Privacy, Data Access and Terms

Privacy notice

Responsibility for personal data

We act as a controller when we determine how information is used to operate Friendzy accounts, provide our service, administer merchant relationships, respond to enquiries and protect the service. Store owners separately control their storefronts, orders and customer relationships; please also read the store's privacy notice.

Where we process personal data solely on a merchant's instructions, the merchant is the controller and we act as its processor. Those activities require appropriate data-processing terms. This notice does not replace a data-processing agreement.

For the data we process on a store's behalf, that agreement is our Data Processing Agreement.

Information we process

• Merchant information: store identifiers and domain, installation credentials, settings, subscription information and support correspondence.
• Accounts and profiles: user identifiers, names, email addresses, password credentials, avatars and biographies where provided. Guest identities and generated names are not necessarily anonymous: they can remain associated with session activity.
• Connected accounts: where a store's plan offers it, you can sign in to Friendzy with your Google or Facebook account instead of an email address. The provider then tells us the identifier it uses for you, your name, your profile picture and, where you allow it, your email address. We never receive your password, your contacts or your posts, and we keep no access token once the sign-in is finished. You choose whether the people in your session see that name and picture or the anonymous name Friendzy gave you, and disconnecting the account in Settings deletes what the provider gave us.
• Sessions and chat: room and participant identifiers, message text, timestamps, delivery and read information, invitations, shared URLs and profiles. Messages are stored to support delivery and message history, not merely aggregated as anonymous words.
• Shared browsing: page content and structure, navigation, mouse movements, scrolling and other events used to display shared activity, subject to the active sharing mode and privacy settings. Anything that looks like an email address is hidden from what friends see.
• Voice messages: recordings you choose to create where available, and information needed to store and deliver them. Recording requires microphone permission.
• Live calls: when you start or join a call, your browser uses your microphone and, if you turn it on, your camera. In a call between friends, audio and video travel directly between the participants' browsers, encrypted in transit, and are not recorded or stored by us. To connect a call, our server passes connection details between the participants; these include each participant's IP address. Your browser also contacts public STUN servers run by Cloudflare and Google to find a route for the call, and those servers see your IP address. In a creator room it is different: the audio and video of whoever is on stage go through Cloudflare's relay (Cloudflare Realtime), which passes them to everyone watching. They are encrypted in transit and are not recorded or stored by us.
• Purchases after shared shopping: when a store has Friendzy's Shopify pixel active, each completed checkout reports its total, currency and checkout token, with Friendzy's own visitor and session identifiers from that browser, so the store can see whether shoppers who browsed together bought. No customer name, email, address, order number or items are sent. The Friendzy widget also keeps in the shopper's browser how that visit reached the store (the store's Friendzy link or one of its campaigns, a friend's invite, or neither; UTM tags and the name of the referring site, never full addresses or query strings), the role of that browser tab in a shared session (host or invited friend), and the last session the browser was in. At checkout the pixel reports that role and that last session too, so the store can see whether an invited friend or the host bought, and how the host had arrived, for purchases made within 7 days of the session. The widget's random per-store device identifier is sent only to check the role against the session and is never stored with the purchase.
• Store customer login, for rewards: when a store turns on "Only reward shoppers logged in to your store", Shopify tells us, through the store's own website, the customer number of the shopper logged in to that store, signed so it cannot be altered. We use it only to decide whether a reward can be given and to give each reward to a customer once; we keep a one-way coded form of that number with each reward given, not the number itself.
• Your store account, if you are signed in to the store: the store's page tells the Friendzy widget that you are signed in, how many orders you have placed, and a coded key for your account that cannot be turned back into your customer number. The widget uses these only in your browser, to decide whether to show Friendzy to you, and sends none of them to us. Once you start using Friendzy or allow it in the store's cookie choices, the widget also reads your name and email address from what Shopify puts on the store's page, when the page includes them. It uses them to offer your name as your name in Friendzy, and to hide your own name and email address from what friends see in a shared session. It sends nothing to read them and keeps them nowhere; your name reaches us only if you choose to use it.
• Store advisers, creators and moderators: when a store invites someone to advise its shoppers or to host or moderate a creator room, their name, email address, status and sign-in records; for advisers also their business hours and a history of the sessions they handled, with how long each lasted and how many messages it had, never what was written.
• The AI assistant: on stores that use it (Growth plan), when no adviser is on duty, the shopper's display name and their most recent messages in that conversation are sent to Anthropic so it can write a reply. The conversation is kept with the session.
• Troubleshooting a store: only while we have debug mode switched on for a store to investigate a fault, the console output of that store's pages, with the page path and a random session identifier, and with tokens, email addresses and query strings removed. It is kept for 3 days.
• Technical and usage data: browser and request information, authentication events, errors and counts of activities such as sessions, messages, pages and invitations. We use IP addresses only for a short time, to limit how often one address can make requests, and do not write them to our logs or databases. A crash report your browser sends to Sentry does carry your IP address. If the Friendzy widget itself fails on a store's page, it sends a crash report to Sentry, whatever you chose about cookies and analytics. Only the version we publish to stores does this, only for errors in Friendzy's own code, and no more than five times on one page. The report says what failed and where in our code, the page address without its query, the store and Friendzy's version. Before it is sent we take out your account, cookies, request headers, email addresses, tokens and message text.
• Feedback on a session: if you rate a shared session, your stars, the problems you ticked and what you wrote, with technical details that help us fix a fault: the page you were on (its address without anything after it), the store's theme, Friendzy's version, the language, the type of device and browser, the screen size, whether you started or joined the session, how many people were there and for how long, the shopping style, whether a call was used, and the last errors. Never your name, account or cart. The store sees the stars and the comment without anything that identifies you; the technical details are only for us. Please do not put personal details in the comment.
• Website activity and enquiries: contact details and messages you send us, and, if you accept analytics, website usage information collected through Google Analytics as described below.
• Prospective merchants: store names and addresses, and business contact details such as names, work email addresses and public professional profile links, gathered from public sources and data providers so we can contact stores that may want Friendzy.

