Privacy Policy

EshopListing / Two Wolves

Last updated: March 23, 2026

---

## 1. Who We Are

EshopListing ("EshopListing", "we", "us", "our") is an AI commerce infrastructure platform that helps e-commerce merchants make their product catalogs readable by AI assistants such as ChatGPT, Gemini, Claude, and Perplexity.

Company: Tai aktualu, UAB

Registered in: Lithuania, European Union

Contact: hq@taiaktualu.org

Website: https://taiaktualu.org

As a company registered in the European Union, we act as a data controller under GDPR (Regulation (EU) 2016/679) with respect to the personal data of our users.

---

## 2. Scope of This Policy

This Privacy Policy applies to:

- Visitors to eshoplisting.com

- Merchants who create an account and use our service

- Users who scan a store domain using our free scan tool

This policy does not apply to third-party websites linked from our service.

---

## 3. Data We Collect

### 3.1 Account Data

When you register, we collect:

- Email address

- Name (if provided via Google OAuth)

- Authentication method (Google OAuth or email/password)

- Account creation date and subscription status

### 3.2 Store & Product Data

When you connect a store, we collect:

- Domain name(s) you submit

- Publicly accessible product data: titles, prices, availability, images, descriptions, URLs

- Scan history and results (AI score, detected issues)

- AI agent interaction logs (how many times AI assistants accessed your store data via our endpoints)

We only access publicly available pages on your store. We do not access password-protected areas, admin panels, or any data not visible to a regular website visitor.

### 3.3 Payment Data

Payment processing is handled entirely by Stripe. We receive only:

- Subscription status (active, cancelled, past due)

- Plan tier

- Last 4 digits of the payment card (from Stripe, for display purposes only)

- Billing country

We never store, see, or process full card numbers, CVV codes, or bank account numbers.

### 3.4 Usage & Technical Data

We automatically collect:

- IP address (anonymized for analytics)

- Browser type and version

- Operating system

- Pages visited and time spent

- API request logs (endpoint, timestamp, response code — no request bodies)

- Referrer URL

### 3.5 Communications Data

If you contact us by email or support form:

- Email address and message content

- Any attachments you send

### 3.6 Blockchain Data

For Business and Protocol Scale subscribers:

- Your store domain, verification timestamp, and trust score are permanently written to the Solana blockchain as a compressed NFT. No personal information (name, email, address) is written to the blockchain. This is publicly visible by design and cannot be deleted.

---

## 4. Legal Basis for Processing (GDPR Article 6)

| Processing Activity | Legal Basis |

|---------------------|-------------|

| Creating and managing your account | Article 6(1)(b) — Performance of contract |

| Providing the AI indexing service | Article 6(1)(b) — Performance of contract |

| Processing payments via Stripe | Article 6(1)(b) — Performance of contract |

| Sending transactional emails (scan results, invoices) | Article 6(1)(b) — Performance of contract |

| Security monitoring and fraud prevention | Article 6(1)(f) — Legitimate interests |

| Aggregated analytics to improve the service | Article 6(1)(f) — Legitimate interests |

| Sending product update and marketing emails | Article 6(1)(a) — Consent (opt-in at signup) |

| Legal compliance and record-keeping | Article 6(1)(c) — Legal obligation |

---

## 5. How We Use Your Data

We use your data to:

- Provide, operate, and improve the EshopListing service

- Scan your store and generate AI-readable product files

- Distribute your product data to AI platforms through standardized protocols

- Send you scan results, service notifications, invoices, and (if consented) product updates

- Detect and prevent fraud, abuse, and security incidents

- Comply with legal obligations

- Aggregate anonymous usage statistics to improve the product

We do not sell your personal data to any third party. We do not use your data for advertising targeting on other platforms.

---

## 6. Data Sharing & Third-Party Processors

We engage the following sub-processors to deliver the service. All are bound by data processing agreements:

|--------------|---------|----------|---------------|

We will notify you of any material changes to our sub-processor list.

We may disclose your data to law enforcement or regulatory authorities if required by applicable law, court order, or to protect the safety of our users or the public.

---

## 7. International Data Transfers

Our primary data storage is in the EU West (Ireland) region. Some sub-processors (notably Stripe and Google) are US-based.

For these transfers, we rely on Standard Contractual Clauses (SCCs) approved by the European Commission under Article 46 GDPR, supplemented by transfer impact assessments where required. You may request a copy of the applicable SCCs by contacting us at hello@eshoplisting.com.

