Omnilisto helps Shopify stores publish their products on sales channels (Vinted, Leboncoin, Etsy, eBay, Cdiscount) and sync prices, stock and sales. This page explains what data we process, why, and what your rights are.
Who is responsible?
OZMEN Can, sole trader (entrepreneur individuel, EI), 101 Impasse des Cigales 2, 13340 Rognac, France — contact: contact@omnilisto.com.
For your account data, we are the data controller. For the data of your store's customers (orders), we act as a processor, on your behalf and according to your instructions (Article 28 of the GDPR).
What data?
- Your store: your Shopify store address and the access tokens provided by Shopify at installation.
- Your catalogue: products, variants, prices, stock, SKUs, barcodes, categories, photos, as well as the texts and settings specific to each channel.
- Your sales on the channels: order number, items, amounts and channel fees. The buyer's name and shipping address are read from the channel when the order is created in your Shopify store, and are then not kept by Omnilisto. The buyer's email address is never collected.
- Your channel connections: Etsy and eBay access tokens, Cdiscount credentials — stored encrypted.
- The Chrome extension: a device identifier to link your browser to your store. The extension acts within your own Vinted / Leboncoin session: it never reads or stores your passwords. If you enter it, your Leboncoin hand-delivery address is saved by Omnilisto and used only to fill in the Leboncoin listing form.
- Technical logs: history of actions (publications, syncs, sales) and errors, to keep you informed and fix problems.
- Your messages to support: name, e-mail, store (optional) and the content of the message sent from the Support page, to reply to you.
Why?
To provide the service you installed (performance of the contract): publishing and updating your listings, syncing prices and stock, creating your sales in Shopify, passing on tracking numbers. Technical logs are also used for the security of the service (legitimate interest). Your data is neither sold nor used for advertising.
Who receives it?
- Shopify, to read your catalogue and create your orders.
- The sales channels you connect (Etsy, eBay, Cdiscount; Vinted and Leboncoin through your browser), for your listings and sales.
- Our hosting provider: OVH SAS, 2 rue Kellermann, 59100 Roubaix, France.
- Brevo (Sendinblue SAS, France), which delivers the messages sent from the Support page to us by e-mail.
- If you use AI writing: Anthropic (United States) receives the title, description and photos of the product concerned — never your customers' data. This transfer is governed by the European Commission's standard contractual clauses.
How long?
For as long as the app is installed. After uninstallation, Shopify asks us to erase your store's data (48 hours later) and we delete it. Requests sent by Shopify to erase the data of one of your customers are processed automatically. Technical logs: 30 days (received notifications), 180 days (action history), 1 year (access log). Messages to support: 1 year. Encrypted database backups: 14 days on the server, 60 days for the off-server copy.
Security
Encrypted connections (HTTPS), channel credentials encrypted in the database (AES-256-GCM), encrypted backups copied off the server, no personal data of your customers kept. Server access restricted to the publisher, by key only; every read of a customer's address is logged. If a security incident affects your data, we notify you within 72 hours. No advertising or audience-measurement cookies.
Data processing (Article 28 GDPR)
For your customers' data (name and shipping address of sales), you are the controller and Omnilisto acts as a processor, solely on your instructions: creating the order in your Shopify store. We commit to: processing this data only for that purpose; not keeping it; ensuring the confidentiality of anyone with access to it; applying the security measures described above; helping you respond to your customers' requests and meet your obligations; notifying you of any data breach within 72 hours; deleting all data on uninstallation. Sub-processors: OVH SAS (hosting, France) and, if you enable it, Anthropic (AI writing, no customer data). By installing Omnilisto, you accept these commitments, which serve as the data processing agreement.
Your rights
You have the right to access, rectify, erase, object to, restrict and port your data. Write to contact@omnilisto.com. If you believe your rights are not being respected, you can lodge a complaint with the CNIL, the French data protection authority (www.cnil.fr). Your store's customers exercise their rights with you; we help you respond to them.