Information comes from you, Shopify when a merchant authorises access, session participants and browser communications with our service. Registered-account features require account information; guest features can be used where available. Optional profile details, messages and recordings are provided at your choice.

Purposes and legal bases

We process information to provide accounts, sessions, chat, recordings, settings and subscriptions. Where you are a party to the service contract, this relies on performance of that contract or steps requested before entering it. For security, abuse prevention, troubleshooting, support and business relationship administration, we rely on legitimate interests in operating a reliable service, balanced against your rights. Crash reports from the widget rely on that same interest, in noticing and fixing faults in Friendzy; because they carry only what is needed to find the fault, they do not wait for your consent, and you can object to them as described below. Processing required by applicable accounting or other laws relies on legal obligations. Contacting stores that may want Friendzy relies on our legitimate interest in business outreach; you can object at any time and we will stop.

Where optional analytics, marketing or other processing requires consent, consent is the required basis. Reading this notice or using Friendzy does not itself give consent to optional tracking or marketing.

Sharing with other participants

Participants receive shared profile information, messages, recordings and browsing activity. In a call, the other participants hear you and, while your camera is on, see you, and their browsers receive your IP address as part of the connection. Keep invitation links private: recipients may forward them, allowing others to join subject to session controls. Participants may copy information they receive.

Merchants should configure and test private-page and element exclusions for their theme, especially account, cart, checkout and order pages. These controls are not a guarantee that every sensitive element is automatically excluded. Stop sharing before entering confidential information and do not send passwords, payment-card details or sensitive personal information in chat. A private session does not imply end-to-end encryption or automatic deletion when the session ends.

Sharing with the store's own tools

A store owner can have Friendzy tell their own systems what happened in a shared session: that one started, that a friend joined, that it ended, or that a reward was earned. This is off until the store owner switches it on, and it goes to one of two places.

Shopify Flow. Friendzy reports these to the store's own Shopify account, where the store owner can build automatic actions on them. What is sent is which session it was, what happened in it, the page the session was on, and — when the shopper is signed in to that store — the store's own customer number for them. This stays inside the store's Shopify account, under Shopify's terms.

