Privacy Policy

1. Introduction & Overview

This Privacy Policy governs the processing of personal data by Velissimo (Trading as Velissimo Commerce) ("Velissimo", "we", "us", or "our") in connection with your use of our website, online storefront hosted at https://m0t40f-6q.myshopify.com, and connected commerce integrations.

We are dedicated to respecting your privacy, complying with the General Data Protection Regulation (GDPR), the UK Data Protection Act 2018, and applicable international data protection standards.

2. Services & Integrations in Scope

Velissimo operates in conjunction with leading commerce and cloud providers. The following services are in scope of this policy:

• Shopify Storefront & Admin API: Hosted ecommerce platform facilitating product catalogs, order processing, and customer checkouts at https://m0t40f-6q.myshopify.com.
• Etsy Marketplace Integration: Multichannel integration connected via OAuth 2.0 PKCE to our verified shop (Velissimo / velissimocommercev1) for product synchronization and fulfillment.
• Pinterest Visual Commerce: Application integration for pin publishing, catalog scheduling, and storefront referral tracking linking back to our canonical Shopify product pages.
• Google Cloud Platform (GCP): Secure enterprise hosting and runtime infrastructure deployed in the London region (europe-west2) via Google Cloud Run, Cloud Storage, and Google Secret Manager.
• Print-on-Demand (POD) Production Partners: Direct production and fulfillment partners (Printful, Printify) fulfilling on-demand apparel and merchandise orders.

3. Information We Collect

We collect and process the following categories of information:

A. Customer & Transactional Data

• Order Information: Customer name, delivery address, billing address, email address, phone number, and items purchased when placing an order through our Shopify storefront.
• Payment Data: Payment card details are processed directly and securely by authorized payment gateways (Shopify Payments, Stripe). Velissimo never stores or has access to your raw credit or debit card numbers.

B. Technical & Authentication Data

• OAuth 2.0 Authentication Tokens: Cryptographically secured access and refresh tokens utilized for server-to-server communication with Etsy and Pinterest API endpoints.
• Access Logs & Telemetry: IP addresses, user-agent strings, request timestamps, and response statuses recorded by our Google Cloud Run servers for performance monitoring and intrusion prevention.

C. Market Intelligence & Research Data

• Marketplace Research Data: Aggregate product pricing and category metadata observed from authorized marketplace APIs (e.g. Etsy Open API v3). No personal identifiable information (PII) is collected or processed during market trend analysis.

4. How We Use Your Information

We process personal data strictly for lawful, legitimate business purposes:

• Order Fulfillment: Ingesting customer orders, transmitting fulfillment specifications to POD production facilities, and dispatching tracking updates.
• Multichannel Commerce: Publishing product designs and commercial pins to Pinterest and Etsy with links directing shoppers to our Shopify storefront.
• Security & Authentication: Protecting operator workstations, verifying OAuth callbacks via anti-replay state nonces, and ensuring tenant isolation.
• Customer Support: Responding to enquiries, managing returns or cancellations, and providing delivery updates.

5. Third-Party Service Providers & Data Processors

We share data with trusted third parties strictly necessary to operate our business:

• Shopify Inc. (Storefront hosting, checkout, and order management)
• Pinterest, Inc. (Visual commerce, product pins, and catalog distribution)
• Etsy, Inc. (Marketplace shop integration and order synchronization)
• Google Cloud Platform (Hosting, database management, and encrypted object storage in europe-west2)
• Printful / Printify (On-demand manufacturing, printing, and parcel shipping)

6. Data Security & Encryption

Velissimo enforces strict architectural security policies across all systems:

• Zero Secrets Exposure: All API keys, shared secrets, and OAuth tokens are stored in Google Cloud Secret Manager and encrypted at rest using Google-managed encryption keys.
• Encryption in Transit: All web and API traffic is enforced over HTTPS with TLS 1.3 encryption.
• Role-Based Access Control (RBAC): Server-authoritative role scoping ensures only authorized operators have access to operational commands.

7. Data Retention

We retain customer transaction and order records only for as long as required to fulfill orders, handle warranty or return claims, and satisfy legal, accounting, or tax reporting requirements (typically 6 years in the UK). Technical logs and diagnostic records are automatically purged on a 30-day rolling window.

8. Cookies & Tracking Technologies

Our Shopify storefront uses essential cookies to enable shopping cart functionality, secure checkout, and user session continuity. We do not deploy intrusive cross-site tracking scripts or sell customer data to third-party data brokers.

9. Your Data Protection Rights

Under GDPR and applicable data protection legislation, you have the following rights:

• Right of Access: You may request a copy of the personal data we hold about you.
• Right to Rectification: You may request that inaccurate or incomplete data be corrected.
• Right to Erasure ("Right to be Forgotten"): You may request deletion of your personal data where retention is no longer legally necessary.
• Right to Restriction of Processing: You may request that we restrict processing under certain conditions.
• Right to Data Portability: You may request your data in a structured, machine-readable format.
• Right to Object: You may object to data processing based on legitimate interests.

10. Contact & Privacy Enquiries

To exercise any of your privacy rights, or if you have questions regarding this Privacy Policy, please contact our privacy team:

• Contact Channel: [OPERATOR SPECIFIED: privacy@velissimo.com / support@velissimo.com]
• Mailing Address: [OPERATOR SPECIFIED: Registered Business Address, United Kingdom]
• Data Protection Officer: [OPERATOR SPECIFIED: Data Protection Officer / Privacy Lead]

Note: Business address and named privacy contacts above are designated operator-supplied fields. Updated operational notices will be posted to this page.