Privacy Policy
Effective date: 15 October 2026
Last updated: 15 October 2026
This Privacy Policy explains how WorldShop, LLC, a limited liability company with its principal office at 9600 Blue Larkspur Ln, Ste 201, Monterey, California 93940, United States ("Shopo", "we", "us"), collects, uses and shares personal data when you use the Shopo web applications at buyer.shopocircles.com and client.shopocircles.com and the Shopo Go mobile app (together, the "Service").
1. What Shopo is, and who is responsible for your data
Shopo is a software tool for personal shoppers ("Buyers") who purchase goods from online shops on behalf of their customers ("Clients"). Buyers use Shopo to keep track of their Clients, orders, items, delivery costs, invoices and Client balances. Clients use Shopo to send product requests to their Buyer, follow their orders, see their balance and receive the Buyer's offers.
Shopo does not sell goods, does not buy goods on anyone's behalf and does not handle payments. Purchases, payments, delivery and refunds are arranged directly between the Buyer and the Client (see our Terms of Service).
Because of this, two parties handle your personal data:
- Shopo is responsible ("controller") for account data needed to run the Service: login credentials, app security, push notifications, technical logs and support requests.
- Your Buyer decides what Client information to record in their workspace, such as order details, balance entries, notes and imported client lists. For that data Shopo acts on the Buyer's instructions as a service provider ("processor"). If you are a Client and have a question about how your Buyer uses your data, you can contact your Buyer directly or contact us and we will pass your request on.
2. Personal data we collect
2.1 Data you give us
| Category | Examples | Who provides it |
|---|---|---|
| Account data | first and last name, email address, phone number, password (stored only as a one-way hash) | Buyers and Clients at registration |
| Client records created by a Buyer | Client name and, optionally, email and phone; opening balance; when a Buyer imports a spreadsheet, the data in that spreadsheet | the Buyer |
| Profile photo | avatar image | you, optionally |
| Order and item data | product links, product names, sizes, colours, prices, product photos you take or upload, notes, order and tracking numbers, courier | Clients and Buyers |
| Balance and payment records | payment amounts, dates and notes that a Client reports, confirmations by the Buyer, invoices, the resulting balance | Clients and Buyers |
| Buyer business data | the Buyer's bank details (shown to Clients on invoices and emails), commission rate, exchange rates, minimum balance | the Buyer |
| Buyer's internal note about a Client | free-text note, visible only to the Buyer | the Buyer |
| Support requests | your email and the content of your message | you |
We do not collect payment card numbers, government IDs, dates of birth or postal addresses.
2.2 Data collected automatically
- Technical and log data. Our servers and our network provider (Cloudflare) record standard request data: IP address, date and time, requested URL, browser or app user-agent and response status. We use it for security, abuse prevention and troubleshooting.
- Login sessions. On the web we set a session cookie. In the mobile app we keep sign-in tokens in your device's secure storage (iOS Keychain / Android Keystore).
- Push notification token. If you allow notifications in Shopo Go, we store the device's Firebase Cloud Messaging token and its platform (iOS/Android) to send you notifications, for example when your Buyer sends new offers.
- Activity timestamps that are needed for features, for example when you last opened your offers feed (used to count new offers).
2.3 Shop pages you open inside Shopo Go
Shopo Go has a built-in browser for visiting online shops. While you browse, the shop's own website may set its own cookies on your device. Shopo does not read those cookies. Each shop's privacy policy applies to your use of it.
When you tap "Оформити замовлення" (Place order), the app takes a copy of the text and structure of the product page you are looking at, with scripts, styles and media removed, and sends it to us together with the page address. We use it only to recognise the product, its name, price, size, colour and image, and to fill in the order form for you. If you are signed in to the shop, the page may contain details the shop shows to you, such as your name in the shop header. We do not look for or use such details.
3. How we use personal data, and our legal bases
| Purpose | Legal basis (GDPR / Ukrainian law "On Personal Data Protection") |
|---|---|
| Create and secure your account, sign you in, confirm your email, reset your password | performance of our contract with you |
| Let Buyers and Clients work together: orders, items, balances, invoices, offers | performance of contract; for Client records, the Buyer's legitimate interest in running their business |
| Recognise products from links and shop pages, including automated processing by AI models (§4) | performance of contract |
| Send service emails: activation, password reset, invoices, payment updates, account-deletion confirmation | performance of contract |
| Send push notifications | your consent, given through the device permission; you can withdraw it at any time in your device settings |
| Security, fraud and abuse prevention, debugging, keeping logs | our legitimate interests |
| Comply with legal obligations and respond to lawful requests | legal obligation |
Where Ukrainian law requires your consent to process personal data, you give it when you create an account and accept this Policy, and you can withdraw it at any time (§8). Withdrawing consent does not affect processing that took place before.
