Privacy Policy

This policy explains what personal information loving collects, why, on what legal basis, who processes it and where, how long it is kept, and how you can use your rights. It applies to merchants and their staff using the loving platform, to visitors of our website, to shoppers who use storefronts hosted by loving and the loving account they shop with, to people who write to those stores through the channels a merchant connects, and to the people at fashion brands we contact about loving.

Who is responsible for your data

loving is operated by lovingapp, Inc., 131 Continental Dr, Suite 305, Newark, Delaware 19713, United States ("loving", "we"). Our full details are in the Legal Notice.

Where we are established. loving is a company established in the United States, with no establishment in the European Union or the United Kingdom. The EU General Data Protection Regulation and the UK GDPR still apply to what we do as controller when we offer our services to people in the EU or the UK, or monitor how they use them (Article 3(2) of each). That is why we name representatives there, below.

We play two different roles, and which one applies decides who you should ask about your data:

• loving is the controller of the data it needs to run its own business: merchant and staff accounts, platform billing, the loving account shoppers sign in with (described below), visitors to our website, our business outreach and referral invitations, consent and legal-acceptance records, and the logs that keep the platform secure.
• Each store is the controller of the data it collects from its customers and visitors — its customer records, orders, conversations, reviews, marketing lists, storefront analytics, and the records of its own team. Each store is run by an independent merchant; loving processes that data on the merchant's behalf and only on its instructions, under our Data Processing Addendum. If your question is about what a store holds about you, ask that store first (its own privacy policy and legal notice are linked from its footer); we help merchants answer.

Representatives. Our representative in the European Union under Article 27 GDPR: [to be completed]. Our representative in the United Kingdom under Article 27 UK GDPR: [to be completed]. You and the supervisory authorities can contact them, as well as us, about anything in this policy.

Privacy contact. We have not appointed a statutory Data Protection Officer: at our size and with the processing we carry out, the law does not require one. Our founder is responsible for privacy and answers every privacy request at hello@loving-app.com.

The loving account you shop with

When you sign in to a store hosted by loving, you sign in with a loving account that works at every loving store. loving is the controller of that account. It holds:

• your name, email address and (if you add them) phone number, photo, date of birth, gender, language and currency, and a company name and tax number for business purchases;
• your address book, which you can reuse at any loving store;
• cards you choose to save: they are kept by Stripe on a customer record that belongs to loving's Stripe account, so you can use them at any loving store. We only see the card brand, its last four digits and its expiry date;
• your signed-in sessions, with the store or site and the browser of each, so you can see and end them;
• the documents you accepted at sign-in (a store's terms and privacy policy and loving's) and when, your default email and notification preferences, and any data or deletion request you make.

What a store sees. A store receives your name, email address, phone number and language only after you sign in to it and accept its policies. Your date of birth is read from your account when that store needs it (for example a birthday reward) and is not copied into the store's records. An address you type at a store is kept by that store and also saved to your address book; another store gets an address from your book only when you pick it yourself. Your gender, company details, saved cards, sessions and address book are never shown to a store. Your marketing preferences in the account are only defaults: agreeing to one store's emails never signs you up for another's.

You manage all of this from your loving account center: you can download a copy of your data, change it, end sessions, ask one store to forget you, switch off profiling at a store, or delete the whole account.

Information we collect

Merchant and staff accounts. Your name and email address, how you sign in (a Google account or one-time email codes), and optional profile details such as a photo, phone number, bio and language. If your store uses Team, it also holds what the store records about you as one of its people (your role, personal and emergency-contact details, documents, schedule, time and leave records, pay terms and payslips); for those records your store is the controller.

Store and commerce data. The products, collections, orders, customers, inventory, shipping, media (pictures, and short videos for marketing posts), pages and settings a merchant creates while running a store. Orders include the buyer's contact details and shipping and billing addresses.

Prompts and AI interactions. The messages, files and images you send to loving's AI features, and what they produce.

Messages and reviews. Conversations between customers and a store — on the storefront's own chat and through any channel the merchant connects to the inbox (WhatsApp, Instagram, Messenger, TikTok, Telegram and email) — with their attachments, and product reviews with any photos. When someone writes through a connected channel, the store gets a contact with the name and account identifier that platform provides.

Storefront activity. Storefronts count visits for the merchant. What they record depends on the visitor's choice in the store's cookie question (see "Storefront analytics, cookies and advertising" below).

Usage and device information. Logs, the country derived from your IP address, your browser type and language, used to operate and secure the service.

