Privacy Policy

1. Who we are

DARUYU is operated by Hrihorii Illiashenko, a sole proprietor (FOP) registered in Ukraine ("DARUYU", "we", "us"). We are the controller of the personal data described in this policy.

You can reach us about anything in this policy at [email protected].

2. Scope

This policy covers the DARUYU website (daruyu.com), our early-access program, and emails we exchange with you. When the DARUYU Shopify app launches, data processed inside merchants' stores will be handled under a separate app privacy policy and data processing terms.

3. Data we collect

We collect only what we need to run the website and the early-access program:

• Early-access form: your work email, Shopify store URL, monthly order volume, how you currently handle gifting, and any optional answers you give (for example, the plan you are interested in).
• Correspondence: the content of emails you send us and details of calls you book with us.
• Usage data: pages visited, clicks, referring website, campaign parameters (UTM), browser and device type, and approximate location derived from your IP address.
• Cookies and similar technologies, as described in the Cookies section below.

We do not ask for and do not want sensitive data (such as health, political, or financial account data) through this website.

4. How we use your data and our legal bases

• To respond to your early-access request, contact you about DARUYU, and onboard your store — based on steps you asked us to take before entering into a contract, and our legitimate interest in running the program.
• To send product updates about DARUYU — based on your consent or our legitimate interest in keeping early-access applicants informed. Every email includes a way to unsubscribe.
• To understand how the website is used and improve it — based on your consent where required by law, otherwise our legitimate interest.
• To keep the website secure and prevent spam and abuse — based on our legitimate interest.
• To comply with legal obligations, such as tax and accounting rules.

We do not sell your personal data and do not use it for automated decisions that have legal or similarly significant effects on you.

5. Service providers

We share personal data only with providers that help us operate DARUYU, under contracts that require them to protect it. These may include:

• Website hosting and infrastructure (for example, Vercel).
• Email and marketing automation (for example, Bento) and transactional email delivery (for example, Mailgun).
• Product analytics (for example, PostHog).
• Business email and productivity tools (for example, Google Workspace).
• Internal notifications about new requests (for example, Telegram).
• Scheduling tools used to book calls with us.

We may also disclose data if required by law, to protect our rights, or as part of a sale or reorganisation of the business.

6. International transfers

Some of our providers process data outside Ukraine and the European Economic Area, including in the United States. Where required, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses.

7. How long we keep data

• Early-access and correspondence data: for up to 24 months after our last contact with you, or until you ask us to delete it.
• Analytics data: for up to 12 months, in aggregated or pseudonymised form where possible.
• Records we must keep by law: for as long as the law requires.

8. Your rights

Depending on where you live, including under the GDPR, you may have the right to:

• Access the personal data we hold about you and receive a copy.
• Correct inaccurate data or have your data deleted.
• Restrict or object to our processing, including for direct marketing.
• Receive your data in a portable format.
• Withdraw consent at any time, without affecting processing that already happened.
• Lodge a complaint with your local data protection authority.

To exercise any of these rights, email [email protected]. We will reply within 30 days.

9. Cookies

We use strictly necessary cookies and local storage to make the website work, for example to remember your language. With your consent where required, we use analytics cookies to understand how visitors use the site. You can block or delete cookies in your browser settings; the website will still work without analytics cookies.

10. Security

We use reasonable technical and organisational measures to protect your data, including encrypted connections (HTTPS), access controls, and reputable providers. No method of transmission or storage is completely secure, but we work to protect your data and will notify you and the authorities of a breach where the law requires.

11. Children

DARUYU is a business service for Shopify merchants. It is not directed at children under 16, and we do not knowingly collect their data.

12. Changes to this policy

We may update this policy as DARUYU evolves. We will post the new version on this page with a new "Last updated" date and, for material changes, let early-access applicants know by email.