We do not sell personal data and do not make decisions about you based solely on automated processing that have legal or similarly significant effects on you.
4. Who we share personal data with
- Between Buyers and their Clients. A Client's name, contacts, orders, items, photos, notes and balance are visible to that Client's Buyer. A Buyer's name, photo, bank details, offers and the data of their shared orders are visible to their Clients. Clients of the same Buyer cannot see each other's data.
- Service providers that process data for us under contract:
| Provider | What it does for us | Data involved |
|---|---|---|
| Hetzner Online GmbH (Falkenstein, Germany) | hosts our servers, databases and uploaded files | all Service data |
| Cloudflare, Inc. (USA) | network security, DNS, content delivery; all traffic passes through it | technical data, data in transit |
| Mailgun Technologies, Inc. (EU data region) | sends our emails | name, email, email contents such as invoices and Buyer bank details |
| Google LLC: Firebase Cloud Messaging | delivers push notifications | push token, notification text such as the Buyer's name |
| Google LLC (Gemini API) and/or OpenAI, L.L.C. | AI models that recognise product data on shop pages | the product page copy and link described in §2.3 |
| Decodo (residential proxy network) | loads public shop pages when a product link is added | product links only, no account data |
- Legal reasons. We may disclose data if required by law, court order or a lawful request from authorities, or to protect the rights, safety and property of our users, us or others.
- Business transfers. If Shopo is involved in a merger, acquisition or sale of assets, personal data may be transferred as part of that transaction under this Policy's protections.
5. International transfers
Shopo is operated from the United States, our servers are located in Germany (EU), and some of our providers process data in the United States and the European Union. Your data may therefore be transferred outside Ukraine or the EEA. Where required, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses or our providers' participation in the EU–U.S. Data Privacy Framework.
6. How long we keep data
- Account and workspace data: for as long as the account is active.
- When a Client deletes their account (§8): sign-in data, device tokens, the avatar and order items that had not been processed yet are deleted immediately. While the Client still has open obligations with their Buyer, such as a non-zero balance, unfinished orders or unconfirmed payments, the Buyer keeps seeing the Client's name, contacts and orders so that they can settle them. Once nothing is open, the Client's name, email, phone and personal notes are permanently removed and replaced with "Deleted client".
- Order and financial records (orders, items, amounts, transactions, invoices) are kept in de-identified form after deletion. The Buyer needs them for bookkeeping and dispute resolution, and they may be required by law.
- Technical logs and product page copies sent for product recognition are kept only as long as needed for security, troubleshooting and improving product recognition.
- Deleted data may remain in backup copies for a limited time until those copies are overwritten or deleted.
7. Security
We take reasonable technical and organisational measures to protect personal data. No system is perfectly secure. If you think your account has been compromised, contact us right away.
8. Your rights and choices
Depending on where you live, you may have the right to:
- access the personal data we hold about you and receive a copy;
- correct inaccurate data. Most profile data can be edited in the app;
- delete your account and data, subject to the records described in §6;
- object to or restrict certain processing;
- withdraw consent, for example turn off push notifications in your device settings;
- data portability for data you provided;
- lodge a complaint with a supervisory authority. In Ukraine this is the Ukrainian Parliament Commissioner for Human Rights (ombudsman.gov.ua); in the EU it is your local data protection authority.
Deleting your Shopo Go account: open the app → «Мій профіль» (My profile) → «Видалити акаунт» (Delete account) and confirm with your password. Buyers, and Clients without the app, can request deletion by emailing [email protected].
To use any other right, email us at [email protected]. We may need to verify your identity. If the request concerns Client data that a Buyer recorded, we may forward it to that Buyer.
U.S. residents: depending on your state, you may have similar rights to know, correct and delete your data. We do not sell or "share" personal data for cross-context behavioural advertising.
9. Children
The Service is intended for adults. You must be at least 18 years old to use it. We do not knowingly collect data from children. If you believe a child has given us personal data, contact us and we will delete it.
10. Cookies and similar technologies
We use cookies and similar on-device storage that are necessary to run the Service: to keep you signed in, to remember your interface language and app settings, and for security (including technical cookies set by Cloudflare).
11. Changes to this Policy
We may update this Policy from time to time. If changes are material, we will notify you by email or in the app before they take effect. The "Last updated" date shows when the Policy was last changed.
12. Contact us
WorldShop, LLC
9600 Blue Larkspur Ln, Ste 201, Monterey, California 93940, United States
Email: [email protected]