Business contacts. For our own outreach, we keep business contact details of people who run or work at fashion brands: name, work email address, brand name, the brand's website and Instagram handle, country, our tags and notes, and whether we added the contact by hand or imported it from a list. We also keep the emails we sent, whether they were delivered, bounced or marked as spam, whether the offer link in them was clicked, any reply and its text, and any request to stop. We do not track whether our emails are opened.

Referral invitations. When a merchant asks loving to invite someone, we keep the invitee's email address, the inviting merchant's name, the referral code and whether the invitation was claimed.

Visitors to our website. loving's own website runs no analytics or advertising tools. If you accept the small notice that asks, we remember how you first reached us (campaign tags in the link, the referring site and the page you landed on) for up to 30 days, and record it once if you create an account. A referral code from a link you followed is kept in your browser for up to 30 days so the offer can be applied when you sign up.

Why we use your data and our legal bases

This table covers the processing loving decides on as controller. For data we process for a store, the merchant decides the purposes and the legal basis.

Purpose	Data	Legal basis	How long
Providing the platform: accounts, stores, hosting, the dashboard and the AI features	Account details, store data, prompts and AI output	Performing our contract with you (Art. 6(1)(b) GDPR)	While the account or store exists; then as in "How long we keep data"
Running your loving shopper account and signing you in to stores	Identity, address book, saved-card details, sessions, sign-in records	Performing our contract with you	While the account exists; sign-in records 12 months; ended sessions 30 days
Billing merchants, invoices, tax and accounting	Billing contact, subscription and payment records	Contract; legal obligation (Art. 6(1)(c))	As long as tax and accounting law requires
Service emails: sign-in codes, invitations, receipts and notices	Email address, the message	Contract	Delivery records as long as the account exists
Keeping the platform secure: preventing fraud, abuse and attacks, rate limits, investigating incidents	IP-derived country, device and browser details, logs, sign-in records	Legitimate interests: protecting loving, its merchants and shoppers	Sign-in records 12 months; other logs as short as our providers allow
Recording what you agreed to	Which document versions you accepted, and when; storefront cookie choices	Legal obligation to be able to prove consent (Art. 7(1)); legitimate interests in proving our agreements	While the account exists and as long as a claim could arise; storefront cookie records 13 months (the answer kept with an order, as long as the order)
Measuring the cost of AI features and spotting misuse	Feature used, model, amount of usage, store, the AI agent's actions	Legitimate interests: running the service at a sustainable cost, and accountability for what the agent did	AI usage records 18 months; AI agent action logs 12 months
Business outreach to fashion brands	The business contact details and email history listed above	Legitimate interests: telling businesses that may benefit from loving about it (direct marketing)	Deleted 12 months after our last contact; an opt-out is kept on our suppression list so we never write again
Sending a referral invitation a merchant asked us to send	Invitee's email address, inviter's name, referral code	Legitimate interests of the inviting merchant and of loving	While the referral programme needs it to credit the invitation; opt-outs kept on our suppression list
Knowing which campaigns bring merchants to loving	Campaign tags, referring site, landing page	Consent (Art. 6(1)(a)), given in the notice on our website	Up to 30 days in your browser; recorded once with your account if you sign up
Applying a referral or offer you followed a link for	The code	Taking the steps you asked for before a contract (Art. 6(1)(b))	Up to 30 days in your browser
Answering your requests and meeting legal duties, including requests from authorities	The request, your identity check, what we did	Legal obligation	3 years

Where we rely on legitimate interests, you can object at any time (see "Your rights"); we then stop unless we have compelling grounds or need the data for a legal claim. Objections to direct marketing are always honoured.

Giving us your email address is necessary to create an account and use the service; without it we cannot provide it. Everything else on your profile is optional.

Data we process for stores

On a merchant's instructions, loving runs the store's customer-facing features and back office: customer accounts and records, carts, checkout, orders and tracking, returns, reviews (marked when they come from a verified purchase), favorites, loyalty, gift cards (including the name and email of someone a card is sent to), subscriptions, event registrations and check-in, conversations, the shopping assistant, virtual try-on, storefront analytics and attribution, marketing email and WhatsApp messages, customer profiles, segments and automated journeys, and the records of the store's own team.

