Privacy Policy

1. Who we are and scope of this policy

Vallen ("Vallen", "we", "us") is a web platform, available at vallen.app, that lets entrepreneurs and small businesses create a digital catalog and online store, share it on WhatsApp and social media, and receive and manage orders from an admin dashboard (admin.vallen.app).

This Privacy Policy explains what data we collect, why we use it, who we share it with and what choices you have. It applies to:

• Sellers: people who create a Vallen account to manage a store.
• Shoppers: people who visit a store built with Vallen (at vallen.app/s/… or on the seller's own domain) and place an order, leave a review or submit a report.
• Visitors: people who browse vallen.app.

2. Summary

• We only collect the data needed to run your account and your store.
• If you sign in with Google, we only receive your name, email address and profile picture. We never access your Gmail, Google Drive, contacts, calendar or any other data in your Google account.
• We do not sell your personal data or use it for advertising.
• You can download, correct or delete your data, and delete your account at any time.

3. Information we collect

3.1 Account data (sellers)

• Name and email address.
• Password, if you sign up with email (stored as a hash; we never see it in plain text).
• Profile picture, if you upload one or sign in with Google.
• Your store's country, currency and time zone.

3.2 Data we receive from Google

If you choose "Continue with Google", we receive basic profile data from Google. Section 4 explains exactly which data and how we handle it.

3.3 Store content

• Store name, link (slug), description, logo, cover image and design.
• WhatsApp contact number, social media links and custom domain, if you set them up.
• Products, prices, images, variants, categories, FAQs and store terms.
• Shipping and payment methods you configure (for example, your PayPal.me link or bank transfer details you choose to show your customers).
• Coupons and advertising pixel IDs (Meta, TikTok, Google Analytics) you choose to add to your store.

3.4 Shopper data

When a shopper places an order in a store built with Vallen, we collect the details entered at checkout:

• Name, phone number, email address and delivery address.
• Ordered products, add-ons, personalization text or images, notes and applied coupon.

We also store reviews (name, rating and comment) and store reports (reason and, if provided, your email) submitted by shoppers.

3.5 Billing data

Payments for Vallen plans are processed by our payment provider, Dodo Payments. We never see or store full card numbers; we only receive your subscription status, plan, amount and transaction identifiers.

3.6 Usage and analytics data

• Store statistics: we record visits, product clicks and store shares, along with the approximate country (derived from the IP address by our hosting provider), the referring site and a random session identifier. We do not store IP addresses in these statistics.
• Site analytics: on vallen.app and on stores we use Google Tag Manager / Google Analytics and Vercel Analytics to measure usage and performance in aggregate.
• Technical data: IP address, browser and device type, logged by our infrastructure providers for security and to operate the service.

3.7 Communications

We keep the messages you send us by email or through the feedback button in the dashboard, so we can reply.

4. Google user data

Vallen lets you create an account and sign in with Google ("Sign in with Google", using OAuth 2.0). This section specifically describes how we handle the data we receive from Google.

4.1 Data we access

We only request Google's basic openid, email and profile scopes. Through them we receive:

• Your name.
• Your email address and whether it is verified.
• Your profile picture URL.
• Your Google account's unique identifier.

We do not request or access Gmail, Google Drive, Contacts, Calendar or any other Google service or data in your Google account, and we cannot read, modify or delete anything in it.

4.2 How we use this data

• To create your Vallen account and sign you in securely.
• To display your name and profile picture inside the admin dashboard.
• To send you emails about your account (welcome, security, billing and service notices). If we send you product news, every email includes an unsubscribe link.

We do not use Google data for advertising, we do not sell it, we do not use it to build marketing profiles, and we do not use it to train artificial intelligence or machine learning models.

4.3 How we store and protect it

This data is stored in our database, hosted by Supabase, encrypted in transit (TLS) and at rest, with restricted access. We do not store your Google access tokens or use them to call Google APIs on your behalf: the OAuth exchange is handled by our authentication provider solely to verify your identity.

4.4 Who we share it with

We do not share or transfer Google data to third parties, except to the service providers we need to operate Vallen, which process it only on our instructions: Supabase (database and authentication), Vercel (hosting) and Resend (account emails). It is never sent to advertising or artificial intelligence providers. We may also disclose it if required by law.