An address the store owner chooses. Friendzy can also send the same events to a web address the store owner gives us, so that other tools they use can act on them. Less is sent there: which session it was, what happened in it, and the customer number when there is one. The page the shopper was on is never sent to such an address. Each delivery is signed so the receiver can check it came from us.

That destination is chosen by the store owner, not by us. We do not control it, we do not know in advance who operates it, and it may be outside Romania and the European Economic Area. Where we send data on a store owner's instructions in this way, the store owner is the controller and is responsible for that destination, for any transfer it involves, and for saying so in their own privacy notice. We act as processor.

On the order. When a shopper buys after shopping together, Friendzy records on their own basket, and so on the resulting order, which session it came from, whether they were the one who invited or the one invited, and when the session was. The store owner sees this on the order in their Shopify admin. It identifies the session and not the shopper, and it is there so a store owner can tell which orders came out of shopping together without relying on our figures.

None of this sends a shopper's name, email address or the pages they looked at to anyone other than the store they are shopping on.

Providers and international processing

We use these providers, each for its part of the service:

• Amazon Web Services (United States, Ohio, and Germany, Frankfurt): chat messages, saved product lists, voice recordings, temporary upload credentials for recordings, and backups; and email delivery (Sweden, Stockholm). Voice recordings are kept in the store's own region. Chat messages and saved lists are copied to both Ohio and Frankfurt for every store, including stores served from the European Union.
• Oracle Cloud (United States, Virginia): the real-time server that connects sessions, chat and calls for stores served from the United States.
• Google Cloud (Germany, Frankfurt): our website, the merchant app, the account service, the database for merchant and shopper accounts, and the real-time server for stores served from the European Union. Each store is served either from the EU or from the United States, decided once when it installs Friendzy, by the store's country.
• MongoDB Atlas (United States): usage counts per store and page, purchase attribution, how visits arrived from a store's campaigns, and debug logs while we troubleshoot a store.
• Anthropic (United States): the AI assistant described above, which receives the store's name, the shopper's display name and up to eight recent messages from that conversation.
• Sentry (European Union): crash reports from the Friendzy widget and from our servers — what failed, where in our own code it failed, the page address without its query, and the store it happened on.
• Cloudflare: our domain's DNS and email forwarding; the network in front of our app and our EU real-time server, which decrypts that traffic at Cloudflare's edge; the relay for the audio and video on a creator room's stage (Cloudflare Realtime); and a public STUN server used to connect calls.
• Google: Google Cloud Logging (Germany, Frankfurt): our error and operational logs, which can include user and store identifiers; Google Analytics on our website, only if you accept it; a public STUN server used to connect calls; the mailbox that receives our email; and YouTube, for the videos in our Journal, only once you press play on one.
• jsDelivr: scripts and stylesheets loaded by our website, so it receives your browser's requests for them. The Friendzy widget on a store loads nothing from it.
• Shopify: app installation, permissions, billing and privacy requests, under Shopify's own terms.
• Finding prospective merchants: we find stores from public sources, such as their websites, public social media profiles and reviews on the Shopify App Store. Business contact details previously obtained from Apollo and StoreLeads are used only after Reoon confirms the email address exists. Introductions are drafted by language models that run on our own computers and, when we ask it to, by Anthropic's Claude, which receives the store's public page or post. No shopper data is sent to these providers for outreach.

Data can be processed outside Romania and the European Economic Area, including in the United States. Transfers subject to the GDPR require an applicable mechanism, such as an adequacy decision or appropriate contractual safeguards. Contact us for the destinations, providers and safeguards relevant to your information, including how to obtain information about those safeguards.

We may disclose information when required by law or necessary to investigate abuse, respond to security incidents or protect legal rights.

The current list of the providers that process store data for us, and how stores hear of a change to it, is on our sub-processors page.

