Privacy Policy

1. Who we are

Poruchko is a service for sellers who sell live on TikTok LIVE: it records who bought what, creates orders, prints labels and sends parcels.

For questions about personal data, write to social@poruchko.com.

2. Two roles: when we decide and when the seller does

For the data of sellers and their staff (section 3), Poruchko is the controller.

For the data of a seller's buyers (section 8), the seller is the controller and Poruchko is the processor, acting on the seller's instructions.

3. What we keep about sellers and their staff

• Name, email and phone.
• Password, stored only as a hash, never in plain text.
• Sessions and devices: when and from which device you signed in, so you can sign out other devices and so we can protect the account.
• Shop details: name, country, time zone, settings, courier profiles and invoicing details.
• Answers to the signup questions: how many lives you do, how you record orders, which couriers you use, TikTok profile and phone.
• Messages you send us for help, and notes from conversations with us.
• Technical data: IP address, device and browser type, errors, feature usage.

4. Why we use it and the legal basis

• To provide the service, create your account, issue invoices and help you: performance of a contract.
• For security, preventing abuse, improving the service and measuring how it is used: legitimate interest.
• To send account emails (confirmation, password reset, invitations, payment notices and changes to the terms): performance of a contract and legitimate interest.
• For accounting and tax duties: legal obligation.

We do not sell personal data and we do not use it for automated decisions with legal effect.

5. How long we keep it

• While the account is active.
• After a shop deletion is requested, personal data is erased 30 days later. Orders and amounts stay, anonymised.
• Invoices and accounting records are kept for as long as the law requires.
• Technical logs are kept for a short time and deleted automatically.

6. Your rights

Under the General Data Protection Regulation (GDPR) you have the right to:

• access your data and get a copy;
• have inaccurate data corrected;
• have your data erased;
• receive your data in a machine-readable format (portability);
• object to processing based on legitimate interest;
• restrict processing.

Write to social@poruchko.com and we will answer within one month at the latest. If you think your rights were violated, you can complain to the Bulgarian Commission for Personal Data Protection (КЗЛД), www.cpdp.bg.

7. Who else receives data: processors and sub-processors

We use the following categories of providers. Each receives only the data needed for its task.

• Hosting of the application and database: Fly.io, servers in the EU (Frankfurt).
• File storage (item photos, live video frames, labels): S3-compatible storage.
• Sending email: JetHost, Bulgaria.
• Usage analytics: PostHog (through our own address), in the app and on public pages, and, if enabled, Google Analytics, on public pages only.
• Connection to TikTok LIVE comments: Euler Stream. It receives the username of the seller's TikTok account to connect to their live.
• Notices to us about new signups: Telegram.
• Buyer reliability check by phone number: nekorekten.com, when the seller uses that feature.
• Couriers: Econt. When a parcel is sent, the data needed for delivery is passed on: name, phone, address and cash on delivery amount. Speedy and BOX NOW receive such data only if the seller connects them and sends a parcel through them.

If a provider is outside the EU, we rely on the European Commission's standard contractual clauses or another permitted basis. You can ask for the current list at the email above.

8. Data about a seller's buyers

When a seller enters data about their buyers into Poruchko (names, phones, delivery addresses, TikTok profiles, live comments, item photos, video frames and notes), the seller is the controller and Poruchko is the processor. If you are a buyer who wants to exercise your rights, contact the seller first. If you do not know who that is, write to us and we will point you to them.

How we work as a processor:

• Purpose: we process this data only to provide the service to the seller (orders, labels, delivery, notices) and on their documented instructions. We do not use it for our own purposes and we do not sell it.
• Confidentiality: only authorised people on our side, bound by confidentiality, can access it, and only when needed for support.
• Security: encrypted connections, hashed passwords, separation of each shop's data, access control and role-based permissions.
• Sub-processors: those in section 7. If we add or change a sub-processor that handles buyers' data, we will tell sellers by email and they can object.
• Help with data subject requests: we will help the seller answer requests for access, correction, erasure, portability and objection, and we will forward to them any request we receive.
• Security incidents: we will tell the seller without undue delay after we learn of a breach affecting their data.
• Deletion: when the seller requests deletion of the shop, personal data is erased 30 days later. Orders and amounts stay, anonymised. The seller can also ask for earlier deletion of specific data at any time.
• Audits: we will give the seller the information needed to show that these duties are met.

The seller is responsible for having a lawful basis to process their buyers' data, for informing them, and for using the service lawfully. This is also set out in the Terms of Service.

9. Cookies and local storage

• Sign-in data: after you sign in we keep login tokens in the browser's local storage so you stay signed in. They are required for the service to work and are removed when you sign out.
• Analytics: PostHog and, if enabled, Google Analytics (public pages only) may record visits and actions on the pages so we can see what works. Google Analytics sets cookies.
• Session recordings: during the free trial we record how you move through the app (screens and clicks) to see where it is hard to use and improve it. The recording shows the screen as it is, including buyers' data visible on it. Passwords are never recorded. Recordings are kept for a short time and deleted automatically. Recording stops after the trial.
• We do not use advertising cookies.

You can delete site data in your browser settings at any time.

10. Changes

If we change this policy in a significant way, we will tell you by email before the change takes effect. The date of the last change is at the top.