Privacy Policy

This policy explains how Grovlix Unipessoal LDA (NIPC 518316327), registered office Rua Dom Afonso Henriques, Número 132, 4950-854 Monção, Viana do Castelo, Portugal ("we", "us"), collects and uses personal data when you use InstaFeed. InstaFeed and PopupSnap are products of Grovlix, a company registered in Portugal. Grovlix Unipessoal LDA is the data controller. We are the controller of the data described in sections 1 to 3. For data about a store's own shoppers (section 4) we act for the merchant, who is the controller.

1. Data we collect from merchants

• Account data: your email address, name (if you give it or your platform shares it), and login details handled by our authentication provider. We never see passwords in clear text.
• Instagram and TikTok details: the public handles you enter (or accounts you connect), and the public posts, captions, videos, thumbnails and public counts we retrieve for them. We keep copies of public content and of the related videos and thumbnails on our own servers so your widget loads quickly.
• Widget settings, product tags, curation choices and usage of the dashboard.
• Support messages and the email or WhatsApp details you give us when you contact us.
• Technical data: IP address, browser type and request logs when you use our site or dashboard, kept for security and troubleshooting.

2. Data from your store platform

• Salla and Zid: when you install the app we receive your store identifier, store name and domain, the access tokens the platform issues to the app (Salla tokens are stored encrypted; all tokens are kept in an access-restricted database), your subscription status from the platform, and the product catalog we need to let you tag products.
• Shopify: your myshopify.com domain, the app access token (encrypted), the granted scope (read_products), your Shopify subscription status, and, with read_products, product names, descriptions, images and prices so you can tag products on posts. We do not read orders or customer data.
• WooCommerce and WordPress: when you install the PopupSnap plugin and connect your store we receive your store URL, a read-only WooCommerce API key and secret that you authorise (protected with encryption), and your product catalog (names, descriptions, prices, images, categories, stock status and variations). The plugin also sends technical pings: when a product is saved or removed, when the plugin is deactivated or uninstalled, and a daily check that it is still active. We do not read orders or customer accounts, and the key has read permission only.
• Websites with an embed code: the website address where the code runs and the settings you choose.

3. Payments and Paddle

Merchants who subscribe directly on our website pay through Paddle. Paddle.com is the Merchant of Record and an independent controller of the payment data it collects: your name, email, billing address, tax details and payment method. We do not receive or store your full card number. We receive from Paddle your customer and subscription identifiers, plan, status, billing period dates, country and email. Paddle's use of your data is described in its privacy notice and the Buyer Terms. Merchants billed by Salla, Zid or Shopify pay that platform, not Paddle.

4. Your store's shoppers (widget data)

The widget runs on the merchant's storefront. It does not use cookies. To count unique visitors it stores one random identifier in the shopper's browser local storage and sends only a hash of that identifier combined with the widget key and the current date, so the value changes every day and does not identify a person. We record event types (such as views, clicks, video plays), the post concerned and the device type, and aggregate them for the merchant's analytics. Where the store platform provides it, interactions such as likes, bookmarks and comments are stored with the shopper's platform display name and identifier. Merchants are responsible for telling their shoppers about this in their own privacy notice and for any consent their local law requires.

5. Instagram and TikTok content providers

To show a merchant's Instagram and TikTok posts, we retrieve public content through third-party data providers, and through official platform interfaces where available. We send those providers the public username or link the merchant entered. We do not send them merchant account credentials, store customer data or payment data. We are not affiliated with Instagram, Meta or TikTok.

6. How we use data and our legal bases

• To provide and secure the Service, run your account and support you (performance of a contract, and our legitimate interests).
• To take payments, prevent fraud and meet tax and accounting duties (contract, legal obligation).
• To send service emails such as receipts, trial and renewal notices, security alerts and, if you enabled them, weekly analytics reports (contract, legitimate interests).
• To understand and improve how the dashboard is used (legitimate interests, or consent where the law requires it).
• To send product news or offers, only where you agreed or the law allows; you can unsubscribe at any time (consent, legitimate interests).

7. Who we share data with (sub-processors)

We do not sell personal data. We share it only with service providers that help us run the Service, under contracts that limit their use of it:

We may also disclose data where the law requires it or to protect our rights. If we are part of a merger or sale, data may transfer to the new owner under this policy.

8. International transfers

Our providers operate in several countries, so your data may be processed outside your own country. Where the law requires it, we use safeguards such as standard contractual clauses or equivalent approved mechanisms.

9. Cookies and local storage on our site

On instafeed.popupsnap.com we use storage that is necessary to keep you signed in and to remember your language and theme, a short attribution cookie (ps_attr) recording the page and campaign parameters you arrived from, and analytics tools (PostHog and Google Tag Manager) on our own site. You can block or delete these in your browser; some parts of the dashboard will then not work.

10. How long we keep data

We keep account and store data while your account is active. When you uninstall the app or delete your account we stop syncing and delete or anonymise your store data after a reasonable period, except records we must keep for tax, accounting, fraud prevention or legal claims. Aggregated analytics that no longer identify you may be kept.

11. Your rights

Depending on where you live (including under the GDPR, the UK GDPR and the Saudi Personal Data Protection Law), you may have the right to access, correct, delete or export your personal data, to object to or restrict some processing, to withdraw consent, and to complain to your data protection authority. Email [email protected] and we will respond within the time the law requires. For payment data held by Paddle, you can also contact Paddle.

12. GDPR: legal bases and your rights in the EU and EEA

Grovlix Unipessoal LDA is established in Portugal, so the EU General Data Protection Regulation (GDPR) applies to the personal data we control. The Saudi Personal Data Protection Law (PDPL) also applies to merchants and shoppers in Saudi Arabia; section 11 covers both.

We rely on these legal bases (section 6 shows which one applies to each purpose):

• Contract: to create your account and provide, bill and support the Service you asked for.
• Legal obligation: to keep accounting and tax records and answer lawful requests.
• Legitimate interests: to secure the Service, prevent fraud and abuse, and understand and improve how it is used, balanced against your rights.
• Consent: for optional things such as product news or non-essential cookies; you can withdraw it at any time without affecting what happened before.

Under the GDPR you have the right to:

• access the personal data we hold about you and get a copy;
• have inaccurate data corrected (rectification);
• have your data erased ("right to be forgotten"), unless we must keep it by law;
• receive your data in a structured, machine-readable form and have it transferred to another provider (portability);
• object to processing based on our legitimate interests, and to direct marketing at any time.

To use any of these rights, email [email protected] from the address on your account. We may ask you to confirm your identity and will answer within one month, as Article 12(3) of the GDPR requires. For complex or numerous requests the law allows us to extend that period by up to two further months; if we do, we will tell you within the first month and explain why. You also have the right to complain to the supervisory authority. In Portugal that is the Comissão Nacional de Proteção de Dados (CNPD), www.cnpd.pt, or the authority in the EU country where you live or work.

13. Security

We use encryption in transit, encryption of Shopify, Salla and WooCommerce credentials at rest, restricted access to our database, and monitoring. No system is completely secure, so we cannot guarantee absolute security.

14. Children

The Service is for businesses and is not directed to people under 18. We do not knowingly collect personal data from children.

15. Changes to this policy

We may update this policy. We will post the new version here with its date and, for material changes, tell you by email or in the dashboard.

16. Contact

Data controller: Grovlix Unipessoal LDA (NIPC 518316327), a company registered in Portugal. Registered office: Rua Dom Afonso Henriques, Número 132, 4950-854 Monção, Viana do Castelo, Portugal. Email: [email protected]. See also the Terms of Service and Refund Policy.