Who we are
Aspar Software EOOD (CG Shops), UIC 204145835, registered office: 9 Aleko Konstantinov St., 7700 Targovishte, Bulgaria. For questions about personal data, write to [email protected]. We have not appointed a data protection officer, because the law does not require one of us.
Whom this covers
People who:
- draft a shop with our AI assistant, in the chat on our site or in ChatGPT;
- use the free website check on our site;
- claim or run a shop on CG Shops or a website on CG Sites (merchants and their owners, representatives and staff);
- write to us;
- use our operator console.
This policy does not cover shoppers in the shops on CG Shops. Each merchant decides what happens to the data in its own shop, and has its own privacy policy. We process that data on the merchant’s behalf, under a data processing agreement.
What we process, why, and for how long
| What | Why | Legal basis (GDPR) | How long |
|---|---|---|---|
| Shop draft: shop name, description of the business, company, VAT number, legal representative, public contact details, proposed products | To prepare your shop, as you asked | Art. 6(1)(b) (steps before a contract). For a company’s representative: 6(1)(f) | The link to an unclaimed draft works for 72 hours. Once a draft or a shop has ended, we remove names and contact details after 180 days (see “Record of demand” below). |
| Your name and email, your acceptance of our terms | To create and run your shop, and to write to you about the service | 6(1)(b). For proof of acceptance: 6(1)(f) | While your shop exists, and 180 days after that. Proof of acceptance: 5 years after the contract ends |
| Billing: company details (name, address, company number, the legal representative (МОЛ) if you give one), VAT number, invoice email, invoices, payments | Invoicing and accounting | 6(1)(b) and 6(1)(c) (Accounting Act, VAT Act) | 10 years from 1 January of the following year (Accounting Act, Art. 12) |
| Credentials you give us for couriers or payment providers | To connect your shop to them | 6(1)(b) | While your shop exists |
| Only if you connect Dropbox or Google Drive: the email and id of your account there, and the access keys it gives us (kept encrypted) | To save each of your invoices and credit notes there, as you asked | 6(1)(b), at your request | Until you disconnect. Then we delete the keys and revoke them at the provider |
| Your messages to support, by email or in the chat on our pages | To answer you | 6(1)(b) | 2 years |
| Building a shop by chat (/build): your email; with Google, also the name and picture of your Google profile; with email, your password only as a protected hash (Argon2id), never the password itself; when you accepted the privacy information | For your account | 6(1)(b) | Until you delete the account; an email account that is never confirmed is deleted after 7 days |
| Your chats with the assistant, processed by Google Cloud Vertex AI in the EU | To build your shop | 6(1)(b) | 30 days after the last message |
| Failed sign-ins, password reset requests and mails sent, kept under a hash of the email and of the IP address; Cloudflare Turnstile’s check that you are not a robot | To protect accounts from password guessing and abuse | 6(1)(f) | Up to 1 day |
| How much of the assistant was used each day, under a hash of the account | A daily limit | 6(1)(f) | 90 days |
| Cloudflare Turnstile’s check that you are not a robot, on some of our forms (website check, email account): Cloudflare receives technical data from your browser, such as the IP address | Protection against bots and abuse | 6(1)(f) | We do not keep the result, we only check it |
| The free website check, only if you send the form: your name, email and phone (optional), the site address and its check result | To send you the full report and to contact you about an online shop | Consent, 6(1)(a) | Up to 12 months, or until you withdraw your consent |
| A share link of the site check, only if you press “Copy the link to the result”: the site address and the check result. The link has no name, email or IP address | To show the result you chose to share to anyone who has the link | 6(1)(f) (legitimate interest: to show the result you chose to share) | 30 days. You can delete the link sooner with “Delete the link” in the browser where you made it |
| The ChatGPT app: the id of the request, and hashes of the IP address and of the ChatGPT user id | To limit how many requests one person can make | 6(1)(f) | About an hour |
| IP address, sign-ins, logs, the session cookie | Security, and preventing abuse | 6(1)(f) | Briefly: logs are overwritten by newer ones once they reach a set size. The cookie: 12 hours, and up to 30 days in the chat on our site |
| Occasional emails about CG Shops or CG Sites (only if you ticked the box “Email me occasionally about CG Shops” or “Email me occasionally about CG Sites”, in Bulgarian “Пишете ми от време на време за CG Shops” or “Пишете ми от време на време за CG Sites”, when claiming) | Marketing | Consent, 6(1)(a) | Until you withdraw your consent |
| Operators of our console: Google account or email, sign-ins | Access control | 6(1)(f) | For as long as they need access |
Record of demand
After we remove your name and contact details, we keep the description of your business and the proposed products (name, category, price). They show us what kind of shops people want, and we keep them on the basis of legitimate interest, for as long as they serve that purpose. This is free text and may still mention you. If you ask, we will delete it entirely.