---

## 8. Cookies & Tracking

We use the following categories of cookies:

### Strictly Necessary (no consent required)

- Authentication session cookie — keeps you logged in during your session. Duration: session.

- CSRF protection cookie — prevents cross-site request forgery attacks. Duration: session.

### Analytics (requires consent)

- Google Analytics 4 — anonymized page view and session analytics. IP addresses are anonymized before storage. Duration: up to 2 years.

We do not use advertising cookies, retargeting pixels, or third-party tracking cookies for marketing purposes.

You can manage cookie preferences via the cookie banner displayed on your first visit, or by adjusting your browser settings. Disabling analytics cookies does not affect the functionality of the service.

---

## 9. Data Retention

| Data Type | Retention Period |

|-----------|-----------------|

| Account data | Duration of account + 30 days after deletion |

| Product & scan data | Duration of subscription + 30 days after cancellation |

| Payment records | 7 years (legal/accounting obligation) |

| API request logs | 90 days |

| Support correspondence | 3 years from last interaction |

| Anonymized analytics | Up to 26 months (Google Analytics default) |

| Blockchain records | Permanent (by design — cannot be deleted) |

After the applicable retention period, data is securely deleted or anonymized.

---

## 10. Your Rights Under GDPR

As a data subject in the European Union (or the UK under UK GDPR), you have the following rights:

| Right | Description |

|-------|-------------|

| Access | Request a copy of the personal data we hold about you |

| Rectification | Request correction of inaccurate or incomplete data |

| Erasure ("right to be forgotten") | Request deletion of your personal data, subject to legal retention obligations |

| Data Portability | Receive your data in a machine-readable format (JSON/CSV) |

| Restriction | Request that we restrict processing of your data in certain circumstances |

| Objection | Object to processing based on legitimate interests |

| Withdraw Consent | Withdraw marketing consent at any time without affecting prior lawful processing |

To exercise any of these rights, contact us at: hello@eshoplisting.com

We will respond within 30 days. If the request is complex, we may extend this by an additional 60 days with notice.

We will not charge a fee for exercising your rights unless requests are manifestly unfounded or excessive.

Note on blockchain data: Data written to the Solana blockchain (store domain, trust score) is permanent by design and cannot be deleted or modified. This data contains no personal information and is publicly visible. Please consider this before subscribing to plans that include blockchain verification.

---

## 11. Children's Privacy

EshopListing is not directed at children under 16 years of age. We do not knowingly collect personal data from children. If you believe we have inadvertently collected data from a child, please contact us immediately at hello@eshoplisting.com and we will delete it promptly.

---

## 12. California Privacy Rights (CCPA/CPRA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA):

- Right to Know — what personal information we collect, use, disclose, and sell

- Right to Delete — request deletion of your personal information

- Right to Correct — request correction of inaccurate personal information

- Right to Opt-Out of Sale — we do not sell personal information

- Right to Non-Discrimination — we will not discriminate against you for exercising your rights

To exercise California privacy rights, contact us at: hello@eshoplisting.com

We do not sell California residents' personal information and have not done so in the preceding 12 months.

---

## 13. Data Breach Notification

In the event of a personal data breach that is likely to result in risk to your rights and freedoms, we will:

- Notify the Lithuanian State Data Protection Inspectorate (VDAI) within 72 hours of discovery (GDPR Article 33)

- Notify affected individuals without undue delay when there is a high risk to their rights and freedoms (GDPR Article 34)

- Provide notification by email to the address associated with your account

---

## 14. Changes to This Policy

We will notify you of material changes to this Privacy Policy by:

- Sending an email to the address associated with your account

- Displaying a prominent notice on the website

- Updating the "Last updated" date at the top of this page

Continued use of the service after the effective date of changes constitutes acceptance of the updated policy.

---

## 15. Contact & Supervisory Authority

For privacy questions or to exercise your rights:

hello@eshoplisting.com

For data protection concerns:

hello@eshoplisting.com (subject: Data Protection Request)

Supervisory Authority (Lithuania):

State Data Protection Inspectorate (Valstybinė duomenų apsaugos inspekcija)

A. Juozapavičiaus g. 6, LT-09310 Vilnius, Lithuania

ada@ada.lt | [vdai.lrv.lt](https://vdai.lrv.lt)

You have the right to lodge a complaint with the supervisory authority at any time, though we encourage you to contact us directly first so we can resolve your concern.