Poleso Privacy Policy

1. Seller data

Account data. Name and email address. Sign-in uses a one-time code sent by email, or Google or Facebook if you link them; from those we receive only your name, email and account identifier.

Store data. Products, orders, delivery and payment settings, team members, and the access keys of the services you connect (banks, delivery services, messengers, bots).

Data from Meta platforms. If you connect Instagram, Facebook, or WhatsApp Business, we receive and store on your behalf: direct messages and attachments, comments on your posts, sender profile information (name, username, profile picture), and message metadata. This data comes through official Meta APIs and webhooks and is used solely to display and manage your customer conversations inside Poleso.

Technical data. Server logs (IP address, request time) for security and troubleshooting; device push subscriptions if you turn on notifications.

2. Buyer data (customers of stores)

Orders.When you place an order on a store's storefront or the store creates it from a conversation: name, phone, email if given, delivery address or branch, the items, the amount, and the payment and delivery status.

Conversations.Messages you send the store through Instagram, Facebook, WhatsApp or the store's Telegram bot, and the store's replies — including automatic ones.

Telegram notifications.If you tap «Notify me when it's back» or «Notify me on Telegram when it ships» and start the bot, we store your Telegram chat identifier and the language you chose — only to send those notifications. They come from the store's bot, or from the Poleso bot if the store has none.

Payments.Card payments are made on the bank's own page (Monobank, LiqPay, WayForPay). We never see or store card details; the bank tells us only whether and how much was paid.

Delivery history in the store. To help the store decide whether to offer cash on delivery, we look at how your earlier parcels from the same store ended — picked up or returned. This history is not shared between stores.

Storefront visits. We count visits and where they came from (for example Instagram or a search engine) only as daily totals per store, with no identifier of the person.

3. How we use data

We use data exclusively to provide Polesofeatures: the unified inbox, sending replies, checkout and orders, payments, creating waybills, notifications, analytics for the store, and creating catalogue products from the seller's own Instagram posts when the seller imports them. We do not sell personal data and do not use it for advertising. Data from Meta platforms is used in accordance with the Meta Platform Terms (developers.facebook.com/terms).

We also keep a record of how each order went: the channel it arrived from, whether the buyer completed the checkout themselves, the amount, the product categories, and how the delivery ended together with its date. We use this to run and improve the service, including our work on assessing delivery risk so that sellers can be offered better terms later. This record holds order and delivery metadata only — the contents of conversations are never analysed for it.

4. Who else receives data

Processors that work for us.Hetzner (servers and the database, European Union), Cloudflare (DNS and network protection), UploadThing (storage of images and files), Resend (email), Sentry (error reports, with personal data filtered out), Anthropic (AI model: when a seller imports their own Instagram posts, each post's caption and image are sent to generate a product name and description; Anthropic does not use this data to train its models).

Services that are needed to fulfil an order, each receiving only what its part requires: Meta (Instagram, Facebook, WhatsApp) and Telegram — to deliver messages; the bank the store uses — to take the payment; Nova Poshta, Meest or Ukrposhta — the recipient's name, phone and address to create a waybill; browser push services (Google, Apple, Mozilla) — to deliver notifications to the seller's devices.

The store you buy from sees your order and conversation data in its dashboard.

5. Cookies and browser storage

We use only what the service needs to work: the seller's sign-in session, the buyer's cart, and the chosen language and currency. The browser's session storage remembers which pages were already counted, so a reload is not counted twice. There are no advertising or third-party tracking cookies.

6. Retention

We keep data while the seller's account is active: orders are the store's business records. An unused cart expires after 7 days. After account deletion or a deletion request, personal data is removed within 30 days, unless a longer retention is required by law.

7. Data deletion

Sellers can have their data deleted in either of two ways. Both remove the same data; the second one is the automated route Meta uses.

— email [email protected] from your account email; or

— remove the Poleso app in your Facebook/Instagram settings: Meta sends us an automated deletion request. Check its status on the data deletion status page.

If your store is connected through WhatsApp Business only, please use the email route above. The automated request Meta sends identifies you by your Facebook or Instagram account, and a WhatsApp-only connection has neither.

Buyers can ask the store they bought from, or write to [email protected] naming the store; we will pass the request on and help carry it out. To stop Telegram notifications, block or stop the bot.

8. Security

Data is transmitted only over HTTPS; bank and delivery-service keys are stored encrypted; the database is reachable only from our servers; each store sees only its own data.

9. Your rights

You may request access, correction, export, or deletion of your personal data at any time via [email protected]. You may also lodge a complaint with a supervisory authority: in Ukraine — the Ukrainian Parliament Commissioner for Human Rights; in the EU/EEA — your local data protection authority.