Privacy Policy

Effective Date: 06.08.26 · Version 2.3

1. Introduction

Vighnahara BV (“we,” “us,” or “our”) operates a SaaS platform named GoGotama designed to provide Business Intelligence (BI) for E-commerce business owners. We are committed to protecting the privacy and security of your business data. This Privacy Policy explains how we collect, use, secure, and delete data when you use our services.

We operate in strict compliance with the General Data Protection Regulation (GDPR) and strictly adhere to the principles of data minimization and security.

2. Who is Responsible?

Vighnahara BV: Pietersbergweg 474, 1105BM, Amsterdam, The Netherlands
Chamber of Commerce (KvK): 69967717
Contact: sakya@vighnahara.nl

3. Data We Collect

We collect data primarily to generate automated business intelligence. We distinguish between your account data (Customer Data) and the data we process from your connected platforms (Platform Data).

A. Customer Data (Your Account)

To manage your account and subscription, we collect:

  • Name and Contact details (Email, Phone).
  • Business details (Company Name, CoC Number, Tax Number).
  • Login credentials (passwords are hashed and stored in the Supabase Vault; we never see plain-text passwords).
  • Billing information (processed via the Shopify App Store).

B. Platform Data (Connected Tools)

We integrate with third-party platforms via Nango to aggregate business metrics. We process data from:

  • E-commerce: Shopify
  • Marketing: Meta (Facebook/Instagram Ads), Google Ads

Specific Data Points Processed:

  • Orders: Order IDs, values, timestamps, and status.
  • Campaigns: Spend, impressions, clicks, and conversion metrics.
  • Shipping: Per-order shipping costs and surcharges, used to identify order-level fulfillment costs and to learn merchant-specific shipping rates that we apply when individual order shipping data is missing.
  • Transactions: Payment status and transaction fees.

Important on End-Customer PII: We do not collect or store direct identifiers (such as consumer names, exact street addresses, or phone numbers) for marketing purposes. However, to accurately calculate fulfillment costs and margins, we do process high-level geographic order data (country, region, and postal code). We do not sell, share, or use this location data for marketing or communication.

4. How We Use Your Data

We use your data solely for the following purposes:

  • Service Provision: To aggregate data and present business intelligence dashboards.
  • Performance Analysis: To calculate daily metrics (e.g., ROAS, AOV, delivery times).
  • Security: To detect and prevent fraud or unauthorized access.

We do not sell, rent, or trade your data to any third parties. This commitment is absolute and permanent.

It is not qualified by the merchant-directed disclosures described in Section 7.2. Those occur only where you explicitly instruct us, only to a recipient you name, and only in respect of your own business records — never your end-customers' personal data. Acting on your instruction to share your own data with a party you choose is not a sale.

Google API Limited Use Disclosure

GoGotama's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

5. Technical Architecture & Security

We employ state-of-the-art security measures to ensure the confidentiality, integrity, and availability of your data.

  • Data Integration (Nango): We use Nango as our secure OAuth connectivity provider. Nango manages the authentication tokens for your platforms (Shopify, Meta, Google, etc.).
  • Data Processing (Railway): Data transformation and aggregation logic are executed via Python scripts hosted on Railway. Data is processed in ephemeral environments.
  • Data Storage (Supabase): All processed data is stored in Supabase.
  • Data Residency: All customer and platform data processed by the Service is stored on infrastructure located in the United States. Where any transfer of personal data across borders occurs in the course of operating the Service, we rely on the safeguards required by applicable law, as reflected in the Data Processing Agreements with our sub-processors (see Section 7).
  • Encryption: Data is encrypted at rest (AES-256) and in transit (SSL/TLS).
  • Access Control: We utilize Row Level Security (RLS) and Role-Based Access Control (RBAC) to ensure you can only access your own data.
  • Vault: Sensitive secrets and keys are stored in the Supabase Vault.
  • Zero AI Training Policy: We strictly do not use Customer Data, Meta Platform Data, or Google Ads API Data to train, retrain, or improve foundational AI or machine learning models (including our LLM provider, Gemini).

6. Data Retention

We adhere to a strict retention policy to minimize data liability.

