Privacy Policy

With respect to your merchant data (store domain, access tokens, audit records and the data for each App listed in Part B), Mora Technologies ApS acts as an independent Data Controller.

With respect to your end customers' data, Mora Technologies ApS acts, where an App touches such data at all, as a Data Processor under GDPR Art. 28, acting on the instructions delivered through Shopify's mandatory privacy webhooks (customers/data_request, customers/redact, shop/redact). You remain the Data Controller for your customers and for your store, including the lawfulness of the data you collect from them, the notices you give them and the third party services you install. Nothing in this Policy transfers those responsibilities to us. The terms of that processing (GDPR Art. 28.3) are set out in our Data Processing Agreement.

• We never sell, rent or trade your data, and we never share it with data brokers or advertisers.
• We never use your data, your store content or your customers’ data to train artificial intelligence models, ours or anyone else’s.
• We never place analytics, advertising or tracking code on your storefront. Where an App adds code to your storefront (for example a label or a badge), Part B says exactly what it does. That code never sends your visitors’ personal data to us; what reaches our servers is the technical data any browser sends when it loads a script (its IP address, its user agent and the page it comes from), which we use only to deliver the script, to limit the rate of requests and, for the Trust Badge, to know whether the visitor is in the EU or the EEA (B.1.5). We do not keep the IP address for more than two hours; A.11 explains the service logs of our host.
• We never collect personal data from your end customers on our own initiative. An App only receives customer identifiers when Shopify sends them to us through its mandatory webhooks, and Part B states what happens to them.
• We never move data outside the European Economic Area except under the safeguards described in A.4.
• We never keep data longer than the retention period stated for it in Part B.

Every App relies on the following core subprocessors. Part B lists any additional subprocessor a specific App uses.

Supabase, Vercel and Upstash (listed in Part B) are companies incorporated in the US whose EU infrastructure may be supported by personnel outside the EEA. Any such residual access is covered by the Standard Contractual Clauses of the European Commission (Decision (EU) 2021/914) pursuant to GDPR Art. 46.2.c, incorporated into each provider's Data Processing Addendum. No personal data is transferred outside the EEA without these safeguards. You can ask us for a copy of them at contact@aveus.ai.

Email you send us. Our mailbox contact@aveus.ai, which receives support questions, privacy requests and replies to the emails our Apps send, is hosted by Google Ireland Limited (Google Workspace / Gmail) under its Data Processing Addendum. If Google or its own subprocessors handle these messages outside the EEA, the Standard Contractual Clauses in that addendum apply. We use your messages only to answer you and to document how we handled your request (GDPR Art. 6.1.b and Art. 6.1.f), and we delete them at the latest three years after the last message in the conversation. Please do not send us your customers' personal data by email.

We implement technical and organisational measures appropriate to the risk, including: AES-256-GCM encryption of Shopify access tokens at rest, Row Level Security (RLS) so that one store can never read another store's rows, HMAC signature verification of every Shopify webhook, TLS in transit, audit logs that can only be added to (the only change allowed is marking an incident you recorded as notified), dependency and secret scanning in our build pipeline, and regular security reviews against the OWASP Top 10. No system is perfectly secure; if we become aware of a personal data breach affecting you, we will notify you and, where required, the supervisory authority within the periods set by GDPR Art. 33 and 34.

Under GDPR Chapter III, you have the following rights regarding your merchant data:

• Right of access (Art. 15): Request a copy of the data we hold about your Shopify store.
• Right to rectification (Art. 16): Request correction of inaccurate data.
• Right to erasure (Art. 17): Request deletion of your data. What a verified erasure request purges, and what uninstalling the App purges automatically, is stated per App in Part B.
• Right to data portability (Art. 20): Request your data in a machine readable format.
• Right to restrict processing (Art. 18): Request that we limit how we use your data in certain circumstances.
• Right to object (Art. 21): Object to processing based on legitimate interests.
• Right to withdraw consent (Art. 7.3): Where we rely on your consent (Aveus news by email, A.12 and B.1.1), withdraw it at any time, as easily as you gave it: in the App Settings, with the link in every news email or by writing to us. Withdrawing does not affect what was done before.
• Right to object to direct marketing (Art. 21, paragraphs 2 and 3): Object at any time to receiving news and offers from us by email. We stop at once.

To exercise any of these rights, contact us at contact@aveus.ai from the email address associated with your Shopify store, or through the Shopify privacy webhooks. We will respond within 30 days (GDPR Art. 12). We may ask you to verify that you control the store concerned before acting on a request.

Providing your merchant data is necessary to conclude and perform our contract with you: without it the App cannot work. We do not take decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you (GDPR Art. 22); the classifications and estimates an App produces are suggestions that you review and decide on.

