Privacy Notice for the Valeria Shopify App
Last updated: 31 October 2026
This notice describes personal data processing relating to installation and use of the Valeria Shopify app, access to the Retailer Portal and interaction with the assistant on stores where it is enabled.
1. Identity of Valeria and roles in processing
Valeria S.r.l., Italian tax and VAT number 04116360126, has its registered office at Via Roma 38/A, 21018 Sesto Calende (VA), Italy. For information about the app, processing carried out on the merchant’s behalf and how to conclude a data processing agreement (DPA), contact support@valeria.food. For processing for which Valeria is the controller, contact amministrazione@valeria.food or send certified email (PEC) to valeria.ai@pec.it.
The merchant is the controller of customer and visitor data processed through the assistant on its store and of data concerning the configurations and content it chooses to use. It is also the controller of processing needed to manage store staff invitations, permissions, roles and authorisations. For these activities, Valeria acts as processor on the merchant’s behalf to provide the app and assist with personal data requests.
Valeria instead acts as controller for management of its own commercial relationship and related service communications, staff identity and platform authentication, access security, billing and legal obligations.
The English Shopify DPA, version shopify_5.0-en, forms part of the English Shopify Service Terms, version shopify_1.6-en. The merchant receives the Terms, DPA and annexes before written acceptance, including electronic acceptance, which precedes processing on its behalf. A copy identifying the merchant can be requested from support@valeria.food.
2. Data received from Shopify
When a merchant installs or uses the app, Valeria receives the following through Shopify:
- Store and installation: the store’s identifier, name, domain and URL; granted permissions, installation status and technical credentials needed to connect the app.
- Users and app plan: identifiers and session data for the Shopify user who opens the app, including their name, email address and language where available; the plan’s status, price and billing cycle. The verified store owner’s email address is also used to arrange access to the Retailer Portal.
- Catalog: products, product type and vendor, descriptions, images, variants, availability, prices and currency needed for search and responses.
- Authenticated customers: account identifier and, where authorised, first and last names that store operators can consult to recognise the customer in conversations. This feature does not request the customer’s email, phone number or address.
- Orders: for personalisation and order support authorised by the authenticated customer, order identifiers and numbers, dates, products and variants, product codes, quantities, prices, discounts, taxes, amounts and currency; where available, payment, cancellation, fulfilment and shipment status, carriers, tracking codes and links, estimated or actual shipping and delivery dates, returns and refunds. Customer addresses, contact details, card numbers, security codes and financial credentials are not requested. To measure purchases following a conversation, the app separately examines essential data from the store’s updated orders and information necessary to connect them to interactions. It retains a result linked to a customer only with that customer’s separate consent to measurement.
- Personal data requests: when Shopify forwards them, identifiers for the request, customer, store and, where relevant, the orders concerned. To handle these requests, the app takes only the necessary identifiers and discards the other fields received from Shopify, including any customer contact details.
Access is limited to the Shopify permissions granted to the app.
3. Data provided by the merchant and its staff
To accept the Terms and DPA electronically, the merchant provides its legal name and full registered address, including country; the person accepting declares they are authorised to represent the merchant. To establish evidence of the agreement, Valeria records those details, the store identifier and domain, the Shopify user identifier and verified email address of the authenticated owner, the acceptance date, and the language and versions of the accepted documents.
The merchant provides the name of the controller to display to customers, a link to its own privacy notice, the date it was last revised and a contact for exercising rights. In the Retailer Portal, the merchant can configure the store profile, the assistant’s appearance and features, manage staff and invitations, upload permitted documents and select web pages for responses, and view the store’s conversations, statistics and personal data requests. Authorised operators can also reply to customer requests in chat; their messages and records of support activities are retained.
Staff provide the data needed for access and generate technical and security records when using the app and Portal. For service communications to administrators, Valeria processes account contact details, information about the organisation’s plan and aggregate usage, communication and language preferences, and records of alerts being read in the Portal and sent by email. Alerts are available in the Portal; the corresponding email notices are optional and can be enabled or disabled in the profile without affecting access to the service. Communications sent to Valeria for support are processed to handle the request. The app or Portal cannot be used without the data needed for installation and access.
To manage the store’s support requests, authorised operators can receive notifications in the Portal and, if enabled, an email. Processing covers the conversation reference, operator contact details and preferences, and reading and sending records. Emails do not contain the chat text or customer name; they include a link restricted to authorised operators. These notifications fall within processing on the merchant’s behalf.
The Retailer Portal uses cookies necessary for authentication and security, and a cookie to remember the selected language.
