Privacy Policy

1. Controller

The controller responsible for data processing described in this policy is:

Wave Commerce Limited
Unit 1113, 11/F, Peninsula Centre
No. 67 Mody Road, Tsim Sha Tsui
Hong Kong
Email: kontakt@tryvo.io

Our representative in the European Union pursuant to Art. 27 GDPR is:

David Motino Cabrera
Vogelsangstr. 40
70197 Stuttgart, Germany
Email: kontakt@tryvo.io

You can address any GDPR matter to the representative instead of, or in addition to, contacting us directly.

2. Who This Policy Covers

We process personal data of three groups of people:

• Website visitors — anyone browsing tryvo.io.
• Brand users — people who create a Tryvo account to run campaigns for their store.
• Submitters — customers of a Brand who receive an invitation and submit a video. For most Submitter data we act as a processor on behalf of the Brand (see section 8); the Brand is your primary contact for privacy requests about your submission.

3. Data We Collect

• Account data (Brand users): name, email address, profile image — managed through our authentication provider Clerk.
• Brand data: store name, logo, brand colors, product catalog, order and customer data synced from your connected Shopify store.
• Submission data (Submitters): the video you upload, your answers to the submission questionnaire (e.g. age range, product satisfaction), your name and email from the originating order, and quality scores generated by AI.
• Usage data: pages visited, features used, timestamps.
• Device data: browser type, operating system, IP address.
• Communication data: emails sent through connected email services (e.g. Klaviyo) including delivery status.

4. Purposes & Legal Bases

Where the GDPR applies, we process personal data on the following bases:

• Providing the Service, including account management, Shopify sync, submission handling, and reward fulfillment — Art. 6(1)(b) GDPR (contract) or, for Submitter data processed for a Brand, the Brand's instructions under our Data Processing Agreement.
• AI-assisted quality scoring and transcription of submitted videos — performance of the submission agreement with the Submitter and the Brand's legitimate interest in reviewing content quality (Art. 6(1)(b) and (f) GDPR).
• Service communication (account, security, billing notices) — Art. 6(1)(b) and (f) GDPR.
• Analytics cookies — only with your consent (Art. 6(1)(a) GDPR); see the Cookie Policy.
• Security, abuse prevention, and legal compliance — Art. 6(1)(c) and (f) GDPR.

5. AI Processing

Submitted videos are automatically transcribed and scored using AI models operated by OpenAI and Google. The models receive the video frames, audio transcript, and campaign context needed for scoring. We do not permit these providers to use your content to train their models under our API agreements. No decision producing legal or similarly significant effects is taken solely by automated means: Brands review submissions before approving or rejecting them.

6. Recipients & Subprocessors

We share personal data only with service providers that help us operate Tryvo (hosting, database, authentication, storage, AI, email), with the Brand whose campaign you participate in (for Submitter data), and where required by law. The current list of subprocessors, including their locations, is published at tryvo.io/legal/subprocessors.

7. International Transfers

Application content (database, uploaded videos) is stored in the European Union. Some subprocessors (e.g. authentication, AI, email) process data in the United States or other third countries. Where the GDPR applies, such transfers are safeguarded by the European Commission’s Standard Contractual Clauses and, where available, the EU–US Data Privacy Framework.

8. Our Role for Submitter Data

For order data, invitation emails, and video submissions processed as part of a Brand’s campaign, the Brand is the controller and we act as processor under our Data Processing Agreement. If you are a Submitter and want your data corrected or deleted, contact the Brand you submitted to; we support Brands in fulfilling such requests and also honor Shopify’s GDPR redaction webhooks automatically.

9. Retention

• Account data: kept while your account exists; deleted after account deletion, subject to statutory retention duties.
• Brand store data (orders, customers, products): kept while the store is connected; deleted when Shopify sends its shop-deletion (redact) webhook after uninstall.
• Submissions and rewards: kept while the Brand's account exists, as they document the reward transaction.
• Logs and diagnostic data: kept for a short rolling window appropriate to security and debugging.

10. Your Rights

Where the GDPR applies, you have the right to:

• access your personal data (Art. 15 GDPR)
• rectification (Art. 16 GDPR)
• erasure (Art. 17 GDPR)
• restriction of processing (Art. 18 GDPR)
• data portability (Art. 20 GDPR)
• object to processing based on legitimate interests (Art. 21 GDPR)
• withdraw consent at any time with effect for the future (Art. 7(3) GDPR)
• lodge a complaint with a supervisory authority in your EU member state

Under the PDPO you have comparable rights of access and correction. To exercise any right, email us at kontakt@tryvo.io.

11. Cookies

Details on the cookies we set and how to change your consent are in the Cookie Policy. Analytics cookies are only set after you opt in via the cookie banner.

12. Security

We apply technical and organizational measures appropriate to the risk, including TLS encryption in transit, encryption at rest, tenant isolation, and least-privilege access. An overview is published on our Security page.

13. Changes & Contact

We update this policy when our processing changes; the effective date above always reflects the current version. For privacy inquiries, contact kontakt@tryvo.io.