This translation is provided for information only. In the event of any difference, the French version prevails.
Privacy Policy
Vueko · Last updated: 24 October 2026
This policy explains which personal data we process, why, with whom, for how long, and how to exercise your rights. It applies to the website vueko.app and to the Vueko service (the “Service”).
1. Data controller
Faycel Delli, sole trader (entrepreneur individuel, EI), publisher of Vueko
27 rue de Verdun, 92150 Suresnes, France
E-mail: contact@vueko.app
For any question about your data, write to contact@vueko.app.
2. The data we process
2.1. If you use Vueko (customers and members of a workspace)
- Account: name, e-mail address, password (stored only in a hashed, unreadable form), Google identifier if you sign in with Google, role and workspace.
- Subscription and payments: plan, credit history, invoices, customer identifier with our payment provider. Your bank card details are processed directly by Stripe: we never have access to them.
- Use of the Service: tracked stores, searches, generated stores, texts and photos you import, requests sent to the artificial intelligence assistant.
- Shopify connection: your store's address and access credentials (your app's ID and secret, or access token, and the temporary token we obtain from them), stored encrypted.
- Technical data: IP address, connection and error logs, cookies necessary for the website to work.
- Origin of your sign-up: if the link that brought you to Vueko carried them, the source, medium and campaign it indicated (“utm” parameters), as well as the domain name of the site you came from (never the full address of the page) and the first page viewed. They are read from the page address, without placing anything in your browser, and stored with your account when you create it.
- Abuse prevention: when you create your first workspace, a fingerprint of your IP address (a value computed with a secret key, never the address itself), so that the free credits are granted to no more than three accounts per connection over 24 hours; for a Gmail, Outlook, Hotmail, Live, iCloud, Proton or Fastmail address, its reduced form (without what follows a “+” and, for Gmail, without the dots), so that they are granted only once per mailbox; when you sign in or request a new password, a fingerprint of the IP address and of the e-mail address entered, to limit repeated attempts and to recognise a connection that has already signed in successfully.
- Correspondence with us: your e-mails and our replies.
2.2. If you operate a store or an advertisement analysed by Vueko
Vueko builds a database of online stores and advertisements from public sources: ad libraries published by the platforms (Meta, TikTok) pursuant to the European Digital Services Act, public pages of stores and public web archives. In particular, we collect the store's address and name, the name of the advertiser's page or account, the advertisements run and their public delivery data (reach, countries, age ranges and gender of the audience), as well as the public catalogue.
This data mostly concerns businesses. It may nevertheless concern a natural person, for example where the store is operated by a sole trader or where an advertisement shows a person. Our crawler only visits public pages and complies with robots.txt files (see the VuekoBot page).
3. Why we process it, and on what basis
| Purpose | Legal basis |
|---|---|
| Creating and managing your account, providing the Service, generating and delivering your stores | Performance of the contract |
| Collecting payments, invoicing, keeping accounts | Performance of the contract and legal obligation |
| Sending you the necessary e-mails (address verification, forgotten password, confirmations, information about your subscription) | Performance of the contract |
| Sending you at most three getting-started tips during your first days (you may object via the link in each e-mail or in your workspace Settings) | Legitimate interest |
| Answering your requests and complaints | Performance of the contract or legitimate interest |
| Keeping the Service secure, preventing fraud and abuse | Legitimate interest and legal obligations |
| Measuring use of the Service from our own data, in order to improve it | Legitimate interest |
| Knowing through which channels our customers find us, as weekly statistics | Legitimate interest |
| Building the public database of stores and advertisements (section 2.2) | Legitimate interest: the analysis of online commerce |
| Informing you of our offers, where applicable | Legitimate interest for our customers (you may object at any time), consent in other cases |
We take no automated decision producing legal effects concerning you. We do not sell your data.
4. Who receives your data
Your data is accessible only to us and to the providers who help us deliver the Service, each within the limits of what it needs:
| Provider | Role |
|---|---|
| Railway (United States) | Hosting of the website and the database |
| Cloudflare | Storage of visuals and backups (backups kept in the European Union) |
| Stripe | Payments and invoices |
| Resend | Sending e-mails |
| Anthropic (United States) | Text generation by artificial intelligence |
| fal (United States) | Image generation by artificial intelligence |
| Sign-in with a Google account, if you choose that option | |
| ScrapeCreators | Collection of public data from ad libraries (section 2.2) |
When you connect your Shopify store, we write to it the items you deliver; Shopify then acts as your own provider.
We may also disclose data to the authorities where the law so requires.
5. Transfers outside the European Union
Some providers process data outside the European Union, in particular in the United States, where our hosting provider's servers are located. These transfers are governed by the EU–US Data Privacy Framework where the provider is certified under it, and/or by the standard contractual clauses adopted by the European Commission. You may obtain a copy of them by writing to contact@vueko.app.
6. How long we keep it
| Data | Retention period |
|---|---|
| Account and Service content | For as long as your account exists. After its deletion, erasure within 30 days, except for data the law requires us to keep. An account with no sign-in for 3 years is deleted, after a warning e-mail sent one month beforehand. |
| Origin of the sign-up | For as long as your account exists |
| Invoices and accounting documents | 10 years (legal obligation) |
| Contracts concluded online | 10 years |
| Technical logs (connections, errors) | 12 months at most |
| Fingerprints of the IP address (abuse prevention) | 24 hours at most |
| Correspondence with us | 3 years after the last exchange |
| Shopify access credentials | Until the store is disconnected or the account is deleted |
| Database backups | Rolling 30 days: erased data disappears from the backups no later than 30 days afterwards |
| Public data on stores and advertisements (section 2.2) | For as long as the store is tracked, then 5 years at most for the history; erasure at the merchant's request |
7. Your rights
You have the rights of access, rectification, erasure, restriction, portability and objection, as well as the right to withdraw your consent at any time where processing is based on it. You may also set instructions regarding what happens to your data after your death.
If you operate a store analysed by Vueko, you may object to the processing and obtain the erasure of your store's data by writing to us from an address linked to the domain concerned, as indicated on the VuekoBot page.
To exercise your rights, write to contact@vueko.app. In case of reasonable doubt about your identity, we may ask you for proof of identity. We reply within one month.
If you consider that your rights are not respected, you may lodge a complaint with the CNIL (the French data protection authority): www.cnil.fr, 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07.
8. Cookies
The website only uses cookies that are strictly necessary for it to work: keeping you signed in, form security and remembering your language. They do not require your consent. We use no advertising, audience-measurement or tracking cookies. To know where our customers come from, we read the parameters of the landing page's address: nothing is placed in your browser for this. When you sign up with Google, these parameters accompany the return address that the sign-in cookie keeps for the duration of the round trip.
Stripe's payment page and sign-in with Google are hosted by those providers, which set their own cookies there in accordance with their policies.
Local storage: when you use the logo maker, your draft (name, slogan, settings, logo in progress) is saved in your browser's storage so that it is not lost if you reload the page; the same goes for the logo you take to a new store and, for the duration of the round trip, for the fields of the store creation form. This storage is used only for this service, is not passed on to any third party, and is erased when you sign out or from your browser's settings. Strictly necessary for the service you request, it does not require your consent.
9. Security
We protect your data with appropriate measures: encrypted connections (HTTPS), hashed passwords, encrypted Shopify credentials, restricted access, backups stored in a private space.
10. Minors
The Service is reserved for adults. We do not knowingly collect data concerning minors.
11. Changes
We may update this policy. The date of the last update appears at the top of the page; in the event of a significant change, we notify you by e-mail.