Documents and web pages selected by the merchant must concern the store, catalogue, FAQs or commercial terms. Valeria acquires their content and retains text, excerpts, source addresses, copies and versions, together with numerical representations used to search for information relevant to questions. The merchant must have the right to use the sources. Public availability does not authorise importing personal data unrelated to the service. Customer lists, identity documents, medical records and personnel files are excluded.
4. Data of store customers and visitors
Assistance and conversation data
The assistant receives messages sent by customers and produces responses and product cards; when requested, it also performs operations on the Shopify cart. To contact support through the external channels made available by the store, the customer may use a message prepared by the assistant from the conversation. On the website, the customer may edit or omit the message before opening the link. The customer decides whether to send it to the store. To manage the conversation, the assistant processes a code containing no customer name or contact details, confirmation of adulthood, privacy choices, language and store information needed for the request, technical operating data and ratings of responses. Data associated with the customer’s code remains personal data. The cart information sent to the assistant concerns the products selected and their quantities, not payment data. To perform requested cart operations, the app may read the cart cookie already set by Shopify. The IP address may be used temporarily to consult the store’s catalog; it is not retained in statistics linked to a customer.
In automated assistance, the assistant checks messages to identify and block data that could directly identify the customer or expose credentials, such as first and last names, addresses, contact details, and personal or payment identifiers. When it detects such data, it asks the customer to rephrase the request. The automated check may not detect all such data.
Where human support in chat is available, authorised store operators can view the conversation and reply to the customer while the automated assistant is paused. Customer and operator messages are retained in their original form. When the conversation returns to the assistant, the AI provider processes the exchange to identify and mask personal identifiers and health information in the copy used to continue the chat. These checks may fail to identify some data and do not anonymise the original history.
Customer recognition and browser storage
In the website assistant, for customers signed in to Shopify, the app links their Shopify customer identifier to a code that contains no name or contact details. The session link enables recognition and application of privacy choices. The association between account and conversation is also retained so that authorised store operators can recognise the customer; where the integration permits, they can consult the customer’s first and last names. Names consulted are not retained in a separate customer profile archive or included in the assistant’s context. The association follows the retention period of the conversation and does not, by itself, authorise use of orders, memory or other optional features.
When a visitor who is not signed in to Shopify opens the assistant, the app stores a temporary identifier in the browser tab’s memory to maintain the chat session while browsing. This identifier is not stored in a cookie. The assistant does not use cookies or other tracking tools for advertising.
If the merchant activates Telegram, the assistant also receives Telegram user, chat and message identifiers and content sent through that channel. At the customer’s request, it links the Telegram identity to their store account to recognise them and apply privacy choices in subsequent conversations. It retains cart state and recorded operations to continue purchases and prevent duplication. The link remains active until revocation or erasure; disabling the channel alone does not revoke it.
Optional features
In the website assistant, signed-in customers can submit images in chat or dictate a message where these input methods are available. On Telegram, these input methods are also available without linking a store account. Audio is transmitted to the transcription provider to be converted into text and is not retained by Valeria or the transcription provider. Any copies of the voice message on Telegram instead follow that platform’s terms. Memory across conversations, personalisation and order support, and measurement of purchases following chat are restricted to authenticated customers, off by default and subject to separate withdrawable consents.
Consent to “Personalisation and order support” authorises consultation of the customer’s orders to tailor suggestions and responses to their purchases and answer questions about their orders. Consultation is restricted to the store and the customer’s verified account and covers Shopify orders from the last 60 days, including searches by order number or identifier. The assistant does not modify orders or carry out cancellations, returns or refunds. If authentication, consent or integration permissions are missing, it indicates that consultation is unavailable. Refusal or withdrawal of consent does not prevent essential chat.
Health information
Intentional use of health information, including information revealed by products purchased, requires separate explicit consent. Without that consent, the app asks customers not to submit it and, in automated assistance, checks received content to identify and block health information. The check may involve sending text and images to one of Valeria’s providers for processing even before consent to its intentional use. For dictated messages, audio transcription takes place before the text check. Retention of content by the provider is described in section 6. Automated checks may fail to identify some health information.
In chat with an operator, the original messages remain in the history. Voluntary disclosure of health information does not, by itself, constitute consent to its use. The merchant limits processing to necessary data and, with Valeria’s assistance, arranges deletion of excessive content without an applicable legal basis.
5. Purposes and legal bases
Processing on the merchant’s behalf
On the merchant’s behalf, data is used to answer questions, find products, manage the cart, personalise assistance and provide order information where authorised, protect the service, display store statistics and ratings of responses, apply privacy choices and assist the merchant with customer requests. Optional features use data only while the relevant choice is active. The assistant may suggest and rank products based on the conversation and authorised features. It does not adopt decisions producing legal or similarly significant effects for customers. The legal bases for this processing are stated in the privacy notice of the merchant, which is the controller.