Marketing to a store's customers. A store's marketing emails go only to people who agreed to receive them. By default the store asks new subscribers to confirm by email (double opt-in), and keeps proof of each consent: where it was given, the wording version and the language. Consent, unsubscribes and complaints are checked again at the moment of sending; every email carries an unsubscribe link and the sender's postal address. Someone who unsubscribed can only be subscribed again by their own action. WhatsApp marketing messages are sent only to people whose opt-in the store has recorded.

Customer profiles. Merchants see each customer's orders, conversations and activity in one profile and can group customers into segments. Purchases of sensitive product types (such as maternity, nursing, period and adaptive wear) are never used for profiling, and profiling can be switched off for any customer — by the merchant, or by the shopper from their account.

Store legal pages. Every store is given editable privacy, terms, refund, shipping, legal-notice and right-of-withdrawal pages that fill in the merchant's own legal details. The merchant is responsible for completing them and for complying with the privacy laws that apply to its customers.

We do not sell personal information, we never use one store's data for another store, and we do not use a store's data to advertise loving or anyone else.

Storefront analytics, cookies and advertising

Every storefront asks visitors two questions before anything that is not strictly necessary happens:

• Analytics — a persistent first-party visitor identifier, so the store can count returning visitors, follow a visit from page to page and checkout, and attribute orders to the campaigns and ad clicks that brought them.
• Marketing — the advertising pixels a merchant connects (Meta, TikTok, Pinterest, Google, Snapchat), and the purchase conversions loving sends to the same networks from the server, with the buyer's email address and phone number hashed with SHA-256.

Before you choose, a storefront counts page views with a temporary identifier held only in the open page's memory, together with campaign tags and the referring site's address — no persistent identifier and no ad-click identifiers. A browser that sends a Global Privacy Control signal is treated as refusing marketing. Server-side conversions are sent only for orders whose visitor agreed to marketing. Storefronts pass Google's Consent Mode signals so Google tags respect your answer.

Your choice is kept in your browser for 12 months, and a record of it (which choice, when, and the wording version) is kept for 13 months as proof. You can change it at any time from the "Cookie settings" link in every store's footer. Each order also keeps what the browser it was placed from said — its answer to the marketing question, whether it sent a Global Privacy Control signal, and the country it was seen from — for as long as the order is kept, so the order's conversion follows that browser: a refusal or a Global Privacy Control signal there stops it, even if you agreed on another device.

By default every visitor is asked. A merchant may choose to ask only visitors in the European Economic Area, the United Kingdom and Switzerland; elsewhere, analytics and marketing then run until you decline, and the decline control is always shown. Analytics events are kept for 180 days by default, and the visitor identifier is linked to a person only when they sign in or place an order. The Cookie Policy lists every cookie and storage entry.

Fonts and videos. Storefronts and loving's website load their web fonts from loving's own address — we fetch them from Google Fonts on our side — so your IP address is not sent to Google when a page loads. A video embedded in a store page (YouTube through youtube-nocookie.com, or Vimeo with its "do not track" setting) loads only after you click it.

AI features and model providers

loving's AI features use two third-party model providers:

• Anthropic powers the loving AI agent — the store builder, the dashboard assistant and the AI in Studio. When a merchant asks it to, the agent reads the store's records to answer (for example to find a customer, list orders or open a customer's profile), and that content is sent to Anthropic for that request.
• OpenAI powers the storefront shopping assistant (which can read the signed-in shopper's own orders, tracking and returns to answer them), the AI features built into storefronts such as virtual try-on, reply drafts in the inbox and on WhatsApp, marketing copy, suggested customer personas and segments, translation, the writing assistant and "Enhance with AI", and image generation and editing.

What you submit to an AI feature — prompts, files, images and the store context the feature needs — is sent to the provider to produce the response. Under their terms for business customers, neither provider uses that data to train its models; they may keep requests for a limited period to detect misuse, under their own retention terms. We do not opt in to any programme that lets a provider use our data for its own purposes. For virtual try-on, the photo you upload is deleted as soon as the image is made, and the image is deleted after 30 days.

What the AI does on its own. The storefront shopping assistant answers shoppers directly, and is clearly labelled as AI. A reply the AI drafts in the inbox or on WhatsApp is reviewed and sent by a person, personas and segment suggestions are proposals a person approves, and the agent asks for approval before high-impact actions.

Profiling and automated decisions

Stores can build profiles of their customers: lifecycle stages (such as new, returning or lapsed), segments, and predictions such as how likely a customer is to stop buying. These predictions are calculated by fixed rules, not by AI. A store can use them to start automated journeys — for example a win-back email or a discount offer.

