Privacy & Cookie Policy

Vittorious is operated by:

Oleh Artemovych Savytskyi, individual entrepreneur (FOP)
Trading name: Vittorious
Ukrainian tax identification number: 2574105050
103 Sichovykh Striltsiv Street, Apt. 25
Kyiv, 04050
Ukraine
Email: [email protected]

In this Policy, “Vittorious,” “we,” “us,” and “our” refer to the operator identified above.

This Policy applies to personal information processed in connection with:

• the public Vittorious website;
• the Vittorious Shopify application and authenticated Vittorious interfaces;
• product audits, recommendations, publishing, and rollback functionality;
• subscriptions and billing administration;
• customer support and live chat;
• security, diagnostics, and service operations;
• our business communications and marketing activities.

Shopify and other third-party services may also process information independently under their own privacy policies and contractual terms.

3.1 Vittorious as a processor or service provider

A Shopify merchant generally acts as the controller, business, or equivalent party responsible for personal data contained in information that the merchant provides to Vittorious through its Shopify catalog, product content, merchant settings, product facts, instructions, or other use of the service.

Vittorious acts as a processor, service provider, or contractor when it processes such Merchant Personal Data on the merchant's behalf to:

• synchronize and analyze the merchant's product catalog;
• perform product, content, market, and Technical SEO audits;
• identify gaps and opportunities;
• generate recommendations and draft content;
• process merchant-provided product facts and answers;
• publish merchant-approved changes;
• maintain publishing history and rollback functionality;
• provide other functionality requested by the merchant.

This processing is governed by the merchant's documented instructions, our applicable agreement, and the Vittorious Data Processing Agreement (“DPA”) where applicable.

3.2 Vittorious as an independent controller

Vittorious acts as an independent controller for personal information processed for its own legitimate business purposes, including:

• establishing and administering the contractual relationship with merchants;
• communicating with merchant representatives and prospective customers;
• operating accounts, subscriptions, and billing;
• providing and documenting support;
• maintaining security, fraud-prevention, and technical records;
• handling privacy requests and legal obligations;
• operating, measuring, and marketing the public Vittorious website.

When a support communication contains personal data about a merchant's customer or another third party, we treat that embedded Merchant Personal Data as processor data where appropriate, while we may act as controller for the business contact details and correspondence needed to provide and administer support.

Vittorious follows a data-minimization approach. The Shopify application requests only the Shopify Admin API permissions required for its current core functionality:

• read_products;
• write_products.

Vittorious does not request Shopify customer or order scopes as part of its core functionality and does not import merchant customer lists or orders.

Through the Shopify API, Vittorious may process:

• Shopify product IDs;
• product title, handle, status, vendor, product type, and tags;
• HTML product descriptions;
• SEO title and SEO description;
• product-page URLs;
• product image URLs and alt text;
• collections associated with products;
• variants, SKU, barcode, price, compare-at price, and inventory policy;
• product modification timestamps;
• shop identifiers and domains;
• application installation, subscription, plan, and usage information.

Vittorious uses offline Shopify sessions for its core application connection and does not intentionally use Shopify online sessions to collect identity information about individual Shopify staff users.

Although ordinary Shopify product data is not Shopify Protected Customer Data, product descriptions, images, metafields, and merchant-supplied content may incidentally contain names or other information relating to identifiable individuals. We therefore treat merchant-provided catalog content as potentially containing personal data.

5.1 Market and audit configuration

We may process market settings selected by the merchant, including:

• country;
• language;
• device type;
• optional city or region.

These values ordinarily describe the market that the merchant wants Vittorious to analyze and do not necessarily represent the merchant's physical location.

5.2 Merchant preferences and product facts

We may process:

• brand voice and writing preferences;
• preferred reading level;
• words or expressions to avoid;
• example copy;
• description templates;
• merchant-provided product facts;
• merchant responses to requests for missing product information.

5.3 Search and Shopping evidence

To perform Evidence-backed Runs and related analysis, Vittorious may process information obtained through search-data providers and public webpages, including:

• search queries and selected market parameters;
• Google Search and Shopping results;
• URLs, titles, snippets, and merchant names;
• prices, currencies, and availability information;
• structured data and product specifications;
• headings and publicly displayed product content;
• other evidence relevant to the requested audit.

Public webpages may occasionally contain information relating to identifiable individuals. Vittorious does not collect such information for the purpose of profiling those individuals.