  • Historical Data: Granular data regarding specific orders, transactions, campaigns, and shipments is retained for no longer than 12 months.
  • Merchant-Elected Retention: The one exception to the 12-month limit is where you expressly elect a longer period to support a service you have specifically requested. In that case we retain only the data reasonably necessary for that service, and only for as long as you maintain the election. Withdrawing it returns the affected data to the standard schedule. An election is never a default, is never bundled with signup, and can be withdrawn at any time.
  • Aggregated Data: After 12 months, granular data is permanently deleted. We retain only anonymous, daily-level aggregated metrics (e.g., “Total Sales on [Date]”) for long-term trend analysis.
  • Deletion Requests: You may request the deletion of your data earlier than the 12-month period by contacting us. We will process this request within 30 days.
  • Uninstalling the Shopify App: When you uninstall GoGotama from your Shopify admin, Shopify notifies us through its mandatory app-uninstall and shop/redact webhooks. On receipt, we immediately revoke the OAuth tokens connecting your store — permanently stopping all further data ingestion — and we schedule your granular Client Data for permanent deletion, which is completed within 30 days. Uninstalling overrides any merchant-elected retention period: an active election terminates automatically and deletion proceeds on the normal schedule. Uninstalling the app never leaves code, scripts, or tracking on your Shopify theme or storefront.

7. Sharing Data with Third Parties

7.1 Sub-processors

For our own operation of the Service, we share data only with sub-processors strictly necessary to run our application. We have Data Processing Agreements (DPAs) in place with:

  • Supabase: Database hosting and authentication.
  • Railway: Infrastructure for data processing.
  • Nango: OAuth and integration management.

We do not allow these providers to use your data for their own purposes. This list is exhaustive as to disclosures we initiate.

7.2 Merchant-Directed Disclosures

Separately from 7.1, and only where you expressly instruct us to do so, we may transmit specified data about your own business — for example, verified margin or performance summaries — to a third party you designate. This is not a disclosure we initiate; it is one you direct.

  • Your instruction only. Limited to the data and the recipient you authorize.
  • Distinct opt-in. Never bundled with account creation, with acceptance of our Terms, or with use of the core product.
  • Withdrawable. You may withdraw at any time as to future disclosures.
  • Business records only. Limited to your own business records and metrics derived from them. It never includes personal data relating to your end-customers.
  • Not a sale. Acting on your explicit instruction to share your own data with a party you select is not a sale, rental, or trade of data, and does not qualify the commitment in Section 4.

No eligibility determinations. GoGotama does not make lending, credit, insurance, employment, or other eligibility decisions, and does not act as a consumer reporting agency. Where you choose to share information with a third party for such purposes, that third party is solely responsible for its own decision and its own compliance.

8. Your Rights (GDPR)

Under the GDPR, you have the following rights regarding your data:

  • Right to Access: View the data we hold about you.
  • Right to Rectification: Correct inaccurate data.
  • Right to Erasure (“Right to be Forgotten”): Request deletion of your data.
  • Right to Restriction: Request we temporarily stop processing your data.
  • Right to Portability: Receive your data in a structured, commonly used format.
  • OAuth Revocation: You may revoke GoGotama's access to your connected platforms (e.g., Meta, Google, Shopify) at any time directly through those platforms' respective user security settings. Disconnecting the integration will immediately halt data ingestion.

To exercise these rights, please contact us at sakya@vighnahara.nl.

9. California & Canadian Privacy Rights (CCPA / PIPEDA)

For merchants and their end-customers located in North America, the following additional terms apply.

Our Role as a Service Provider: Where GoGotama processes personal information on behalf of a merchant, Vighnahara BV acts as a “Service Provider” as that term is defined under the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA). We process personal information only to provide the Service to the merchant, for the limited business purposes described in this Policy, and in line with the merchant's instructions.

No Sale or Sharing of Personal Information: We do not “sell” or “share” personal information, as those terms are defined under the CCPA, and we do not disclose personal information for “cross-context behavioral advertising.” Consistent with Canada's Personal Information Protection and Electronic Documents Act (PIPEDA), we do not trade, rent, or otherwise commercialize personal information, and we use it only for the purposes for which it was provided. We have never sold or shared personal information. The merchant-directed disclosures described in Section 7.2 are limited to a merchant's own business records and derived metrics and exclude end-customer personal information, and in any event occur only at the merchant's explicit direction — neither a “sale” nor a “share” as those terms are defined under the CCPA.

North American Privacy Rights: Subject to applicable law, residents of California and Canada may exercise rights comparable to those described in Section 8 — including the right to know what personal information is processed, the right to request its deletion, and the right not to be discriminated against for exercising these rights. To make such a request, contact us at sakya@vighnahara.nl.

10. Changes to this Policy

We may update this Privacy Policy from time to time. If we make significant changes, we will notify you via email or a notification within the dashboard.