1. Controller. BALTICSOUTH OÜ, registry code 17114245, Karamelli tn 2, Kesklinna linnaosa, Tallinn, Harju maakond, 11317, Estonia. Contact for privacy questions: hello@viplor.app.
2. What we collect and why
| Data | Purpose | Legal basis (GDPR) |
|---|---|---|
| Account data: e-mail address, authentication identifiers | Create and secure your account, send service e-mails | Contract |
| Store data: the store address you submit and the public product-page content we read from it | Produce your audits and reports | Contract |
| Audit results and history | Show your results and history | Contract |
| Subscription data: plan, status, billing period, payment-provider identifiers (we do not receive your card number) | Grant access to paid features, manage your subscription | Contract; legal obligation |
| Technical data: IP address, request logs, security and error logs, session cookie | Security, abuse prevention, reliability | Legitimate interests |
| Support messages | Answer your requests | Contract; legitimate interests |
We do not use your data for advertising and we do not sell personal data. We do not use analytics or advertising trackers.
3. Cookies. We use only strictly necessary cookies: `viplor_customer_session`, a secure HttpOnly session cookie that keeps you signed in, and `viplor_customer_csrf`, a token that protects forms against cross-site requests. These do not require consent under EU rules. We also use strictly necessary same-session browser storage: `viplor.preview.reference` keeps the reference needed to retrieve your preview, and `viplor_checkout_pending` tracks a pending checkout when you return to your account.
4. AI processing. We send the public content of the analyzed product pages to our AI analysis providers to produce the audit. We do not send your password, payment data or account e-mail to them.
5. Who receives data (processors)
| Provider | Role | Location |
|---|---|---|
| Supabase | Database and authentication | EU, Stockholm (Sweden) |
| Vercel | Website and API hosting | Functions in Stockholm (arn1) plus a global CDN |
| Render | Runs background audits | Frankfurt (Germany) |
| Mistral AI | AI text generation: writes the explanatory text of your audit report | See its privacy notice |
| TypeSafe | AI assistant checks: runs the product page checks behind the ChatGPT, Gemini and Copilot breakdown | See its privacy notice |
| Resend | Service e-mails | EU region |
| Creem | Payments, taxes and invoices, as merchant of record and independent controller of billing data | See its privacy notice |
We have data-processing agreements with our processors. Some of them (for example Vercel, Supabase, Render and Resend) are part of groups based in the United States, and data may be accessed from or transferred outside the European Economic Area, including through Vercel's global CDN. Where this happens, we rely on an adequacy decision (including the EU–US Data Privacy Framework for certified providers) or the European Commission's standard contractual clauses, with additional safeguards where needed. You can ask us for a copy of the relevant safeguards at hello@viplor.app.
6. Retention. Account and audit data are kept while your account is active. You can request deletion of your account, which also erases your workspace, store and audit data, from the app (section “Delete your account”); you can also e-mail hello@viplor.app. After a 7-day cancellable waiting period, we erase your personal data, except billing facts that we must keep for accounting (subscription identifier, plan, status and dates, without your name, e-mail or store), which we keep for 7 years from the end of the financial year, as required by the Estonian Accounting Act (§ 12), then deleted. If you have an active subscription, confirming the deletion also ends it with our billing provider at the end of the period you already paid, so you are not charged again; the rest of that period is not refunded. Automatic retention periods are listed in the table below. Backups and platform logs are kept for our providers' standard retention periods, then deleted.
| Data | Action | Period |
|---|---|---|
| Deletion request, waiting period | executed after | 7 days |
| Free-preview requests never claimed (e-mail, store address, result) | deleted | 90 days |
| Service e-mail records: recipient address and error text | redacted | 30 days |
| Finished audit jobs | deleted | 365 days |
| Collected page evidence | deleted | 365 days |
| Audit runs, per-product records, usage events | deleted | 730 days |
| Abandoned, failed or expired checkout attempts | deleted | 90 days |
| Completed checkout attempts | deleted | 730 days |
| Billing event ledger (no personal data) | deleted | 7 years from the end of the financial year |
| Retained billing records (no personal data) | deleted | 7 years from the end of the financial year |
| Finished deletion requests (anonymised) | deleted | 365 days |
7. Your rights. You may request access, correction, deletion, restriction, portability, and object to processing based on legitimate interests. You can download a copy of your data from the app (Settings, “Download my data”). E-mail hello@viplor.app; we will respond within one month. You may also complain to the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, aki.ee) or your local authority.
8. Security. We use encrypted connections, per-customer data isolation, signed payment webhooks and limits on automated access. No system is perfectly secure; we will notify you and the authorities of a personal-data breach where the law requires.
9. Children. Viplor is a business service and not directed at anyone under 18.
10. Changes. We will post updates here and give notice of material changes by e-mail or in the app.
11. Contact. hello@viplor.app.