5.4 Audit, recommendation, and publishing data

We may create and store:

• audit results and product or catalog scores;
• identified gaps and technical findings;
• evidence records;
• recommendations and AI-generated drafts;
• conflicts and missing-information flags;
• merchant review, approval, and rejection statuses;
• affected Shopify product and field;
• previous and approved replacement values;
• publishing timestamps and rollback information.

Vittorious does not publish supported product-content changes to Shopify until the merchant explicitly approves them.

5.5 Operational and technical information

We may process:

• subscription plan and usage;
• provider costs and processing status;
• job status and timestamps;
• application and API errors;
• IP addresses and request metadata;
• security and abuse-prevention information;
• pseudonymized technical fingerprints;
• records used to prevent duplicate billing or duplicate processing.

5.6 Website and browser information

When you use our public website, we may process:

• IP address;
• browser, device, and operating-system information;
• requested pages and referring pages;
• timestamps;
• campaign and attribution parameters;
• website interactions;
• cookie and privacy preferences;
• security signals.

5.7 Local application preferences

The Vittorious application may store limited non-personal interface preferences in browser storage, such as sidebar display state. These preferences are not used for advertising or cross-site tracking.

5.8 Support and live chat

If you contact Vittorious, we may process:

• your name and work email address;
• company or store information;
• message content;
• attachments and screenshots;
• technical information you voluntarily provide;
• support history.

Vittorious uses a self-hosted support configuration so that ordinary live-chat conversations, users, messages, and attachments are stored within infrastructure controlled by Vittorious rather than hosted by the Support Board software vendor. If an optional support integration causes support content to be transmitted to another provider, that provider will be disclosed where required before such integration is used for production data.

Where Vittorious acts as a controller and the GDPR or UK GDPR applies, we rely on one or more appropriate legal bases depending on the processing activity.

Where Vittorious acts as a processor, the merchant determines the applicable legal basis for its processing and instructs Vittorious in accordance with the applicable agreement and DPA.

Where processing is based on consent, you may withdraw that consent at any time. Withdrawal does not affect processing lawfully carried out before consent was withdrawn.

Vittorious uses artificial-intelligence and machine-learning services to assist with functions such as:

• product-content analysis;
• evidence interpretation and classification;
• gap detection;
• recommendation generation;
• creation of product-copy drafts.

Only information reasonably necessary for the requested operation is provided to AI services. Depending on the feature, this may include permitted product facts, relevant product content, the field being analyzed, relevant evidence, locale, merchant-approved writing preferences, and technical instructions generated by Vittorious.

Vittorious:

• does not train its own general-purpose AI models on Merchant Data;
• does not intentionally permit Merchant Data to be used to train third-party general-purpose AI models;
• does not sell Merchant Data to AI providers;
• does not provide merchant customer or order databases to AI providers as part of the core service;
• minimizes information included in AI requests;
• uses commercial/API configurations and privacy controls intended to prevent model-training use of Merchant Data;
• uses Merchant Data for AI processing only to provide, evaluate, secure, or improve the requested Vittorious service for the relevant merchant, subject to our contractual obligations.

Vittorious does not use the AI functionality described in this section to make decisions about natural persons that produce legal effects or similarly significant effects.

Vittorious maintains a strict separation between Merchant Data and advertising data.

We do not use the following for targeted or cross-context behavioral advertising:

• Shopify catalog data;
• Merchant Personal Data;
• audits or recommendations;
• product drafts;
• merchant settings;
• publishing history;
• support-message content.

Advertising, conversion-measurement, and retargeting technologies may be used only on publicly accessible marketing pages of vittorious.app, such as the homepage, pricing pages, feature pages, industry pages, public articles, and campaign landing pages.

Advertising pixels and retargeting technologies are not loaded in the authenticated Vittorious application, the Shopify embedded application, administrative or support back-office interfaces, or pages that display Merchant Data.

We may use cookies, local storage, tags, scripts, pixels, software development libraries, and similar technologies.

9.1 Strictly necessary technologies

Strictly necessary technologies may be used to:

• deliver the website or application;
• authenticate users and maintain sessions;
• remember privacy choices;
• protect accounts, forms, and infrastructure;
• prevent fraud and abuse;
• provide functionality expressly requested by the user.

These technologies may operate without optional consent where permitted by applicable law.

9.2 Functional technologies

Functional technologies may remember optional preferences or enable requested features, such as certain live-chat functionality. Where applicable law requires consent for a particular technology, it will not be enabled before the required choice is made.

