retention period of up to 35 days. Where the processing method used involves an archive of requests and responses at the AI provider, that archive is retained for 30 days. Provider records for security and abuse prevention are subject to the separate applicable contractual requirements. Infrastructure and provider records relating to store data are subject to the 30-day deletion period specified in the DPA. Backups are restricted to recovery, and deletions are reapplied before the service is reopened.

Originals, copies and reproductions of store data, including backups and records of choices and rights requests, must be deleted within 30 days of uninstall, the service no longer being needed or an enforceable deletion request, according to the earliest applicable deadline, unless the law prohibits deletion or varies the deadline. This obligation takes precedence over the ordinary periods above.

5. Browser storage and cookies

In the website assistant, a temporary identifier is retained in the browser tab’s memory for visitors who are not signed in, to maintain the session while browsing. For signed-in customers, the link used for the session is separate from the association between account and conversation, which follows the period stated in section 4. The cart cookie already set by Shopify may be read to perform the requested operation. The assistant does not use cookies or other tools for advertising purposes. Account links through Telegram instead follow the periods in section 4.

6. Recipients and transfers

Authorised staff of the store and Valeria access data only as necessary to provide the service, support and security. Valeria uses the following providers, bound by agreements under Article 28 GDPR:

• Microsoft Srl, for AI processing, audio transcription, support notifications to operators, backups and, depending on the infrastructure used, hosting the application and storing data;
• Hetzner Online GmbH, for hosting the application and storing data, where used;
• Cloudflare, Inc., for transmission and protection of service traffic.

The list of providers applicable to the store is available from [PRIVACY CONTACT].

Emails notifying operators of a support request do not contain the chat text or the customer’s name; they include a link to the conversation restricted to authorised operators. Alerts and their reading and sending records in the service are retained for 90 days from creation, unless deleted earlier.

When users use the Telegram channel, Telegram Messenger Inc. processes communication data as an independent controller under its Privacy Policy, including retention of copies of messages and attachments, such as audio and images, and any transfers outside the EEA. Deletion in Valeria’s systems does not delete copies held on Telegram.

When the user opens a link to an external support service, the service provider receives any pre-filled message, even if the user does not send it to the store. Processing and retention of data by the external service, including any transfers outside the EEA, are subject to its privacy notices and applicable terms. Erasure from Valeria’s systems does not delete copies held by external services.

The application, databases and ordinary service records, including backups, are hosted in the European Economic Area (EEA). AI processing takes place in the European data zone defined by Microsoft, comprising the European Union and the EFTA countries included in that zone. International services in Microsoft’s provider chain and Cloudflare’s global network may involve access from, or transfers to, countries outside the EEA, including the United States. Such transfers are subject, as appropriate, to adequacy decisions or safeguards under Article 46 GDPR, including the European Commission’s Standard Contractual Clauses adopted under Decision (EU) 2021/914 and any necessary supplementary measures. Information on the countries involved and a copy of applicable safeguards are available from [PRIVACY CONTACT].

7. Data subject rights

Users may request access, rectification, erasure and restriction of processing and, where applicable, data portability. They may object to processing based on legitimate interests and withdraw consent. Requests are addressed to [PRIVACY CONTACT]. The controller verifies the requester’s identity and responds with Valeria’s technical assistance.

Users who have linked their Telegram account to their store account may request revocation of the link by contacting [PRIVACY CONTACT]. The link is not revoked when the merchant disables the Telegram channel.

Users may lodge a complaint with the Italian Data Protection Authority or the competent supervisory authority.