4.5 Retention, deletion and revocation

• We keep this data while your account is active.
• If you delete your account (Settings → Danger zone in the dashboard), we immediately delete your account, profile and associated Google data. You can also request deletion by emailing support@vallen.app.
• You can revoke Vallen's access to your Google account at any time at myaccount.google.com/permissions.

4.6 Compliance with Google's policy

Vallen's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

5. How we use information

• Create and manage your account, and publish and host your store.
• Process orders and deliver them to the right seller (in the dashboard and, if configured, via WhatsApp or email).
• Show each seller their store's statistics.
• Bill subscriptions and manage free trials, coupons and cancellations.
• Send transactional emails and service notices and, unless you unsubscribe, Vallen news.
• Provide support and respond to your messages and reports.
• Prevent fraud, spam and abuse (for example, with Cloudflare Turnstile on forms).
• Improve the service using aggregated usage data.
• Comply with legal obligations.

6. Legal bases

We process data to perform our contract with you (providing the service), for our legitimate interest in operating, protecting and improving Vallen, with your consent where required (for example, for news emails or non-essential cookies), and to comply with legal obligations.

7. Who we share information with

We only share data with providers that help us operate Vallen, and each receives only what it needs for its function:

• Supabase: database, authentication (including Sign in with Google) and file storage.
• Vercel: hosting, content delivery network, approximate country geolocation and performance analytics.
• Cloudflare: bot protection (Turnstile) on forms.
• Resend: email delivery.
• Dodo Payments: subscription payment processing.
• OpenAI: optional artificial intelligence features (see section 8).
• Google: Sign in with Google and Google Tag Manager / Google Analytics.

In addition:

• Order data is shared with the seller of the store where the order was placed.
• If a seller adds Meta, TikTok or Google Analytics pixels to their store, those providers may receive browsing data from that store's visitors under their own policies.
• We may disclose information if required by law, to protect the rights and safety of Vallen and its users, or in a merger or acquisition, in which case this policy will continue to apply.

We do not sell your personal data.

8. Artificial intelligence features

Vallen offers optional features such as generating product descriptions or design suggestions for your store. Only when you use them, we send OpenAI the content needed for that task (for example, the product name or the instructions you write). We never send your Google data or your shoppers' data, and OpenAI does not use data sent through its API to train its models.

9. Shopper data: the seller's role

Each store on Vallen is managed by its seller, who decides what data to request from shoppers and how to use it to fulfill orders. For that data, the seller acts as the controller and Vallen as the processor acting on the seller's behalf. If you are a shopper and want to access, correct or delete your order data, contact the store; you can also write to us and we will help.

10. International transfers

Our providers may process data in the United States and other countries. When that happens, we rely on providers that offer appropriate safeguards, such as standard contractual clauses.

11. Retention and deletion

• Account and store: while your account is active.
• Account deletion: when you delete your account we immediately delete your profile, stores, products, images, orders and statistics. Backup copies are automatically deleted within 30 days at most.
• Billing records: kept by our payment provider for as long as tax law requires.
• Support messages and reports: for as long as needed to handle them.

12. Security

• Encryption in transit (TLS/HTTPS) and at rest.
• Passwords stored as hashes, never in plain text.
• Row-level security rules in the database: each seller can only see data from their own stores.
• Restricted internal access and bot protection on forms.

No system is 100% secure, but we continuously work to protect your data.

13. Your rights and choices

• Access and portability: request a copy of your data in a structured format.
• Rectification: correct your data from the dashboard or by asking us.
• Erasure: delete your account from the dashboard or ask us to delete your data.
• Objection and unsubscribe: unsubscribe from news emails using the link in each email.
• Revoke Google access: at myaccount.google.com/permissions.

To exercise any of these rights, email us at support@vallen.app. We respond within 30 days. You may also file a complaint with the data protection authority in your country.

14. Cookies

We use cookies that are necessary to keep you signed in and keep your cart, and analytics cookies to understand how the site is used. See our Cookie Policy for details.

15. Children

Vallen is not intended for anyone under 18, and we do not knowingly collect data from minors. If you believe a minor has given us their data, contact us and we will delete it.

16. Changes to this policy

We may update this policy. If the changes are significant, we will notify you by email or in the dashboard before they take effect. The date of the last update appears at the top of this page.

17. Contact

If you have questions about this policy or your data:
Email: support@vallen.app
Website: https://vallen.app