Privacy policy

1. Who is responsible

The controller of your personal data is Ravinaro LLC, doing business as Viversio, 30 N Gould St Ste R, Sheridan, WY 82801, United States. Contact for anything about your data: help@viversio.com.

We have not yet appointed a representative in the EU (GDPR Article 27) or in the UK (UK GDPR Article 27). They will be named here once appointed. Until then, write to us directly at help@viversio.com about any data protection matter.

2. What we collect

• When you buy: name, delivery address, email, phone number (couriers on our routes need it), what you bought, the amount and currency, and the order's delivery, refund and dispute history.
• Payment: Stripe collects your card or wallet details directly. We receive only a payment reference, the payment method type, the card's last four digits and country, and the results of fraud checks.
• Your account, if you create one: your email address and a sign-in link; no password.
• When you contact us: your messages and anything you send, such as photos of a faulty item.
• When you browse: your approximate country (from your IP address, to show the right currency and delivery date), language, theme and region choices, cart contents (stored in your browser), and technical data such as IP address, browser type and pages requested, kept briefly in our hosting provider's security and error logs. If you allow analytics or advertising cookies, also the pages you view and shop events, a random browser ID and the ad click that brought you (see the Cookie settings).
• Consent records: which version of our terms you accepted and when, and your cookie choices.
• Newsletter, if you subscribe: your email, language, country, where you signed up, the exact wording you agreed to, when, and when you confirmed. We also record whether each newsletter was delivered, bounced or reported as spam.
• Bot checks on forms: when you sign up, sign in or track an order, Cloudflare Turnstile checks technical signals from your browser to stop automated abuse. It sets no advertising cookies and we keep no result beyond pass or fail.

3. Why we use it, and on what legal basis

• To take, deliver and support your order, including refunds and returns: to perform our contract with you (GDPR Art. 6(1)(b)).
• To keep tax, accounting and transaction records: to meet our legal obligations (Art. 6(1)(c)).
• To prevent fraud, secure the site, handle chargebacks and defend legal claims: our legitimate interest in protecting our customers and business (Art. 6(1)(f)).
• To run and improve the site (for example error logs): our legitimate interest in a working, secure store (Art. 6(1)(f)).
• Analytics and advertising cookies, and the purchase confirmation sent to ad platforms: with your consent (Art. 6(1)(a)) where the law requires it, which you can withdraw at any time in the Cookie settings. Elsewhere, our legitimate interest in measuring the store and our ads (Art. 6(1)(f)), which you can object to at any time; we treat Global Privacy Control as that objection for advertising. We don't send marketing emails.
• To send the newsletter: your consent, given by confirming the link we email you (Art. 6(1)(a)). You can withdraw it at any time with the unsubscribe link in every email.

Where we rely on legitimate interests, you can object (see your rights below). We don't make decisions that have legal or similarly significant effects on you based solely on automated processing, except that a payment may be blocked automatically by fraud screening; you can ask a person to review it.

4. Who we share it with

We share personal data only with the service providers we need to run the store, and only what each needs:

• Cloudflare (USA): hosting, database, security and email routing.
• Stripe (USA and Ireland): payments, fraud screening and tax calculation. Stripe is also an independent controller for some of this data; see Stripe's privacy policy.
• Resend (USA): sending order emails, sign-in links and the newsletter.
• The suppliers and couriers that ship your order (China, and delivery companies in your country): name, delivery address and phone number, to pack and deliver it.
• Our support mailbox: emails you send to help@viversio.com reach us through Cloudflare Email Routing and are kept in our mailbox so we can answer you and keep a record of your request.
• Analytics, only with your choice: Google (Google Analytics; Google Ireland and Google LLC, USA) and Microsoft (Clarity; USA).
• Advertising platforms, only with your choice: Google (Google Ads), Meta Platforms (Facebook, Instagram), TikTok, Microsoft (Microsoft Advertising) and OpenAI (ads in ChatGPT). They receive the pages you view, shop events, ad click IDs, IP address and browser type, and for a purchase its value, items, and your email and phone number hashed (SHA-256). Meta, TikTok and Microsoft also act as independent controllers for some of this data; see their privacy policies.
• Authorities, courts, advisers and payment networks where the law requires it or to establish or defend legal claims, and a buyer of the business if it is ever sold.