Processing for which Valeria is the controller
For its own purposes, Valeria uses the data necessary to:
- manage contracts, plans and commercial account support: performance of a contract if the individual is a party to it (GDPR Article 6(1)(b)), or the legitimate interest in managing the relationship with the merchant’s representatives (Article 6(1)(f)). Communications to administrators about plan usage rely on the legitimate interest in managing the service relationship transparently and enabling administrators to monitor its use (Article 6(1)(f));
- manage identity, authentication and security of access to the platform: the legitimate interest in providing and protecting the service (Article 6(1)(f)) and, for applicable security duties, compliance with legal obligations (Article 6(1)(c));
- maintain accounting records and handle rights requests concerning processing for which Valeria is the controller: compliance with legal obligations (Article 6(1)(c));
- establish, exercise or defend legal claims: the legitimate interest in protecting Valeria’s rights (Article 6(1)(f)).
Valeria does not sell customer data. It does not use conversations, images, orders or store content for advertising, to train or improve AI models, to develop products or services for its own purposes, or for independent reuse across stores, including in aggregated or derived form.
6. Retention
Standard periods
During the relationship, these are the app’s standard retention periods for data processed on the merchant’s behalf. The merchant adopts them in its instructions or agrees and communicates different periods before activation.
| Category | Standard period |
|---|---|
| Messages and responses from the assistant and operators, ratings, thumbnails and the link to the authenticated customer | 90 days after the conversation closes |
| Original images and copies used to produce a response | Deleted after completion of the response; prepared images that are not attached deleted within 48 hours |
| Dictation audio | Not retained by Valeria or the transcription provider; copies on Telegram follow that platform’s terms |
| Carts managed through the channel and related operations | 90 days from the cart’s last update; for operations with unresolved outcomes, content is deleted and only identifiers and states necessary to prevent duplication remain until resolution or erasure of the customer’s or store’s data |
| Links between Telegram and store accounts | While active, until revocation or erasure; revoked links and expired requests are deleted after 90 days from revocation or expiry |
| Archive of requests and responses at the AI processing provider, where used | 30 days |
| Statistics linked to a customer, counts of assistant use and data on orders linked to the assistant | 730 days, subject to applicable objection or erasure |
| Customer memories and current settings | Until withdrawal, erasure or 365 days of inactivity |
| App diagnostic data, which may contain chat content, and technical records of its operation | 30 days |
| Documents and web pages used for answers, copies of acquired content, excerpts and search indexes | Active content until removal or until the store stops using the service; superseded revisions for 90 days |
| Files prepared to provide copies of personal data | Deletion starts after the merchant explicitly confirms they have downloaded and stored the files securely; to be completed within 30 days of generation, including when no confirmation is given |
| Records of privacy choices and essential data on completed rights requests | Current choices while active and related records for 5 years after replacement or withdrawal; request data, including date, status and outcome, for 5 years after closure, if these periods are adopted in the merchant’s instructions |
No separate archive of orders consulted for personalisation and support is retained. Data included in conversations or diagnostics follows the corresponding periods above. The 60-day limit concerns orders accessible through Shopify, not retention of the data obtained.
Portal access and cookies
In the website assistant, the visitor’s temporary identifier is stored in the browser tab’s memory and has a limited validity period. The session link between the assistant’s code and the Shopify customer identifier expires shortly after the app session. The separate association between account and conversation instead follows the 90-day period from closure of the conversation.
Shopify permissions remain active while needed to connect the store. Revoking a staff member’s access to one store does not delete their account on the Valeria platform.
Retailer Portal cookies for the session and request protection last 12 hours. The temporary cookie used to complete authentication lasts 10 minutes. The cookie that remembers the selected language lasts one year.
Operations and administrative data
Records of store operations performed in the Portal are retained for 730 days during the relationship. Plan, usage and support request alerts and their reading and sending records in the Portal are retained for 90 days from the creation of the alert and removed by the next automatic deletion procedure, unless deleted earlier. Email communication and language preferences are retained until the account or the organisation to which they relate is deleted; disabling email alerts removes the address associated with the preference. Administrative, accounting and tax documentation for which Valeria is the controller is retained for 10 years from the last entry. Contractual data, including evidence of acceptance of the Terms and DPA, is retained for the duration of the relationship and thereafter for periods required by law or necessary to establish, exercise or defend legal claims. The deletion deadlines stated below remain applicable to store data processed on the merchant’s behalf.