9.3 Analytics

We may use analytics to understand:

• website traffic and page performance;
• navigation patterns;
• campaign effectiveness;
• conversion events;
• technical problems and website reliability.

Where prior consent is required, optional analytics technologies remain disabled until the user provides the required consent.

9.4 Advertising, conversion measurement, and retargeting

Public marketing pages may use third-party advertising technologies. Depending on configuration and applicable law, these technologies may process online identifiers, cookie or device identifiers, IP-derived information, pages visited, referring pages, campaign parameters, conversion events, and interaction information.

Such disclosures may constitute targeted advertising, cross-context behavioral advertising, “sharing,” or, under some U.S. privacy laws, a “sale” of personal information even where no money is paid for the information.

The current technologies, providers, purposes, categories, and durations are made available through our Cookie Settings or Your Privacy Choices controls.

9.5 EEA and UK users

For users in the EEA and United Kingdom, advertising cookies, advertising pixels, and other non-essential storage or access technologies requiring consent remain disabled until the user provides valid consent.

Our consent controls allow users to accept optional technologies, reject optional technologies, or manage their choices by category. Optional categories are not enabled by default where prior consent is required. Refusing optional analytics or advertising does not prevent access to the core public website or Vittorious service.

Consent may be changed or withdrawn through Cookie Settings.

9.6 United States privacy choices

Where applicable U.S. privacy law provides a right to opt out of sale, sharing, or targeted advertising, users may exercise that right through Your Privacy Choices.

Where legally required, Vittorious also recognizes qualifying browser-based universal opt-out mechanisms, including Global Privacy Control (“GPC”).

A qualifying GPC signal will be treated as an opt-out of applicable sale, sharing, and targeted-advertising processing for the browser or device from which the signal is received and, where legally required and technically appropriate, for an associated account.

9.7 Do Not Track

Some browsers transmit a legacy “Do Not Track” signal. Because no universally accepted standard governs that signal, Vittorious does not currently interpret the legacy Do Not Track header as a separate privacy instruction. We do honor qualifying legally recognized universal opt-out mechanisms where required.

Depending on the processing activity, information may originate from:

• you directly;
• your employer or business;
• a Shopify merchant;
• Shopify APIs;
• your browser or device;
• Vittorious systems;
• support communications;
• service providers;
• publicly accessible webpages;
• public search and Shopping results.

We disclose information only where reasonably necessary to provide, secure, administer, measure, or market Vittorious, or where required or permitted by law.

11.1 Shopify

Shopify provides the merchant platform, application installation infrastructure, authentication mechanisms, APIs, Shopify Admin integration, and billing functionality. Shopify also processes information under its own relationship with the merchant.

11.2 Hosting and infrastructure providers

Approved hosting and infrastructure providers may process application data, databases, caches, analytics stores, backups, network traffic, and server logs as necessary to operate the service.

11.3 Cloudflare

Cloudflare may provide DNS, CDN and reverse-proxy services, network security, bot and abuse prevention, traffic management, technical analytics, and email-routing functionality.

11.4 Search-data providers

Vittorious may use DataForSEO and Serper.dev, including as primary or fallback search-data providers. These providers receive information necessary to perform the requested search, such as a query, country, language, device type, and optional search location.

11.5 AI providers

Depending on configuration and availability, Vittorious may use AI services supplied by OpenAI, OpenRouter, Anthropic, and other providers identified in the current Subprocessor List. AI requests are subject to the restrictions described in Section 7.

11.6 Support infrastructure

Support communications may be processed through Vittorious-controlled, self-hosted support infrastructure and, where applicable, approved email, delivery, storage, or communication providers disclosed in the current Subprocessor List.

11.7 Advertising and analytics providers

Advertising and optional analytics providers used on public marketing pages are identified through Cookie Settings or Your Privacy Choices. These providers do not receive Shopify catalog data, audits, recommendations, product drafts, merchant settings, publishing history, or authenticated application content from Vittorious for advertising.

11.8 Professional advisers and authorities

We may disclose information to legal advisers, accountants, auditors, insurers, government bodies, courts, regulators, or law-enforcement authorities where reasonably necessary and permitted or required by law.

11.9 Business transactions

If Vittorious is involved in a merger, acquisition, financing, reorganization, transfer of business, or sale of assets, information may be disclosed as reasonably necessary for that transaction, subject to appropriate confidentiality and privacy safeguards.

Where Vittorious processes Merchant Personal Data as a processor, we maintain a current list of material subprocessors used for that processing.