We also use Alibaba Cloud's Qwen AI service (DashScope) to translate product pages and articles. It receives store content only, never customers' personal data. We do not sell your personal data. Sharing with the advertising platforms above may count as "sharing" for cross-context behavioural advertising under some US state laws; you can opt out at any time (see section 8).

5. International transfers

We are based in the United States and our service providers are in the United States, China and elsewhere, so your data is processed outside your country. Where data from the EU, the EEA, the UK or Switzerland goes to a country without an adequacy decision, we use the European Commission's Standard Contractual Clauses (with the UK Addendum where relevant) or our providers' certification under the EU-U.S. Data Privacy Framework.

Delivery details are sent to suppliers in China because this is necessary to perform the contract you ask us to perform: your order ships from there (GDPR Art. 49(1)(b)). You can ask us for a copy of the safeguards we use.

6. How long we keep it

• Orders, invoices and payment records: 10 years after the order, because EU import VAT (IOSS) and tax rules require it.
• Accepted terms version and time: as long as the order record, to show what was agreed.
• Messages with us: 3 years after the last message, or longer if needed for an open claim.
• Account: until you delete it; sign-in links expire after use or within a short time.
• Security and error logs: a few days to a few weeks at our hosting provider.
• Cookie choice: 6 months, then we ask again.
• Analytics and advertising cookies: see the Cookie settings for each one's duration. What the platforms keep is set by their own retention policies.
• Newsletter: while you're subscribed. Unconfirmed sign-ups are deleted after 30 days. After you unsubscribe we keep only your address, the date and the consent record, so we can honour the opt-out and show what you agreed to; ask us and we delete it.

7. Your rights

Depending on where you live, you can ask us to: tell you what data we hold and give you a copy; correct it; delete it; restrict or object to how we use it; and give it to you or another company in a portable format. You can withdraw consent at any time, without affecting what we did before. We won't treat you differently for using your rights.

To use a right, write to help@viversio.com from the email address you used with us. We may ask you to confirm your identity. We answer within one month (45 days for California), and it's free. Some data we must keep by law, for example tax records, even if you ask us to delete it; we tell you if that's the case.

You can also complain to a data protection authority, in particular where you live or work. In the UK that's the Information Commissioner's Office.

8. If you live in California or another US state with a privacy law

In the last 12 months we have collected these categories of personal information: identifiers (name, email, address, phone, IP address, cookie and ad click IDs), commercial information (purchases), internet activity (pages requested and shop events), approximate geolocation (country). We use them for the purposes in section 3 and disclose them to the service providers in section 4. We do not sell personal information. Where you haven't opted out, we "share" identifiers, internet activity and commercial information with the advertising platforms in section 4 to measure our ads. We don't use or disclose sensitive personal information.

You have the right to know, delete and correct your personal information, to opt out of sharing (in the Cookie settings, or by sending the Global Privacy Control signal, which we honour as an opt-out), to limit use of sensitive personal information (we don't use it), and not to be discriminated against for using these rights. An authorised agent may make a request for you. If we refuse a request, you can appeal by replying to our answer.

9. If you live in the United Arab Emirates

We process your data in line with Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data. You have the rights to access, correct, delete, restrict, object to processing and have your data transferred, as described in section 7.

10. If you live in Brazil

Under the LGPD (Law No. 13,709/2018), you have the rights to confirmation and access, correction, anonymisation, blocking or deletion of unnecessary data, portability, information about who we share data with, and to withdraw consent. Our legal bases are those in section 3 (performance of a contract, legal obligation, legitimate interest and consent). You can contact us at help@viversio.com or the ANPD.

11. Security, children and changes

We use encryption in transit, encrypted storage for sensitive keys, minimal access and providers with strong security. No system is perfectly secure; if a breach affects you, we tell you and the authorities as the law requires.

The store is not meant for children. We don't knowingly collect data from anyone under 16 (13 in the US). If you think a child has given us data, tell us and we delete it.

We update this policy when what we do changes. The date and version are at the top. If a change matters, we tell you before it takes effect.