These rights also apply to you if you subscribed to our news on aveus.ai without being a merchant (A.12).

You have the right to lodge a complaint with the competent supervisory authority:

Each data category in Part B is deleted automatically once its retention period expires. Periods are upper limits, not minimums: we do not keep data beyond the purpose that justifies it (GDPR Art. 5.1.e, storage limitation). Where a category is kept after uninstallation, Part B says so and why. Records that document that we honoured a legal request (for example the entry proving that a shop/redact webhook was processed) are kept as evidence of compliance under GDPR Art. 5.2 (accountability) and Art. 17.3.e (defence of legal claims). The record of a processed shop/redact request keeps the store domain for 90 days so that it can prove the erasure; other such records are pseudonymised where possible.

The Apps are software tools. Their outputs (compliance classifications, risk scores, image labels, certificates, generated documents and similar) are produced automatically from the data available to the App at the time and may be incomplete or inaccurate. They are provided to assist you and do not constitute legal advice; you remain solely responsible for reviewing them and for your store's compliance with the EU AI Act, the GDPR and any other law that applies to you. Our liability, warranties, the governing law and the forum for disputes are governed exclusively by our Terms of Service, which you accept in each App before you use it (in Aveus AI, on its first screen). This Policy describes how we handle data; it does not create obligations beyond those required by data protection law.

We may update this Privacy Policy, including by adding a section to Part B for a new App or amending an existing section when an App changes what it does with data. We will notify you by updating the "Last updated" date at the top of this page. Material changes will be communicated to you by email or in the App at least 30 days before they take effect, except where a change is required by law or by Shopify, and when one takes effect Aveus AI asks you to accept the new version in the App before you can keep using it.

Our website aveus.ai uses no cookies, analytics, advertising or tracking of any kind, and its fonts are served from our own domain. The site is hosted by Vercel Inc. (see A.4) and its pages are delivered through Vercel's network from the location nearest to you. To deliver each page and protect the site from abuse, Vercel processes the technical data that every web request carries: your IP address, your browser's user agent, the page requested and the time of the request. It keeps this data only for the limited period its service logs are retained. Legal basis: GDPR Art. 6.1.f (our legitimate interest in running a secure website). If you write to us, A.4 explains how your email is handled.

The app itself, at app.aveus.ai, is hosted in the same way and Vercel processes the same technical data for every request to it. When our security rules block a request, our logs record a pseudonymised hash of the IP address, the user agent and the path. To protect the service we may block requests from certain countries or networks of origin, for example those under sanctions or used for abuse. Legal basis: GDPR Art. 6.1.f (our legitimate interest in running a secure service).

On aveus.ai you can ask to receive news from Mora Technologies ApS by email: new Aveus AI features, other Mora Technologies apps for Shopify and plan offers. Subscribing is optional and is never a condition for anything.

What we process. The email address you enter, the language of the page, the version of the consent text you were shown, and when and how you subscribed, confirmed, received a message or unsubscribed. Apart from the technical data that Vercel processes for every request to our servers (see the previous section, on visitors to our website), your IP address is used only as the key of a short lived rate limit counter that protects the form from abuse (B.1.3); it is not stored with your subscription.

Double confirmation. We first send you an email with a confirmation link that works for 72 hours. Until you press it we send you nothing else, except a new confirmation email, at most one a day, if the form is submitted again with your address; a subscription that is not confirmed is deleted after 7 days.

Legal basis. Your consent (GDPR Art. 6.1.a). Keeping the proof of your consent after you unsubscribe: our legitimate interest in being able to show it (Art. 6.1.f). Sending the confirmation email and keeping an unconfirmed request for up to 7 days: our legitimate interest in checking that the request comes from the person who uses the address (Art. 6.1.f).

Retention. While you are subscribed and then for 2 years after you unsubscribe, as proof of your consent. Then it is deleted.

Withdrawal. With the link in every email we send you after you confirm, with immediate effect, or by writing to contact@aveus.ai.

Recipients. The form is processed by our app at app.aveus.ai, hosted by Vercel in Frankfurt (A.4), and the rate limit counter is kept by Upstash (B.1.3). The list is kept in our database with Supabase in Frankfurt (A.4) and the emails are sent by Lettermint B.V. (Netherlands, EU) without open or click tracking (B.1.3). We never load this list into any other app, never combine it with data about a Shopify store and never sell or share it.