Retention

• Chat messages and voice recordings: deleted automatically 90 days after they are sent.
• Shopper accounts: kept until you delete your account or ask us to, or until a store asks Shopify to erase your data and no other store holds data for you.
• Merchant data: deleted when Shopify asks us to erase a store's data, normally 48 hours after the app is uninstalled. This includes the store's messages, recordings and usage counts.
• Usage counts: daily counts per store and page do not identify shoppers and are kept while the store uses Friendzy. The daily lists of guest identifiers used to count unique guests are deleted after 45 days.
• Rewards for logged-in shoppers: the coded record of which customer received which reward is kept for 400 days so a reward is not given twice, and deleted with the store's data; a reward waiting for a shopper to log in is kept for 24 hours.
• Saved projects: a set of products you chose to keep. Held on your device for 180 days after you last save one, and on our server for 90 days so your other devices can have it.
• Host moderation: when the host of a session quiets or removes someone, we keep who did what to whom and when, never what anyone wrote, for 30 days, to answer support and abuse questions.
• Store adviser history: the record of each time a shopper asked for an adviser, and of each session an adviser handled (who, when, how long and how many messages, never what was written), is kept for 395 days, so a store can compare its adviser statistics with the same time a year earlier. It is deleted sooner if the store's data is erased.
• Feedback on sessions: kept while the store uses Friendzy, and deleted with the store's data.
• Messages to us: what you send through our contact form, with your name and email address, is kept for 365 days.
• Purchase attribution: which sales a Friendzy session helped: the order total, currency and date, with the random browser, session and checkout identifiers that link the sale to a session. Those identifiers are kept for 30 days; after that they are removed, and only anonymous totals stay in the store's statistics. The list of who visited a creator room likewise becomes a plain count after 30 days. All of it is deleted with the store's data about 48 hours after the app is uninstalled.
• Logs: kept by Google Cloud Logging for 30 days.
• Crash reports: kept by Sentry for 30 days.
• Backups: kept for 30 days, so deleted data can remain in a backup for up to 30 days.
• Copies in browsers: copies of messages kept in your browser, or in other participants' browsers, stay until that browser's storage is cleared (see Cookies and browser storage).

Leaving a session, clearing browser storage or uninstalling does not by itself erase server records. Contact us to request deletion or retention information for particular data. Legal obligations can limit deletion; we cannot erase copies independently retained by other participants.

Your rights

Subject to applicable conditions, you can request access, correction, erasure, restriction and portability, object to processing based on legitimate interests, and object to direct marketing. You can withdraw consent without affecting the lawfulness of processing before withdrawal.

Email [email protected], or use our contact form and identify your message as a privacy request. Include the relevant account, store or session, but never passwords or payment details. We may request proportionate identity verification. GDPR requests must be answered without undue delay, ordinarily within one month; permitted extensions require notice and reasons within that first month. For merchant-controlled records, you can also contact the store.

You may complain to a competent supervisory authority, including where you live, work or consider an infringement occurred. Romania's authority is the National Supervisory Authority for Personal Data Processing (ANSPDCP).

Security and children

Security measures include encryption in transit and at rest, access control, and separation between stores, so that a request is refused data belonging to any store but its own. No internet service guarantees absolute security. Protect credentials and invitations and report suspected unauthorised access.

Friendzy is not intended to solicit children's personal information. Contact us if a child has supplied personal data without any authorisation required by applicable law so we can review the situation and take appropriate action.

Shopify permissions

The Shopify authorisation screen determines the access granted. Friendzy asks for these permissions, each for one purpose:

• Read customers and orders (read_customers, read_orders): to show a store adviser, while they are helping a shopper in a room, whether that shopper has bought from the store before and what. It is not requested when Friendzy is installed: the merchant switches it on from the Store advisers page, and can withdraw it there. Friendzy stores no customer record and no order of its own from it.
• Read discounts (read_discounts): to let the merchant pick one of the store's existing discount codes as a reward. It does not allow creating or changing discounts. It is not requested when Friendzy is installed: Shopify asks for it the first time the merchant searches their codes, and it can be declined or withdrawn.
• Read themes (read_themes): to recognise the store's theme, fill in starter settings that suit it and check that the Friendzy embed is switched on. It does not allow changing theme files.
• Web pixels and customer events (write_pixels, read_customer_events): to switch on Friendzy's pixel, which reports each completed checkout's total, currency and checkout token (see "Purchases after shared shopping"), so the store's Metrics can show whether shoppers who browsed together bought. It receives no customer details. It also reports the shopper's role in a Friendzy session and the last session the browser was in, so purchases within 7 days can be linked to it; the random Friendzy device identifier it sends is used only to check that role and is not stored.
• Online Store pages (write_online_store_pages): to create one page on the store, /pages/friendzy, that explains shopping together to shoppers, and to keep it at the current version. It is not requested when Friendzy is installed: the merchant adds the page from the Friendzy admin, and may decline. Friendzy never changes any other page. This page is Friendzy's: an edit made to it is replaced the next time the page is updated, and the page is created again if it is deleted. It is left on the store after uninstalling, for the merchant to keep or delete.
• Store languages and translations (read_locales, write_translations): to see which languages the store publishes and to add a translation of the /pages/friendzy page in each of them that Friendzy has a guide written in, so shoppers browsing the store in another language read it in that language. It does not allow changing any other translation or any store content. It is not requested when Friendzy is installed: the merchant is asked from the Friendzy admin, only when the store shows another language, and may decline.
• App proxy (write_app_proxy): to answer requests the Friendzy widget makes through the store's own website at /apps/friendzy, where Shopify adds the logged-in customer's number with a signature only Shopify and Friendzy can make. It is used only when the merchant turns on "Only reward shoppers logged in to your store".

Additional access requiring Shopify authorisation must be approved through Shopify. Merchants control activation and privacy configuration. Purchases, payments, delivery and returns remain the responsibility of the merchant and its providers.

Cookies and browser storage

The Friendzy widget stores nothing in your browser until you open it, with two exceptions that identify nobody: one value for the current tab that decides whether its button is shown, which is never sent anywhere, and, once you point at or focus its button, a copy of its text in your language, so it opens quickly. Once you open it, it uses browser storage that it needs to work:

• a sign-in cookie, friendzyAuthToken, and a guest identity token, kept in a cookie (friendzyShopperKey) and in local storage, each valid for up to 90 days;
• your answer to the offer to use the name from your store account, together with that name, so you are not asked twice;
• preferences such as language, theme and sound;
• a copy of your rooms and messages, and voice messages that haven't finished sending, so a session survives a page reload;
• a random identifier for this browser on each store, and the rooms this browser opened, so opening your own invite link takes you back to your room instead of joining it as your own guest;
• only if you allow analytics in the store's cookie choices: how this visit reached the store (friendzy-arrival, in session storage until the tab is closed), your role in a shared session, host or invited friend (friendzy-room-role, in session storage), and the last session this browser was in (friendzy-last-session, in local storage, used for 7 days), so the store can tell whether an invited friend or the host bought; and, for the store's gradual rollout of Friendzy, a random identifier for this browser, a count of your visits, your rollout group and whether this browser has bought here (friendzy-visitor-id, friendzy-visit-count, friendzy-rollout-bucket, friendzy-bought, in local storage). Opening Friendzy is not that consent. If you withdraw it, the widget stops and removes them;
• when a store rewards only logged-in shoppers, a proof of your store login that Friendzy issues and that expires after one hour;
• temporary credentials and session state, kept only for the browser tab's session.

Apart from the tab-session data, these stay until you clear your browser's storage or sign out. The sign-in pages use a session cookie that lasts two hours. A store's own staff who open the store's test link also get a test cookie, friendzy_test, for 30 minutes, or friendzy_staff, which marks a staff browser for 400 days and is renewed on each visit; shoppers never get either.

