Privacy policy.

Who is responsible?

Revuka is operated by Wndr.digital B.V., Ravenoord 1, 3523 DB Utrecht, the Netherlands, registered with the Dutch Chamber of Commerce under KvK 89116194. Contact us at info@revuka.com for privacy questions or requests.

We are responsible for information used to operate this website, respond to enquiries and administer our merchant relationship and subscription service. For customer data processed on behalf of a merchant using the app, the merchant determines the purposes of processing and we act on its instructions. The merchant’s privacy policy also applies.

What information is used?

• Website and enquiries: technical request information needed to serve and secure the site, and the contact details and messages you choose to email us.
• Merchant accounts: Shopify store identity, installation and access information, app settings, agreement acceptance, private subscription/approval information, invitation usage and operational records.
• Review collection: relevant order/customer and product references, the order email address, invitation status, language, purchase-evidence references, review-link credentials and a per-store unsubscribe marker.
• Reviews: the display name chosen by the reviewer, rating, review text, product association, submission date, source, verification information, merchant responses and any photos or videos submitted with a product review.

We do not request Shopify customer first/last names, postal addresses, phone numbers or payment-card details for this workflow. A display name is supplied as review content. Our data-use overview lists each category’s fields, source, purpose, visibility and retention.

Why is it processed?

Information is used to provide and secure Revuka, respond to enquiries, send merchant-authorized review requests, collect and manage reviews, establish purchase evidence, display published feedback and handle support and privacy requests. Merchant customer data is not used for data sales, advertising audiences or AI-model training.

For our own processing, the applicable basis is responding to steps you request before a contract, performing a service agreement, legitimate interests in operating and securing the service, consent where required, or a legal obligation. Merchants are responsible for the lawful basis and required notices for their customer communications and review publication. The merchant processing agreement sets out the parties’ instructions and duties; the owner adopted version 2026-11-05 on 5 November 2026, while merchant acceptance remains a separate affirmative action in the app.

Plans, billing and invitation allowance

Shopify supplies the subscription ID, status, test flag, price, currency and current billing period. Revuka verifies the active entitlement with Shopify. Local billing records contain the store and installation references, a pending subscription reference, an encrypted pending approval link and the minimal request/uncertainty metadata needed to avoid duplicate charges.

Invitation usage records contain the store, UTC calendar month and sent/reserved counts, without customer identifiers. A separate private delivery ledger can link a request to its delivery status, provider message reference and quota period/count marker. These records operate the plan allowance and reliable delivery; they are not public storefront or advertising data.

Shopify handles subscription approval and payment directly. Revuka’s billing flow does not request structured card or bank details. Broader event messages can be received transiently for authentication and are minimized before storage; review text and files remain content supplied by their author.

What becomes public?

A published review can show its display name, rating, text, submission date, source and verification context, merchant response and attached media. Do not include private information in review text or media. Uploaded files retain their validated original bytes: embedded metadata, such as EXIF, is not stripped and can become public with a published file.

Customer email addresses, private order/customer identifiers, invitation tokens and internal operational records are not included in the public storefront review response. A purchase-verification label describes the evidence checked; it does not guarantee the truth of an opinion.

The website demo

The interactive website demo stays in your browser tab. Its entries are not submitted to the review service, and files selected there are previewed locally rather than uploaded. Closing or resetting the demo clears its working state.

This website does not add analytics or advertising cookies. Essential browser preferences may be stored locally. Following an external link takes you to a service with its own privacy policy.

Service providers and transfers

Cloudflare provides Revuka’s hosting, database, media storage, invitation-email delivery and inbound email routing. Google Workspace receives support and private privacy enquiries sent to info@revuka.com. That correspondence includes sender/recipient addresses and display names, message headers, content and any attachments the correspondent supplies. Shopify provides the merchant platform and authorized data exchange.

The owner has confirmed Wndr.digital B.V. as the contract customer for Cloudflare and the receiving Workspace account. Google’s standard Netherlands Workspace terms identify Google Cloud EMEA Limited in Dublin unless another agreement applies; this published basis has not been independently audited against the individual contract. The provider schedule links the relevant processing terms, entity table and subprocessors.