Termination and erasure
On uninstall, the app stops serving the store. Valeria must delete merchant and customer data, including originals, copies and reproductions, within 30 days of uninstall, the data no longer being needed to provide the service, or receipt of an enforceable deletion request from the merchant, customer or Shopify, except where applicable law prohibits deletion or varies the deadline.
Retention by providers and backups
Infrastructure and provider records relating to data processed on behalf of the merchant are subject to the 30-day deletion period specified in the DPA. Where the processing method used involves an archive of requests and responses at the AI provider, that archive is retained for 30 days. Provider records for security and abuse prevention are subject to the separate applicable contractual requirements. For service alerts to operators, Microsoft Exchange Online retains technical delivery records for 90 days from sending, including after the account or organisation is deleted. Valeria does not retain copies of those alerts in Sent Items; copies in recipients’ mailboxes follow the retention choices of those recipients and their email services.
Backups are restricted to restoring the service and are not used for ordinary operations. They are subject to the deletion obligations specified in the DPA. Deletions are reapplied following a restore.
7. Providers, location and transfers
Recipients and providers
Shopify is the platform from which the app receives data and to which it sends requested cart operations. Its own processing is described in Shopify’s privacy notices and agreements with the merchant.
When the Telegram channel is used, Telegram Messenger Inc. processes communication data as an independent controller under its Privacy Policy, including copies of messages and attachments, such as audio and images, and any transfers outside the EEA.
When the customer opens a link to an external support service, the service provider receives any pre-filled message, even if the customer does not send it to the store. Processing and retention of data by the external service, including any transfers outside the EEA, are subject to its privacy notices and applicable terms. Erasure from Valeria’s systems does not delete copies held by external services.
Valeria uses Microsoft Srl for identity and access management, sending email communications through Exchange Online, AI processing, audio transcription and backup storage; Cloudflare, Inc. for transmission and protection of service traffic; and, depending on the infrastructure used, Microsoft Srl or Hetzner Online GmbH for application hosting and data storage. When processing data on the merchant’s behalf, these providers act as sub-processors under the DPA; for processing for which Valeria is controller, they act under the agreements applicable to the relevant service.
Persons authorised by Valeria access data only as necessary to provide the service and support. Appointed professional advisers and public authorities may also receive data in the cases provided by law.
Location and transfers
The application, databases and ordinary service records, including backups, are hosted in the European Economic Area (EEA). AI processing takes place in the European data zone defined by Microsoft, comprising the European Union and the EFTA countries included in that zone. International services in Microsoft’s provider chain and Cloudflare’s global network may involve access from, or transfers to, countries outside the EEA, including the United States, for security, support, identity management or service operation.
Such transfers are subject, as appropriate, to adequacy decisions or the European Commission’s Standard Contractual Clauses with any necessary supplementary measures. Before activating a store with personal data, Valeria verifies and documents the applicable providers, countries and safeguards. Merchants may request this information and a copy of applicable safeguards from support@valeria.food.
8. Rights and requests
Store customers and visitors
A customer or visitor who has used the assistant may contact the merchant operating the relevant store, using the contact details in the merchant’s notice linked from the assistant. The merchant verifies identity, assesses the request and responds; Valeria provides technical assistance with access, provision of copies, rectification, restriction or erasure. Requests about store data received by Valeria are handled with the merchant; Shopify may also forward app-related access or erasure requests to Valeria.
Choices in the assistant
Choices for optional features can be changed under “Privacy and data” in the assistant. Withdrawal does not affect the lawfulness of earlier processing and triggers the deletion process applicable to the feature concerned. Withdrawal of consent to personalisation and order support stops consultation for both uses and closes the current conversation. It does not delete orders retained by the store; data already included in conversations or diagnostics follows the applicable periods and rights.
Customers who use the assistant through Telegram may ask the merchant to erase their personal data or revoke the link between their Telegram account and their store account.
Data for which Valeria is the controller
For data Valeria processes as controller, individuals may request access, rectification, erasure where provided by law, restriction, portability where applicable, and objection to processing based on legitimate interests. Requests can be sent to amministrazione@valeria.food or by certified email (PEC) to valeria.ai@pec.it. Valeria responds within the time limits set by the GDPR. Individuals may lodge a complaint with the Italian Data Protection Authority or another competent supervisory authority.
9. Updates
Valeria updates this notice when the app’s features, data, providers or processing practices change materially. The date at the top identifies the published version. Material changes are communicated through an appropriate channel when required. Updating the notice does not extend existing consents: further uses requiring consent need a new informed choice by the user.