Our website sets only the cookies it needs to work until you choose otherwise: a session cookie and a security token (XSRF-TOKEN), which protect the site against forged requests and expire after two hours; and, only when you pick a language in the language menu, site_language, which remembers it for one year so that the site's home address opens in that language. It is set whatever you answer in the cookie banner, stays on this site, and can be deleted in your browser settings. Analytics cookies wait for your consent: our website loads Google Analytics only if you accept it in the cookie banner. It then sets cookies (_ga and _ga_…, for up to two years) and sends Google device, browser, page and network information so we can see how the website is used. If you decline, or make no choice, it is not loaded. We remember your choice in your browser's local storage (friendzy-analytics-consent). You can change it at any time with "Cookie settings" at the bottom of every page; declining also removes Google Analytics cookies. The website also loads stylesheets and scripts from jsDelivr, which receives your browser's requests for them. Some Journal articles show a video hosted on YouTube. Nothing is loaded from YouTube until you press play on it; then the video loads from youtube-nocookie.com, and Google may set cookies and receives your browser's requests, under Google's privacy policy.

Our page for store owners opens only from a personal link we send by email. When you open it with the button on that link, our website sets friendzy_store_brief, which lets this browser read the page for seven days and then expires. It holds a random identifier and nothing about you, it is needed for the page you asked to see, so it is set without asking, and it is used for nothing else.

Microphone and camera permissions are requested by your browser when you use voice messages or calls, and are separate from analytics consent.

You can clear or block browser storage and revoke microphone and camera permission through browser settings. Blocking storage may prevent sign-in or shared sessions from working. Clearing local storage does not delete server records. A merchant's own cookies and analytics are covered by its notice.

Service terms

These terms cover Friendzy's shared-shopping, account and communication features. Merchants must have authority to install and configure the app. Users must have the capacity or authorisation required by applicable law. Paid plan prices and billing periods are those accepted in the subscription flow, with Shopify billing terms applying where relevant. Separately agreed merchant contracts continue to apply.

You retain rights in content you contribute and permit us to process, store and transmit it as needed to provide the features you use. Share only information you are entitled to share. Do not use Friendzy for unlawful conduct, harassment, impersonation, spam, malicious code, unauthorised access or harm to children. Software and branding remain the property of their respective owners.

We may send necessary service, security and billing communications. Creating an account does not automatically subscribe you to marketing; applicable consent and opt-out requirements apply.

Maintenance, faults and changes can affect availability. We do not promise uninterrupted operation or increased sales. Access may be restricted where reasonably necessary to address misuse, security threats, legal requirements or material breach, with notice where appropriate and practicable.

You may stop using Friendzy; merchants may uninstall through Shopify. Contact us for account or data-deletion requests. Stopping use does not erase retained data or obligations already incurred.

Romanian law governs these terms, subject to mandatory protections under applicable law. Nothing here excludes rights or liability that cannot lawfully be excluded, including mandatory consumer protections and access to competent courts.

Our Data Processing Agreement forms part of these terms. It covers the personal data we process on a store's behalf, and a store accepts it when it installs Friendzy.

Software ownership and licence

SWARMSOFT S.R.L. owns Friendzy's software, including the storefront widget, the merchant admin and the servers, together with their code, design and documentation, all of which are protected by copyright. Merchants who install Friendzy receive only a limited, non-exclusive, non-transferable licence to run it on their own store under these terms, while it remains installed.

Without written permission from SWARMSOFT S.R.L., no one may copy, reproduce, modify, translate, port, reverse-engineer, decompile or deobfuscate the software, create derivative works from it, scrape the widget or the admin, or use the software or its content to train, fine-tune or evaluate artificial intelligence models, or as input in prompts to such models.

A breach ends any licence granted under these terms, and SWARMSOFT S.R.L. may pursue all available legal remedies, including takedown requests, injunctions and damages.

These restrictions apply except where, and only to the extent that, applicable law expressly permits an act regardless of such terms, for example decompilation strictly necessary for interoperability under EU law. Requests for permission go to [email protected].

Contact and changes

Contact SWARMSOFT S.R.L. at [email protected], or through the Friendzy contact form, for questions or privacy requests. We will revise this page and its date when practices or terms change, provide additional notice where required and obtain consent for new processing that requires it.