None of this makes decisions that have legal or similarly significant effects on you: nothing decides whether you can buy, what you pay at checkout, or anything about credit or employment. You can object to profiling by a store at any time by switching it off in your loving account, or by asking the store. Stripe may screen payments for fraud under its own policies.

Connected platforms

Merchants can connect their own accounts on Meta (Facebook, Instagram, Messenger, WhatsApp, Threads and Meta Ads), TikTok (TikTok Shop, TikTok Business Messaging, TikTok posting and TikTok Ads), Google (Search Console, Merchant Center, Google Ads and YouTube), Pinterest, Snapchat and Telegram. Depending on what the merchant turns on, loving:

• sends the store's catalog, posts (pictures and short videos; on YouTube, Shorts only) and ads to that platform;
• receives the messages customers send the store there, and sends the store's replies back;
• for advertising measurement, sends that platform each purchase (its value and items) with the buyer's email address and phone number hashed with SHA-256 — only for orders whose visitor agreed to marketing.

Data loving receives from a connected platform is used only to provide that merchant's features. It is never sold, never shared with another merchant, and never used by loving to train AI models. Access tokens for connected accounts are encrypted at rest. When a merchant disconnects a platform, loving deletes its tokens and stops syncing; disconnecting TikTok Shop also deletes the customer-service conversations it brought into the inbox and the contacts who only wrote through it. Each platform processes what it receives as an independent controller under its own terms.

Who we share data with

• Service providers (sub-processors) that host, store, deliver and process data for us under contract — the current list, what each processes and where, is at Sub-processors.
• Stores you sign in to, as described in "The loving account you shop with".
• Platforms a merchant connects, as described above.
• Stripe, which processes payments as an independent controller under its own privacy policy, and carriers (through our shipping provider), which receive the delivery address of a parcel.
• Authorities, only where the law requires it, after we check that the request is lawful and limited to what it needs.
• A buyer or successor, if loving is involved in a merger or sale of its business, under this policy.

Where data is kept and international transfers

loving's primary database runs on Convex, hosted on Amazon Web Services in Ireland (European Union). Uploaded media (pictures and short videos) and storefront files are stored and delivered by Cloudflare, and the apps are served from Vercel's global network. loving itself is a United States company: the people who operate the service, and several of our providers — including our AI model providers and email delivery — reach or process data from the United States.

Data stores share with us. When a merchant in the European Economic Area, the United Kingdom or Switzerland has loving process its store's data, that data is transferred to us in the United States under the European Commission's standard contractual clauses — Module 2 (controller to processor), in our Data Processing Addendum — with the UK International Data Transfer Addendum for UK data and the Swiss adaptations for Swiss data. Where we pass it on to a sub-processor outside those regions, we use Module 3 (processor to processor) with the same additions.

Data we hold as controller. What you give loving directly — your account, your loving shopper account, your messages to us — is held by a United States company under this policy. Where we pass it to providers outside the EEA, the UK or Switzerland, we use standard contractual clauses (Module 2, controller to processor, with the same UK and Swiss additions) with each of them.

You can ask us for a copy of the safeguards that apply.

How long we keep data

• Accounts and stores: while they are active. Deleting a store starts a 30-day recovery window, after which the store and its data — catalog, orders, customers, media, conversations and builder history — are permanently deleted. Deleting a loving account starts a 30-day window in which it can be cancelled; then the account is deleted and its records in each store are anonymized.
• Storefront analytics events: 180 days by default (the merchant can change this). Storefront cookie-choice records: 13 months; the answer kept with an order, as long as the order.
• Shopping-assistant conversations: 12 months after their last message.
• Virtual try-on: the uploaded photo is deleted right after processing; the generated image after 30 days.
• Sign-in records: 12 months. Ended sessions: 30 days.
• A store's activity log and AI agent action log: 12 months. AI usage records: 18 months.
• Abandoned carts: 90 days after they expire; idle carts: 180 days.
• Records of a store's team members: their emergency contacts and kiosk PIN are deleted when they leave; other personal details, documents and time and leave records 36 months after their employment ends by default (the merchant can change this); payroll records as long as tax law requires.
• Data-export archives: 7 days. The log of privacy requests: 3 years.
• Business outreach contacts: 12 months after our last contact.
• Disconnecting TikTok Shop deletes the conversations and contacts it brought in, straight away.

Some records — for example invoices, orders and payment ledger entries — are kept longer where tax, accounting or other law requires. When a person's account or customer record is erased, those records no longer identify them.

