Privacy Policy
Alondio is not yet generally available. This policy is published ahead of launch and describes how the service will handle personal data.
This is a pre-launch draft prepared in good faith and pending review by a qualified lawyer.
1. Who we are
APPVANGUARDS SRL, registered in Romania, unique registration code (CUI) RO41268079, registered office at Jud. Ilfov, Sat Tamaşi, Comuna Corbeanca, Strada Chişinău, Nr. 42, operates Alondio.
For any privacy question or to exercise a right, write to contact@alondio.com.
2. Two roles, and why the difference matters
Alondio sits between a merchant and that merchant's customers, so we handle two different kinds of personal data in two different legal capacities. Which section below applies to you depends on which you are.
- We are the controller of the merchant's own data — the account, contact details, billing and subscription status, and support correspondence. We decide why and how that data is processed. Section 3 applies.
- We are a processor of the merchant's customers' data — phone numbers, cart and order events, consent records, delivery status and attribution identifiers. The merchant is the controller of that data; we act on their documented instructions and for no purpose of our own. Section 4 applies.
If you are a customer of a shop that uses Alondio and want to see, correct or delete your data, contact that shop. They are the controller and we assist them. If you contact us directly we will pass the request on, but we cannot act on it ourselves.
3. Where we are the controller: merchant data
| Purpose | Data | Legal basis | Retention |
|---|---|---|---|
| Providing and securing the account | Shop domain, name, email, authentication and session data, app settings | Performance of a contract (Art. 6(1)(b)) | Life of the account, then 24 months |
| Billing and subscription management | Subscription status, charge records and identifiers from Shopify | Contract (Art. 6(1)(b)) and legal obligation (Art. 6(1)(c)) | As required by Romanian accounting and fiscal law |
| Support and correspondence | Messages you send us and our replies | Legitimate interest in supporting our merchants (Art. 6(1)(f)) | 36 months from last contact |
| Service security and diagnostics | IP address, timestamps, error and request logs | Legitimate interest in keeping the service secure (Art. 6(1)(f)) | Up to 12 months |
| Waitlist, product updates and launch notifications | Email address, plus the exact consent wording you agreed to, the time, your IP address and browser user agent — kept as evidence that consent was given | Consent (Art. 6(1)(a)), withdrawable at any time | Until you unsubscribe, at which point the record is deleted outright rather than flagged |
4. Where we are a processor: your customers' data
We process the following on the merchant's instructions, to deliver the service they have asked for. The legal basis for this processing is the merchant's to establish, not ours.
| Category | Examples | Why it is processed |
|---|---|---|
| Contact identifiers | Phone number, name | To address and deliver a message |
| Commerce events | Cart contents and abandonment, order confirmed / shipped / delivered, product availability | To decide whether a message should be sent, and what it should say |
| Consent records | Timestamp, source, channel of an opt-in | To gate marketing sends and to evidence consent |
| Message metadata | Template used, send time, delivery state, failure reason | To show whether a message arrived and why it did not |
| Attribution identifiers | Advertisement click identifiers, conversation references, order references | To associate an ad click with a conversation and an order |
We do not sell this data, do not use it for our own marketing, and do not use it to train models for third parties. A data processing agreement covering this role is available from contact@alondio.com.
5. Who else receives data
- Meta Platforms — necessarily receives the recipient's phone number and message content in order to deliver a WhatsApp message. Meta acts as an independent controller for parts of this.
- Shopify — the source of store, order and customer data, and the channel through which subscriptions are billed.
- Infrastructure providers — hosting and database services running the application.
- Operational services — email delivery and error monitoring.
- Professional advisors and authorities — where required by law or to establish or defend legal claims.
We share only what each recipient needs. A current list of sub-processors is available on request, and merchants will be notified of changes to it.
6. Transfers outside the EEA
Delivering a WhatsApp message necessarily involves Meta Platforms, which is based in the United States. That transfer is unavoidable if you want to send WhatsApp messages at all, and it happens on the basis of the safeguards in Chapter V GDPR — an adequacy decision where one applies, and Standard Contractual Clauses otherwise.
We intend for merchant and customer data under our own control to be stored on EU infrastructure. That is a commitment about how we will build the service rather than a description of infrastructure that exists today, and this policy will be updated with specifics once hosting is finalised.
7. Retention and deletion
We keep personal data no longer than needed for the purpose it was collected for, or for as long as the law requires. Two commitments are worth stating plainly because they are enforced in the software rather than left to policy:
- Message content and customer personal data are never written to our logs.Logs record identifiers and status codes — not phone numbers, names, addresses, or the values substituted into a message template.
- Erasure is a real deletion. A deletion request results in records actually being removed and cascading to the related messages and consent records. We do not mark data as deleted while retaining it.
We implement Shopify's mandatory privacy webhooks — customer data request, customer redact, and shop redact — so that requests reaching a merchant through Shopify are honoured.
8. Security
We apply technical and organisational measures appropriate to the risk, including encryption in transit, restricted access to production systems, verification of the signature on every incoming webhook, and the logging restrictions described above. No system is perfectly secure, and we do not claim certification we have not obtained.
9. Your rights
Where we are the controller, you may request access to your data, correction, erasure, restriction, portability, or object to processing based on legitimate interests. Where consent is the basis, you may withdraw it at any time without affecting prior processing.
Write to contact@alondio.com. We respond within one month, extendable by two further months for complex requests, and free of charge.
As noted in section 2, an end customer of a shop using Alondio should direct their request to that shop.
10. Complaints
Please raise a concern with us first. You also have the right to complain to the Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP) at dataprotection.ro, or to the supervisory authority where you live or work.
11. Cookies and this website
alondio.com sets no cookies and runs no analytics or tracking scripts.The site is static HTML, the documentation search runs entirely in your browser, and there is nothing here to consent to — which is why you are not being asked.
The Alondio app inside the Shopify admin uses only the session cookies and tokens required for it to function and for Shopify to authenticate you. Those are strictly necessary and are covered by section 3 above. If this ever changes we will say so here and, where consent is required, ask for it before setting anything.
12. Changes
We will update this policy as the service develops and will publish the revised version here with a new date. Material changes will be notified to merchants directly.
13. Contact
APPVANGUARDS SRL · CUI RO41268079 · Jud. Ilfov, Sat Tamaşi, Comuna Corbeanca, Strada Chişinău, Nr. 42
contact@alondio.com