Privacy policy
Oriva, 150 bis avenue Charles-de-Gaulle, 92110 Clichy, France. For any question: contact@orivaforge.com. This page says the same as the French one, plus what applies to the buyers of shops that use the Oriva Shopify app.
What we collect, why, and for how long
| Data | Why | Legal basis | Duration |
|---|---|---|---|
| Waiting-list email, with the date of your consent | To tell you when we launch | Your consent | 3 years after you signed up, or until you withdraw it |
| Name and sign-in email (for Google sign-in, those of your Google profile), session cookies | To give you access to your account | Performance of the contract | As long as your account exists. You can delete it at any time from your account (Account, then Delete my account). |
| Your questions to support, with the state of your installation when you sent them | To answer you | Performance of the contract | 3 years after your question, or sooner if you delete your account |
| Stripe customer identifier and subscription status | To bill your subscription | Contract, legal obligation | Invoices: 10 years (accounting obligation) |
| Card fingerprint (an opaque identifier from Stripe, never the number) | To prevent the free trial from being used again | Legitimate interest | 3 years after your trial, even if you later delete your account |
| Root domain of the site that used a free trial | To prevent the free trial from being used again | Legitimate interest | 3 years after your trial, even if you later delete your account |
| Email and amount of a preorder already paid | To honour the preorder | Performance of the contract, legal obligation | Email replaced 30 days after you used your preorder, or 3 years after payment if you never did. The amount and the payment reference stay (accounting). |
| If you are a partner: the name of your link, your payment details (encrypted), your commissions and payouts | To pay your commissions | Performance of the contract (partner programme terms), legal obligation | As long as you take part in the programme. Commissions and payouts: 10 years (accounting obligation) |
| If you are a partner and you choose to: the addresses where you say you share Oriva (channel, profile, newsletter…) and a note | To support you and to spot practices the terms forbid (promo-code sites) | Your consent (you add them yourself, it is optional) | Until you remove them or delete your account. Only you and the Oriva team see them, and Oriva does not visit these addresses. |
| If a partner recommended Oriva to you: the link between your account and that partner | To pay the partner their commission | Your consent (the “Partner programme” cookie) | As long as your account exists. The partner is told of your sign-up and your payments, in their space or in their own tracking tool, but sees neither your name, your address nor your site. |
| IP address when a form is submitted | To block abusive submissions | Legitimate interest | Erased automatically within a few minutes |
We never see your card number: payment is handled entirely by Stripe. We do not sell or rent your data, and we make no automated decision about you.
Cookies
Our own website uses Oriva on itself, to measure its own advertising campaigns. Without your consent, no advertising cookie is set and no click identifier is captured: that is the product's default behaviour, applied to its own page. If you accept in the banner, a cookie (“or_vid”) identifies your visit so that a conversion can be linked to the campaign it came from. If you accepted advertising measurement and create an account, your email address is turned into an irreversible fingerprint before it is passed to Google Ads, so that it can link your sign-up to the ad you clicked. You can change your mind at any time with the “Manage cookies” link in the footer of the French site. With your consent (“Partner programme”), a cookie (“oriva_via”) keeps for 60 days the code of the partner who recommended Oriva to you, and a second one (“oriva_via_sub”) the label they put on their link, if any, so that they can be paid their commission if you create an account. The customer area sets the cookies needed to sign in, and remembers two preferences you choose: the space shown and a message you hid. They are exempt from consent.
Buyers of shops that use the Oriva Shopify app
When a merchant installs the Oriva app, a pixel runs on their shop, and only for visitors who accepted marketing cookies in the shop's privacy settings. For these data the merchant is the controller and Oriva is its processor: the merchant decides which of them are collected and to which advertising platforms they are sent. If you bought from such a shop, address your requests to that shop; you can also write to us and we will pass them on.
The pixel sends us, on the merchant's behalf: page views, product views, add-to-cart, checkout start and purchase events (with the order reference, amount and currency); the advertising click identifiers and campaign tags found in the address the visitor arrived on; the cookie identifiers set by the advertising platforms; a pseudonymous visitor identifier derived from the one Shopify gives the browser; the IP address and browser type of the request; and, when the merchant's installation has been granted access, the buyer's email address and phone number.
Email addresses and phone numbers are normalised and turned into an irreversible fingerprint (SHA-256) before anything is stored: the plain values are not kept. IP addresses and browser types are erased after 90 days. Sales events are kept for 30 days or 13 months, according to the merchant's plan. Events are sent only to the advertising platforms the merchant connected (Meta, TikTok, Google Ads, ChatGPT Ads, or an affiliate network); Meta and TikTok require the IP address and browser type, which are forwarded to them with the event.
We answer Shopify's three privacy requests. When a buyer asks for erasure, we erase their events by hashed email and phone number. When a shop uninstalls the app, we delete the shop's events 48 hours later. Every erasure and every data request leaves a line in an access log, which holds no personal data, for 3 years. We do not offer an automatic export: a buyer's request for access is answered by hand, through the merchant.
About the merchant: we receive the shop's address and, when the merchant creates their Oriva account from the app, the shop owner's email address as Shopify gives it to the app. Billing goes through Shopify. The merchant's data is processed as the table above says for account holders. The agreement that binds us to merchants is on the French site, on the DPA page.
Our service providers
- Vercel: Website hosting, runs in Frankfurt, a platform not limited to Europe
- Supabase: Database and sign-in, European Union
- Upstash: Cache and queue, European Union
- Resend: Sending emails (alerts, support replies), sent from Ireland
- LWS: Support mailbox, France
- Stripe: Payment, Stripe Payments Europe, Ireland
- PayPal: Paying commissions to partners who choose it, PayPal (Europe), Luxembourg
- Google: Signing in with your Google account, only if you choose “Continue with Google”
- YouTube (Google): Presentation video on the French home page, only if you press “Activer le son” (turn the sound on): YouTube may then set cookies. Until you do, no request is sent to YouTube
Some of these providers are American companies. Vercel runs the site in Frankfurt, but its platform is not limited to Europe. Transfers outside the EU are covered by the European Commission's standard contractual clauses or by the EU-US data privacy framework, depending on the provider. Our data are stored in the European Union.
Your rights
You can access your data, have it corrected or deleted, object to its processing, limit its use, take it with you, or withdraw your consent at any time. Write to contact@orivaforge.com (see also our contact page): we answer as soon as we can. If you think your rights are not respected, you can also lodge a complaint with the CNIL, the French data protection authority (its complaint page is in French:cnil.fr/fr/plaintes).