Infrastructure and support can involve processing outside the European Economic Area. Applicable processing terms and transfer safeguards govern those arrangements. We do not promise EEA-only processing. Do not send customer exports as ordinary support-email attachments; use the authenticated app workflow.

How long is information kept?

Reviews are kept while the store uses the service unless the merchant or customer requests deletion. Deleted reviews are hidden immediately; remaining deletion records and attached media are cleaned up after 30 days when synchronization can safely complete. Unattached uploads expire after 7 days.

Invitation email and encrypted review links are erased after the request expires, 180 days after its scheduled invitation date. Purchase references and pseudonymous recipient fingerprints can remain as evidence and to honor opt-outs. Completed webhook bodies are scrubbed after processing; duplicate-event metadata is retained for 30 days. Server-held customer-data exports expire after 30 days. Downloaded support/export copies use restricted encrypted temporary storage and are deleted on task closure, no later than seven days afterwards unless a separately documented legal requirement applies. This is a manual operating duty, separate from server expiry. Revuka’s application audit records, completed jobs and sent-mail metadata are cleaned after 365 days. Providers’ own security and administrative logs follow their separate service terms. Unresolved work, uncertain delivery records and failed minimal events require operator resolution rather than a fixed automatic purge date. Len van Essen owns these cases, checks failed privacy/background work each business day and reviews still-open cases at least every 30 days.

The encrypted billing-approval link is cleared when Shopify authoritatively confirms that its matching pending subscription is active, frozen, cancelled, declined or expired, or when the pending subscription reference is removed. A still-pending or unconfirmed link becomes eligible for scheduled cleanup two days after its last checkout attempt or saved approval state; ordinary plan-page refreshes do not restart that period. Local billing-account metadata remains until store-data deletion. Aggregate invitation usage is retained for roughly 13 calendar-month periods; erasing a customer’s linked personal request/delivery records does not remove account-level usage totals. Uninstalling immediately removes installation credentials and stops ordinary review invitations, reminders and scheduled collection work. Shopify’s shop-data deletion request removes the store’s retained local data and media, including acceptance and unsubscribe records, with protection against an old request deleting a newer active installation. Ordinary resolved support and website enquiries are manually deleted 90 days after resolution unless a specific continuing purpose is documented; provider deletion/recovery terms also apply. The data-use schedule also explains recovery copies and the retention limits.

Local erasure is not postponed when Shopify has revoked access needed to delete its separate review object. External deletion remains unconfirmed until resolved. A private follow-up record can keep only pseudonymous store/object/product references and the minimal action, timing and error state needed to complete that instruction. Len owns the follow-up; completed records are cleaned after 30 days. Store-data redaction removes these local follow-up records as well, without implying that the external platform has erased its object. Controller/platform assistance may still be necessary.

Your choices and rights

Review recipients can unsubscribe using the invitation link. This stops that merchant’s review invitations and reminders, including future orders. A per-store keyed email fingerprint preserves the preference without retaining the address in the suppression record. It is pseudonymous personal data, not anonymous data. Customer erasure and store-data deletion remove the marker; if it is erased, the service can no longer remember that preference.

A merchant can stop requests or uninstall the app. These controls do not replace a request to erase personal data. Depending on the circumstances, you can request access, correction, deletion, restriction or portability of your personal data, object to processing, and withdraw consent where processing relies on it. Contact the merchant for merchant-controlled customer data, or email us and identify the relevant store. We may ask for information needed to verify the request without exposing another person’s data.

You can also lodge a complaint with your competent data-protection authority, including the Dutch Autoriteit Persoonsgegevens.

Changes and contact

We update this policy when the service or its data practices change. The date above identifies the current version. Len van Essen is accountable for privacy, security and incidents. Questions can be sent to info@revuka.com or to Wndr.digital B.V. at the postal address above. Routine support is Monday–Friday, 09:00–17:00 Europe/Amsterdam, excluding public holidays. There is no 24/7 monitoring or guaranteed response-time service; support hours do not postpone notification of a personal-data breach without undue delay.