Where the data comes from
From you, on our pages, including the chat on our site, and by email. And if you use our assistant in ChatGPT: OpenAI sends us the shop details that the assistant has collected, and some technical data to limit requests (see below). The assistant is an AI and says so at the start of the chat. OpenAI Ireland Limited is responsible for the conversation itself, as a separate controller under its own privacy policy, and we do not see it.
The CraftGenie Shop Builder app in ChatGPT
When you use our CraftGenie Shop Builder app in ChatGPT, its tools receive:
- the description of your shop or website, and the shop details you choose to give;
- the id of the request;
- a SHA-256 hash of your IP address and a SHA-256 hash of your anonymised ChatGPT user id.
We keep the id and the two hashes for about an hour, to limit how many requests one person can make. Then we delete them.
The assistant never asks for your name, email or payment details. Nothing is built until you send the claim form on the CG Shops page. The controller is Aspar Software EOOD. Write to us at [email protected].
Before sign-in: a sample shop
When you write what shop you want before you sign in, we send your text to Google Cloud Vertex AI in the EU to show you a sample name, categories and products. We keep the text and the sample for at most 2 hours, linked only to a cookie in your browser, without a name or email. If you sign in and continue, they become the start of your conversation and are kept like it (30 days). To prevent abuse we keep a keyed hash of your IP address with a count of requests for 24 hours and use Cloudflare Turnstile. Basis: steps at your request before a contract (Art. 6(1)(b) GDPR) and our legitimate interest in stopping abuse (Art. 6(1)(f)). Please do not write personal data in this field.
Signing in to the admin panel without a password
When you are signed in to CG Shops, you can open the admin panel of any of your shops with a one-time link valid for 60 seconds. We record when, from which account and for which shop it was issued, in CG Shops and in the shop itself (we keep the record for 1 year for security). The password from the email remains a way to sign in, also without CG Shops.
Team invites
When a shop owner invites somebody to their team, we send the invite to the address the owner gives us, on the owner’s instruction. We record who invited, accepted or removed whom, and when. We keep these records for 2 years. A team member’s changes stay in the shop’s change log with their name and email. After 2 years we remove the name and email of the removed member from the change log.
Who receives it
- Our service providers: Google Cloud (hosting, and Vertex AI for the chat on our site and for reading documents, in the EU), Cloudflare (network and security, including Turnstile, and storage of the shops’ photos and files, in the EU), Backblaze (encrypted backups, in the EU), Google (email, sign-in for our operators, and sign-in with Google in the chat), Amazon Web Services (the shops’ emails, once we move them there), Stripe and myPOS (payment of our fees) and our accountant. The full list is in the DPA.
- Dropbox and Google (Google Drive), only if you connect them on your invoices page: a copy of each of your invoices and credit notes, in your own account there. Dropbox sees only the folder Apps/CG Shops, and Google Drive only the files we made. The provider is responsible for your account, under its own contract with you. You can disconnect at any time, with us or at the provider.
- Public authorities, where the law requires it.
We do not sell data.
Outside the EU
Cloudflare, Google and Stripe are certified under the EU-US Data Privacy Framework where data reaches the USA. Where needed, we also use the European Commission’s standard contractual clauses. You can ask us for a copy.
Your rights
You can ask for:
- access to your data;
- correction;
- erasure;
- restriction of processing;
- data portability.
You can also object to processing based on legitimate interest, and object to marketing at any time. You can withdraw consent at any time. We answer within one month. You can complain to the Commission for Personal Data Protection (КЗЛД): 2 Prof. Tsvetan Lazarov Blvd, 1592 Sofia, [email protected], www.cpdp.bg.
Other
- You must give your name and email to claim a shop. Everything else is optional.
- We make no decisions based solely on automated processing that have legal or similarly significant effects on you.
- Our pages use necessary cookies: a session cookie; in the chat on our site, a sign-in cookie for up to 30 days, and a 10-minute cookie while you sign in with Google; if you ask for a sample shop before you sign in, a 2-hour cookie that keeps the sample until you sign in; only while you connect Dropbox or Google Drive, a 15-minute cookie that keeps the connection to your browser; and, only once you open the support chat, the chat’s cookie, which keeps your conversation for up to a year. On our public pages (www.cgshops.com, the shop builder chat, the site check, these documents) we also use Google Analytics and PostHog, to see how the site is used and which posts bring visitors, and, while we run ads, marketing cookies, only if you allow them (Art. 6(1)(a)). You can withdraw consent at any time. Details: Cookie Policy.
- We keep the campaign tags of the link you came from (for example utm_source) in your browser for up to 30 days, to count which post brought a shop. There is no identifier in them, and they are deleted once sent with your claim.
- Data we delete can remain in our encrypted backups for up to 7 months, until they expire.
- We tell you by email about important changes to this policy.
This is a translation. If the Bulgarian and English texts differ, the Bulgarian text prevails.