Your rights

Depending on where you live, you have the right to:

• access your data and get a copy;
• correct data that is wrong or incomplete;
• delete your data;
• restrict our use of it while a question is resolved;
• receive the data you gave us in a portable format, or have it sent to someone else;
• object to processing based on legitimate interests, including profiling, and — always — to direct marketing;
• withdraw consent at any time, without affecting what was done before;
• not be subject to a decision based solely on automated processing that has legal or similarly significant effects on you;
• complain to a data-protection supervisory authority, in particular where you live, where you work or where you think the law was broken. Because we have no establishment in the EU, there is no single lead authority for us: any EU authority can receive your complaint, and in the UK it is the Information Commissioner's Office.

How to use them. Most of this is self-service:

• Shoppers can download a copy of their data or delete their loving account from the account center (a deletion can be cancelled for 30 days, then runs), ask a single store to forget them (which takes effect immediately), and switch off profiling at a store.
• Merchants and staff can download their own data and delete their account from the dashboard. An account that still owns a live store cannot be deleted until the store is deleted or transferred to someone else.
• Merchants can export a customer's data, erase a customer and switch off profiling for a customer from the dashboard. Erasing a customer deletes their conversations, reviews and review photos, carts, tracking, profile data, try-on images and assistant chats, and removes their personal details from gift cards; their orders are kept for tax and accounting law but no longer identify them.

For anything else, email hello@loving-app.com. We may need to confirm your identity first. We answer within one month; where a request is complex we may extend that by up to two further months and will tell you why. Requests are free. If your request concerns data a store controls, we pass it to the store or help it answer.

Your rights under US state privacy laws

If you live in a US state with a consumer privacy law (such as California, Colorado, Connecticut, Virginia or Texas), the following applies in addition to the rest of this policy.

What we collect. In the past 12 months we have collected the categories described in "Information we collect": identifiers (name, email, phone, account and device identifiers); customer records (addresses, billing details); commercial information (orders, subscriptions); internet activity (pages viewed, storefront events); approximate location (country); audio and visual information (photos you upload); professional information (business contacts for outreach); and inferences (customer segments and lifecycle stages). We use them for the purposes in "Why we use your data", and disclose them to the service providers and parties listed in "Who we share data with".

No sale. loving does not sell personal information and does not share it for cross-context behavioural advertising on its own account. On storefronts, advertising pixels and conversions — which can count as "sharing" — run only for the merchant, only with the visitor's marketing consent, and never when the browser sends a Global Privacy Control signal, which we treat as an opt-out. We do not use sensitive personal information to infer characteristics about you, and we have no actual knowledge of selling or sharing the data of anyone under 16.

Your rights. You can ask to know what we collect and how we use and disclose it, to get a copy, to correct it, to delete it, and to opt out of sale or sharing. We will not treat you differently for using these rights. An authorized agent can make a request for you with your signed permission; we may ask you to confirm your identity directly. If we decline your request, you can appeal by replying to our answer or by writing to hello@loving-app.com with "Appeal" in the subject; we answer appeals within the time your state's law sets, and if we still decline you can contact your state attorney general.

Children

loving is not directed to children. You must be at least 16 to create a loving account, and we do not knowingly collect personal information from children under 16. If you believe a child has given us their data, contact us and we will delete it.

Security

All data is encrypted in transit (TLS) and at rest by our infrastructure providers. On top of that, access tokens for connected platforms and API keys are encrypted with AES-256-GCM, and gift-card codes, webhook secrets and guest chat tokens are stored only as one-way hashes. Every store's data is isolated from every other store's, staff access follows the granular permissions each merchant chooses, incoming webhooks are verified by signature, changes made in a store are recorded in its activity log, and access to production data is limited to the people who operate the service.

Personal-data breaches

If we become aware of a breach affecting personal data, we notify the affected merchants without undue delay and in any event within 72 hours of becoming aware of it, with what we know and what we are doing about it. Where we are the controller and the law requires it, we notify the competent supervisory authority within the same 72 hours, and the people affected without undue delay when the breach is likely to put them at high risk. We also notify the platform partners whose data is involved, as our agreements require.

Changes to this policy

We may update this policy as the product evolves. We tell merchants about material changes in the dashboard before they take effect, and the "Last updated" date above changes with every revision.

Contact

Questions, requests or security concerns: email hello@loving-app.com, reach us from your dashboard, or reply to any email loving has sent you. Our postal address is in the Legal Notice.