1. Introduction
This Privacy Policy describes how Thom & Co GmbH (“Naridon”, “we”, “us”, or “our”) collects, uses, and discloses your Personal Data when you visit our website, install our Shopify Application, use the Naridon web app at v2.naridon.com, or use our services (collectively, the “Service”). We are committed to protecting your privacy in accordance with the EU General Data Protection Regulation (GDPR) and the Swiss Federal Act on Data Protection (FADP).2. Information We Collect
A. Information You Provide to Us
- Account Information: When you install Naridon, we collect your name, email address, and shop URL via Shopify’s API.
- Support Communications: Information you provide when contacting our support team (email content, screenshots).
- Configuration Data: Settings and preferences you input into the Naridon dashboard (e.g., target keywords, brand guidelines).
B. Information We Collect Automatically
- Log Data: We collect server logs which may include IP addresses, browser type, operating system, and timestamps.
- Usage Data: We track how you interact with the dashboard (pages visited, features used) to improve user experience.
- Store Data: We index public product information (titles, descriptions, images) to power the AI search features.
C. Information Processed on Behalf of Merchants
When you use Naridon on your store, we may process personal data of your customers (“End-Users”) on your behalf:- Search Queries: Questions asked by customers to the AI.
- Session Metadata: Anonymous session IDs to group interactions. Note: We do NOT collect or store sensitive payment information (credit cards) or passwords.
3. How We Use Your Information
We use your Personal Data for the following purposes:- Service Delivery: To provide the functionality of the Naridon App (contractual necessity).
- Billing & Administration: To manage your subscription and communicate service updates (contractual necessity).
- Security & Debugging: To detect and prevent fraud, abuse, or technical issues (legitimate interest).
- Product Improvement: To analyze usage patterns and train our search algorithms (legitimate interest). This never includes data we receive from Google APIs; see section 8.
- Marketing: To send you promotional content, where you have opted in (consent).
4. Data Sharing and Disclosure
We do not sell your Personal Data. We share data only in the following circumstances:- Service Providers: With trusted third-party sub-processors (hosting, AI, analytics) who assist us in operating the Service. These transfers are covered by Data Processing Agreements (DPAs).
- Legal Compliance: If required by law, subpoena, or legal process.
- Business Transfers: In connection with a merger, sale, or asset transfer, provided the receiving party agrees to privacy terms.
5. Data Retention
We retain Personal Data only for as long as necessary:- Merchant Account Data: Retained for the duration of your subscription plus 2 years for tax/legal records.
- End-User Search Logs: Retained for 30 days for analytics, then anonymized or deleted.
- Backups: Retained for 90 days in encrypted archives.
6. Cookies and Tracking
We use cookies to authenticate sessions and analyze traffic. You can control cookies through your browser settings.- Essential Cookies: Required for login (e.g., Shopify Session Tokens).
- Analytics Cookies: Used to measure site performance (can be opted out). For more details, please see our Cookie Policy.
7. Your Rights (GDPR/FADP)
If you are located in the EEA, UK, or Switzerland, you have the right to:- Access, correct, or delete your personal data.
- Restrict or object to our processing.
- Withdraw consent at any time (for marketing).
- Lodge a complaint with a supervisory authority.
8. Google User Data
When you connect a Google account in Naridon (Settings → Connections), you choose which Google service to connect, and Google shows you the exact permissions before you agree. We only request the permissions needed for the feature you connect.
How we use it. We use Google user data only to provide and improve the features you can see in Naridon. We do not sell it, use it for advertising, or use it to train or improve generalized AI or machine learning models.
Limited Use. Naridon’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
Who we share it with. Only with sub-processors that help us run the feature you asked for: our hosting provider (Amazon Web Services) and the AI providers that draft text for you (for example a review reply or a post). They process it under contract, for that purpose only, and may not use it to train their models. We share it with others only if the law requires it, or as part of a merger or sale, where the buyer must follow this policy.
Storage and security. Access tokens are encrypted at rest. Data is stored in our database in the EU (AWS, Frankfurt) and sent over encrypted connections.
Retention and deletion. We keep Google user data while the connection is active. When you disconnect a Google service in Naridon, we stop collecting data from it and revoke our Google access once no other Naridon connection on your account uses it. YouTube data is deleted within 7 days of disconnecting. Other Google data we already received stays in your workspace reports until you ask us to delete it at privacy@naridon.com; we then delete it within 30 days, except where the law requires us to keep it.
Revoking access. You can remove Naridon’s access at any time on Google’s security settings page: myaccount.google.com/permissions, or by disconnecting the service in Naridon.
9. YouTube API Services
Naridon uses YouTube API Services to connect your YouTube channel, publish the videos you approve and report on their performance.- By connecting a YouTube channel, you agree to be bound by the YouTube Terms of Service.
- Google’s handling of your data is described in the Google Privacy Policy.
- What Naridon accesses, stores and shares from YouTube is set out in section 8. We refresh or delete stored YouTube data at least every 30 days.
- You can revoke Naridon’s access to your YouTube data at any time on Google’s security settings page. When you revoke access, we delete the YouTube data we stored within 30 days, or within 7 days if you disconnect in Naridon.
- Questions: privacy@naridon.com.