The list identifies, as applicable:

• the provider;
• the service or purpose;
• relevant categories of data;
• processing locations;
• applicable international-transfer safeguards.

The current list is available at https://vittorious.app/subprocessors.

Where required by the applicable DPA, we provide notice of intended additions or replacements of subprocessors and a reasonable opportunity to raise a data-protection objection.

Vittorious is established in Ukraine.

Information may be processed in Ukraine, the European Economic Area, the United Kingdom, the United States, and other countries in which approved service providers operate.

Where GDPR Chapter V, UK GDPR transfer rules, or other applicable law requires safeguards for an international transfer, Vittorious uses an appropriate lawful transfer mechanism. Depending on the circumstances, this may include:

• the European Commission's Standard Contractual Clauses (“SCCs”);
• the UK International Data Transfer Addendum or International Data Transfer Agreement;
• an applicable adequacy decision or recognized transfer framework;
• supplementary contractual, organizational, or technical safeguards;
• another transfer mechanism permitted by applicable law.

Where Vittorious acts as a processor, applicable international-transfer provisions may also be incorporated into the DPA.

We retain personal information only for as long as reasonably necessary for the relevant purpose and apply the following retention periods and limits.

Information may be retained longer where required by law, necessary to establish, exercise, or defend legal claims, necessary to investigate fraud or security incidents, or subject to a documented legal hold.

Data that has been irreversibly aggregated or de-identified so that it no longer constitutes personal data may be retained for longer.

14.1 Backups

Data deleted from active production systems may remain temporarily in encrypted, access-restricted backups until the applicable backup expires. Backups are not used for ordinary application processing. If a backup is restored for disaster recovery, applicable deletion records are re-applied so that previously deleted Merchant Personal Data is not unintentionally restored for ongoing use.

Vittorious supports Shopify's mandatory privacy-compliance process, including Shopify's required privacy webhook topics for customer data requests, customer redaction, and shop redaction.

Vittorious does not request Shopify customer or order scopes for its core functionality. Nevertheless, when we receive a valid Shopify privacy request that applies to data processed by Vittorious, we identify relevant records and perform the required access, deletion, or de-identification action within the applicable period, subject to lawful retention exceptions.

Privacy requests may be submitted to [email protected].

Depending on applicable law, you may have rights to:

• request access to personal information;
• request correction of inaccurate information;
• request deletion;
• request restriction of processing;
• object to certain processing;
• receive certain information in portable form;
• withdraw consent where processing is based on consent;
• object to direct marketing;
• opt out of sale, sharing, or targeted advertising where applicable;
• exercise rights concerning qualifying automated decision-making;
• appeal certain privacy-request decisions where applicable;
• complain to an applicable data-protection authority.

We may request information reasonably necessary to verify identity or authority and to prevent unauthorized access, disclosure, modification, or deletion.

Where Vittorious holds the relevant personal information solely as a processor for a Shopify merchant, we may refer the request to that merchant and provide reasonable assistance to the merchant in responding.

This section applies to the extent that a U.S. state privacy law applies to Vittorious and to the processing concerned.

17.1 Categories of personal information

17.2 Sale, sharing, and targeted advertising

Vittorious does not sell Shopify Merchant Data or catalog information. Vittorious does not sell personal information for cash.

However, third-party advertising technologies on public marketing pages may involve disclosures that applicable law defines as “sharing,” targeted advertising, cross-context behavioral advertising, or, under some laws, a “sale.”

Where a statutory opt-out right applies, you may exercise it through Your Privacy Choices or a qualifying universal opt-out mechanism.

17.3 Categories that may be disclosed for advertising

Advertising processing on public marketing pages may involve:

• online identifiers;
• IP-derived information;
• Internet or network activity;
• website interaction data;
• campaign information;
• approximate location;
• related advertising inferences.

Vittorious does not provide Shopify catalog data, audits, recommendations, merchant settings, product drafts, publishing history, or authenticated Vittorious application content to advertising providers for advertising purposes.

17.4 Global Privacy Control

Where applicable law requires it, Vittorious honors Global Privacy Control and other legally recognized universal opt-out mechanisms as requests to opt out of applicable sale, sharing, or targeted-advertising processing.

17.5 Additional state rights

Depending on your state and whether the applicable law covers Vittorious, you may have rights to access, correct, delete, or obtain a portable copy of certain personal information; opt out of certain sale, sharing, targeted advertising, or qualifying profiling; limit certain uses of sensitive personal information; appeal a decision; and exercise rights without unlawful discrimination.

