Privacy policy

Waitlist. When you join the waitlist: your email address, WhatsApp number, country, browser language, and where you came from (ad campaign tags such as utm_source, the Facebook or Google click ID, the referring website and the page you landed on). If you continue with Google, we also receive your Google account ID and name.

Merchant accounts. When you have an Ostorya account: your name, email, password (stored only as a one-way hash), your shop details (name, address on Ostorya, country, currency, time zone), your team members, your preferences (language, wallpaper), and what you create in Ostorya (products, images, themes, discounts, messages to the theme assistant).

Feature requests. When you send us an idea from your desktop: what you write, the pictures you add and, if you choose to record one, your voice note. Only our team listens to or reads them, to answer you and plan new features; you can ask us to delete them at any time.

Your shop’s customers. When people order from a shop built on Ostorya, the shop collects their name, phone or WhatsApp number, city, address, the order, its delivery status and payment. For this data the merchant is responsible (the “controller”); we process it only to run their shop.

Technical data. IP address, browser and device type, and the cookies listed below, to keep you signed in, protect the service against abuse and measure our ad campaigns.

Visit counts. When you open our public pages (home, waitlist, legal pages), we count the visit: the page, the type of device, your browser language, and the ad campaign or website that sent you. We do not store your IP address for this; we keep only a code made from it that changes every day, so we can count unique visitors without recognising you.

• To run Ostorya: accounts, shops, orders, delivery and the features you use.
• To contact waitlist members by WhatsApp or email when Ostorya opens, and about their access.
• To measure our own ad campaigns on Meta, Google and ChatGPT (see “Advertising measurement”).
• To keep the service secure: rate limits, fraud and abuse checks, logs.
• To answer support and data requests.

We do not sell personal data. We do not use your shop’s customer data for our own marketing.

To know which of our ads bring visitors and sign-ups, our public pages (home, pricing, features, about, contact, legal pages and the waitlist page) can use the Meta Pixel and Meta’s Conversions API, the Google tag (Google Analytics and Google Ads) and the OpenAI pixel (ads in ChatGPT). When you open one of these pages, each of them can receive the page view with your IP address, browser and its own cookies. When you join the waitlist, they receive a sign-up event; for Meta we also send your email address, WhatsApp number and country hashed (SHA-256) from our server, so Meta can match it to an ad click without us sending them in clear text. Your Ostorya desktop, our admin pages and the shops built on Ostorya never load these tags. You can limit ad tracking in your Meta and Google account settings, and block these tags in your browser.

If you choose “Continue with Google”, Google tells us your email address, name and Google account ID, and that your email is verified. We use them only to fill in your waitlist entry or sign you in. We do not access your Gmail, contacts, files or any other Google data.

When a merchant asks the theme assistant to change their shop, we send the request, any images attached to it and the current theme settings to Anthropic (Claude) to produce the change. The conversation is saved in the merchant’s account so changes can be undone. Anthropic processes this data on our behalf and does not use it to train its models under its commercial terms.

• Hosting: our servers and database, operated by our hosting providers in the European Union.
• Meta Platforms (Pixel and Conversions API on our public pages), Google (sign-in, Google Analytics and Google Ads on our public pages), Anthropic (AI features: theme assistant, product import, brand checks, AI Landing Page research), OpenAI (AI Landing Page images: the product photos and page texts the merchant chooses are sent to generate them; and the OpenAI pixel on our public pages, for ChatGPT ad measurement).
• Stripe (card payments for credits: Stripe receives your card and billing details, Ostorya never sees your full card number), Resend (sending our emails), Cloudflare (DNS, protection and email forwarding).
• Delivery companies chosen by each merchant receive the delivery details of that merchant’s orders.
• Authorities, only when the law requires it.

Some of these providers are in the United States. Where data leaves your country, we rely on the provider’s contractual safeguards.

• Session cookie (omni_session): keeps you signed in. Necessary.
• Preview and sign-in cookies (omni_preview, omni_wl_google, omni_g_state): short-lived, for theme previews and Google sign-in. Necessary.
• Advertising cookies: Meta (_fbp, _fbc), Google (_ga, _ga_*, _gcl_*) and OpenAI, set by their tags on our public pages, for ad measurement.

Your browser may also keep small preferences locally (for example, the sidebar you collapsed). These never leave your device.

• Waitlist entries: until you get access, then for up to 12 months, or until you ask us to delete them.
• Accounts and shop data: while the account is open; deleted within 30 days after the account is closed, except what the law requires us to keep (for example invoices).
• Server logs: only as long as needed for security and troubleshooting, then deleted.

You can ask to see, correct, export or delete your personal data, and object to its use for ad measurement. Write to [email protected] from the email address you used. We answer within 30 days. To delete your data, follow the data deletion instructions. If you are a customer of a shop on Ostorya, contact that shop first; we will help them answer you.

Depending on where you live, you may also have the right to complain to your data protection authority (for example the CNDP in Morocco or your authority in the European Union).

Connections are encrypted (HTTPS). Passwords are hashed with Argon2. Each shop’s data is kept apart in the database by row-level security, so one shop cannot read another’s. Staff access is limited to what is needed to run the service.

Ostorya is for businesses and is not meant for anyone under 18. We do not knowingly collect data from children.

We will update this page when our practices change and show the date at the top. For important changes we will tell account holders by email or WhatsApp.

Questions: [email protected] · WEB UNIVERS LLC, 30 North Gould Street, Sheridan, WY 82801, United States.