Aveus AI, listed on the Shopify App Store as “Aveus: EU AI Act Labels”, is a B2B RegTech platform serving Shopify merchants. We collect the minimum data necessary to provide compliance auditing services (GDPR Art. 5.1.c, data minimisation). We do not collect customer profiles, orders or payment data from your end customers (consumers). The only customer data we handle are the customer identifiers Shopify sends in its mandatory privacy webhooks and the IP address that every request to our servers carries, used as described in B.1.3 and B.1.5. None of the features of Aveus AI runs, the nightly audit included, until you accept the Terms of Service, the Data Processing Agreement and this Policy in the App. Before that, it only does what installing and accepting need: it keeps the installation session, records your acceptance and answers the mandatory privacy webhooks and the uninstall webhook of Shopify, and its public storefront endpoints use the IP address of the visitor as a rate limit key (B.1.3).

B.1.1 What data we collect and why

B.1.2 Data Retention

B.1.3 Additional subprocessors

AI classification runs on Google Cloud Vertex AI, pinned to the EU multiregional endpoint and restricted to generally available models, so that the ML processing of the content submitted for analysis takes place within the European Union. We authenticate with short lived credentials issued through Workload Identity Federation: no long lived Google Cloud service account key exists in our runtime. Processing is governed by the Google Cloud Data Processing Addendum (GDPR Art. 28). We do not send your end customers' personal data to the model: what is analysed is extracts of your theme files (code, settings and any text you placed in them) and publicly available vendor documentation. To avoid repeating an analysis, results are cached under a fingerprint of the content analysed for 30 days after they were last used, so identical content seen in another store reuses the result; nothing that identifies your store is kept in that cache. Google Cloud EMEA Limited may rely on Google LLC (USA) and other Google affiliates as its own subprocessors for limited support, engineering access and abuse monitoring, under the Standard Contractual Clauses described in A.4.

B.1.4 Erasure and uninstallation

A verified erasure request purges your AI inventory, compliance ledger, audit logs, sessions, detected vendors, synthetic media flags, certificates, AI cost telemetry, the spend counters kept in our database, scan performance telemetry, operational notifications, storefront scan history, enforcement night records, pseudonymised error records, legal acceptance records, your Aveus news subscription and its proof of consent, evidence file records and partner agency links. Uninstalling the app automatically purges your AI inventory, synthetic media flags, detected vendors and session data; the remaining categories are removed by a verified erasure request or when their retention period expires. Uninstalling also stops the Aveus news emails at once.

B.1.5 What the App reads and writes in your store

To detect provenance markers the App downloads at most the first 256 KB of each product image (and, for some large files, also the last 256 KB), inspects them in memory and discards them; only the detection result is stored. It reads your theme files but never changes them. It writes to your store a product metafield for each labelled image and one shop metafield with the list of labelled files, in the App's own namespace, and one metafield on the App's installation (aveus.free_plan) that tells the theme blocks whether your store is on the free plan. On paid plans, at every audit and every night, it also sets your Shopify privacy settings so that cookie consent and the data sale opt out are required in the countries of the EU and the EEA, the United Kingdom, Switzerland and the territories where the same rules apply (Réunion, Guadeloupe, Martinique, French Guiana, Mayotte, Saint Martin, the Åland Islands, Gibraltar, Jersey, Guernsey and the Isle of Man) wherever your store still uses Shopify's default for that country; a setting you made yourself is left as it is, and you can change it in your Shopify admin. This setting does not show a cookie banner: you turn one on yourself, in Shopify or with another app.

The Trust Badge block that you can enable in your theme loads a script from app.aveus.ai, so the visitor's browser connects to our servers and its IP address is used as the rate limit key described in B.1.3; the country that Vercel derives from it, which we do not store, decides whether the badge is shown, because it is shown only to visitors in the EU and the EEA. The block sets no cookie and stores nothing in the visitor's browser. The AI Image Label block reads the metafields above and loads nothing from our servers; its link opens your public disclosure page on app.aveus.ai, which anyone can open and which lists the AI technologies found in your theme and the images labelled in your store (name, risk level, purpose and dates); it does not show classifications that await human review or were rejected in it. To show you in the “Notices in your store” tab whether your store has a cookie banner, the App reads your Shopify privacy settings (whether Shopify's cookie banner is turned on) and the app blocks turned on in your published theme; it does not keep this information. Inside the Shopify admin, the App keeps a few preferences in your browser's local storage (for example the language you chose and the alerts you marked as reviewed); they stay in your browser.

Before a new Aveus App is published on the Shopify App Store, we add a section to Part B describing the data it handles (what we store and why, what we read but do not keep, what the App writes to your store, retention, subprocessors, privacy webhooks). The "Last updated" date at the top of this page moves on that day. An App that has no section in Part B is not covered by this Policy and is not published by us.