17.6 Authorized agents

Where permitted by applicable law, an authorized agent may submit a privacy request on your behalf. We may request reasonable evidence of the agent's authority and, where permitted, verify the request directly with you.

17.7 Appeals

Where applicable state law gives you a right to appeal a privacy-request decision, you may send an appeal to [email protected] and identify the request as a “Privacy Request Appeal.”

17.8 Sensitive personal information and financial incentives

Vittorious is not designed to use sensitive personal information to infer characteristics about individuals for targeted advertising.

Vittorious does not currently offer financial incentives or materially different service pricing in exchange for permission to sell or share an individual's personal information.

17.9 California notice at collection

At or before the point where personal information is collected through the public website, Vittorious provides access to this Policy and, where applicable, Your Privacy Choices. The principal categories collected, purposes, recipients, retention periods, and advertising disclosures are described in Sections 5, 6, 9, 11, 14, and 17 of this Policy.

Where the GDPR applies, individuals may have the right, subject to applicable conditions and exceptions, to:

• obtain confirmation of processing and access personal data;
• request correction of inaccurate or incomplete data;
• request erasure;
• request restriction of processing;
• receive certain data in a structured, commonly used, machine-readable format;
• object to processing based on legitimate interests;
• object at any time to direct marketing;
• withdraw consent where processing is based on consent;
• exercise applicable rights concerning qualifying automated decision-making;
• lodge a complaint with a competent supervisory authority.

We normally respond to qualifying GDPR requests within one month, subject to legally permitted extensions.

Vittorious does not use the processing described in this Policy to make solely automated decisions about individuals that produce legal or similarly significant effects.

EEA privacy requests can be submitted directly to [email protected].

Where the UK GDPR applies, individuals may have rights substantially corresponding to the access, correction, deletion, restriction, portability, objection, consent-withdrawal, and automated-decision rights described above.

Individuals may also have the right to complain to the UK Information Commissioner's Office.

UK privacy requests can be submitted directly to [email protected].

Vittorious maintains reasonable and appropriate technical and organizational measures designed to protect information against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or unauthorized access.

These measures include, as applicable:

• encryption of data in transit;
• encryption of production data and backups at rest;
• access controls and least-privilege principles;
• multi-factor authentication for privileged administrative access;
• restricted access to production systems;
• secure management of API credentials and Shopify tokens;
• separation of production and development environments;
• controls against using unsanitized production Merchant Personal Data in development;
• logging and monitoring;
• dependency and vulnerability management;
• backup and recovery procedures;
• incident-response procedures;
• confidentiality obligations and appropriate vendor safeguards.

No Internet-based service can guarantee absolute security.

Vittorious maintains procedures for investigating suspected security incidents.

Where Vittorious acts as a processor and becomes aware of a personal-data breach involving Merchant Personal Data, we notify the affected merchant without undue delay as required by the applicable DPA and law.

Where Vittorious acts as a controller, we notify affected individuals and competent authorities where applicable law requires notification.

Vittorious is a business-oriented service intended for adults acting on behalf of businesses and is not directed to children.

We do not knowingly collect personal information from children for targeted advertising and do not knowingly sell or share the personal information of individuals under 16.

We may send communications to existing and prospective business contacts where permitted by applicable law.

Marketing communications include an appropriate unsubscribe mechanism. An unsubscribe does not prevent us from sending communications necessary for account administration, security, billing, contractual notices, or requested support.

We do not use Shopify Merchant Data or merchant-customer information to build advertising audiences.

Vittorious may contain links to Shopify stores, product pages, search results, documentation, social networks, and other third-party websites or services. Those third parties may independently process information under their own privacy policies. We are not responsible for their independent privacy practices.

We may update this Policy when our services, providers, processing practices, or applicable legal requirements change.

The current version will display its latest revision date. If a material change substantially affects how previously collected personal information is used, we will provide additional notice and obtain consent where required by applicable law.

Where Vittorious processes Merchant Personal Data on behalf of a merchant, the Vittorious Data Processing Agreement addresses applicable processor obligations, including documented instructions, confidentiality, security, subprocessors, data-subject requests, personal-data breaches, international transfers, audit rights, and return or deletion of Merchant Personal Data.

The current DPA is available at https://vittorious.app/dpa.

Questions, privacy requests, and data-protection concerns may be sent to:

Oleh Artemovych Savytskyi, individual entrepreneur (FOP)
Vittorious
103 Sichovykh Striltsiv Street, Apt. 25
Kyiv, 04050
Ukraine
Email: [email protected]