Privacy policy

Total Commerce Listings (“the app”) is operated by Wuva Ltd (“we”). It lets a merchant list stock to their Shopify store from a handset. This policy describes what the app stores, why, and how to have it removed.

What we store

Merchant data. The Shopify store domain, an encrypted API access token, the templates, catalogue and branding the merchant creates, a history of the uploads made, and the names of paired handsets. Where a store is connected through its own Shopify app, that app’s client id and secret are stored encrypted.

Product data. The details of items the merchant lists: title, description, specifications, price, photographs and video clips. From a handset, photographs and clips are uploaded directly to Shopify’s own storage and do not persist on our servers. From the web page, or when a template asks for a server-side studio step, they pass through our servers for processing and are not kept afterwards.

Customer data: none. The app does not read, receive or store any information about a merchant’s customers. It requests no customer, order or checkout permissions.

API keys. Where a merchant creates a key for the public API, we store a one-way hash of it, never the key itself.

Why we store it

Solely to provide the service: to authenticate with the merchant’s store, render the capture app from the merchant’s templates, look up specifications from their catalogue, and create products. We do not sell data, share it with advertisers, or use it for any purpose other than operating the app and, where a plan is metered, calculating the bill.

Optional AI features

AI features are off until a merchant turns them on under Settings, and are metered. When on, item photographs and the answers staff have typed may be sent to Anthropic (to suggest answers, check photo quality, or write listing copy) and to Leonardo.ai (to remove or replace a photograph’s background, add a shadow, or upscale it). Both process the data to return a result and under their terms do not use it to train models. No customer data is ever involved, because the app holds none. Turning the features off stops any further data being sent.

Where it is held

On infrastructure hosted by Render in the European Union (Frankfurt). Access tokens and app secrets are encrypted at rest. Handset tokens are stored in the device’s secure keychain. Our processors are Shopify (the store itself), Render (hosting and database), and, only when a merchant has turned AI features on, Anthropic and Leonardo.ai as described above.

Shopify privacy requests

We implement Shopify’s mandatory compliance webhooks. Because we hold no customer data, a customer data request or customer redaction request is acknowledged with confirmation that nothing is held. A shop redaction request, which Shopify sends 48 hours after uninstall, permanently erases every record we hold for that store: its catalogue, upload history, templates, devices, credentials and the store record itself.

Uninstalling

Uninstalling the app revokes its access to your store immediately. Your templates and history are retained for 48 hours so a reinstall restores them, then erased as above. You can request earlier deletion by contacting us.

Contact

Wuva Ltd · support@totalcommerce.ai