Privacy policy

Tolra ("we") makes Shopify apps for stores that sell parts and technical products. The first is Tolra Search. Tolra is run by Samet Büyükkömürcü (sole proprietorship), Gaziantep, Türkiye (postal address on request). Contact: support@tolra.app.

This policy explains what Tolra collects when a merchant installs it, when shoppers use the search on a store that runs it, and when you visit our website.

Who is responsible for what

• Merchant data (your store, settings, support messages): we decide how it is used, so we are the controller.
• Shopper data (searches and "Can't find what you need?" requests on your store): the store is the controller, and we process it on the store's behalf to provide search. Shoppers should contact the store about their data; the store can reach us if needed.

We process merchant data to provide the service you installed (contract) and to keep it secure and working (legitimate interests). We process shopper data only on the store's instructions.

Information from merchants

When you install Tolra, Shopify gives us access to your store's data under the permissions you approve:

• Products (titles, descriptions, types, tags, vendors, SKUs, barcodes, product fields, images and variants) that are published to your Online Store, their translations and your store languages. We copy them into a search index that belongs only to your store. We don't store prices or stock; they are read from Shopify when shoppers search.
• Your theme (read only), to check that the search box and results page are switched on.
• Your plan with Tolra, from Shopify's billing.
• Your settings in Tolra: search box design, synonyms, search rules, other part numbers you upload, and approved filter values.
• Support messages you send from the Support page: your reply email, the topic and message (including a collaborator request code if you choose to give our team store access), and, if you tick the box, your setup details (plan, product count, live theme name, whether the search box and results block are on).
• Support assistant conversations: the questions you type to the assistant on the Support page and its answers, what it offered (for example a button to add a synonym group) and how many AI tokens each answer used. To answer, the assistant reads your store's setup in Tolra (plan, product count, last product copy, theme check, setup steps, search report, synonym and rule counts, AI filter counts) and can run a test search on your store's index. If you choose to send the conversation to our team, it is saved as a support message, as above.
• Live chat with our team, if you open it on the Support page: the chat service receives your store name, plan, the email you use and what you write, and may set its own cookies in that page.
• On paid plans that include it, approved filter values and part numbers are written to your products in two app-owned fields, when you switch this on.

We use this information only to provide and support Tolra on your store. Each store's data is kept apart; we never combine stores or use one store's data for another.

Information from shoppers

• Searches: the words typed, how many results they found and when. We do not store who searched, customer accounts or IP addresses. When a shopper adds a product to the cart from Tolra's results or quick order, we record the search and which product was added, so the store can see which searches lead to sales; no cart, order or shopper data. Search records are deleted after 90 days. The most frequent searches of the last 30 days can be shown to shoppers as "Popular searches"; a search is only shown after it was made several times on different days, and searches that look like an email address, a phone number or a web address are never shown.
• "Can't find what you need?" requests: if a shopper chooses to send one, we store what they asked for, an optional note and the email they typed, only after they tick a box to share it with the store. The form links to the store's own privacy policy and is only shown when the store has one. The store sees the request in Tolra to reply. Requests are deleted after 90 days, or earlier when the store deletes them or the customer asks the store to erase their data.
• Customer data request reports: when a customer asks the store, through Shopify, for the data held about them, we prepare a short report of what Tolra holds for that email in the store's Tolra admin, for the store to send. The report is deleted when the store marks it sent, or after 30 days.
• Rate limiting: to stop abuse we count requests per network (IP) address for about one minute, in our server's memory. Tolra does not write these addresses to its database.

Tolra does not use cookies or local storage on your store's pages, does not track shoppers and does not sell or share shopper data.

AI processing

On plans that include AI, product text (titles, descriptions, types, tags and product fields) is sent to Anthropic's Claude API to suggest filter values and part numbers, and filter names and values are sent to it for translation. No shopper or customer data is sent for this.

On every plan, the support assistant sends your questions, the recent messages of the same conversation and the setup facts listed above to Anthropic's Claude API to write its answers. Top searches that found nothing (search words only) and product titles from a test search can be part of those facts; no shopper names or IP addresses are sent.

Anthropic processes this data on our behalf and, under its commercial terms, does not use it to train its models. We do not train or fine-tune any model on merchant data.

Our website

Our website (tolra.app) uses no cookies, no analytics and no third-party scripts, and its fonts are served from our own server. Like any website, our hosting provider may keep standard access logs (including IP addresses) for security for a short time. If you email us, we keep your message to answer it.

Service providers and international transfers

• Anthropic, PBC, United States (AI processing of product text and support assistant conversations, as above)
• netcup GmbH, Manassas, Virginia, USA (app server, database and search index)
• Cloudflare R2, North America (encrypted database backups)
• Resend, USA (the weekly search summary to the merchant, and forwarding support messages to us)
• Apple iCloud Mail (our support mailbox)
• Cloudflare Pages (this website)

Some of these providers are outside your country, including in the United States. Where the law requires it, transfers are covered by the providers' data processing terms (for example the EU Standard Contractual Clauses).

Retention and deletion

• Search records and product requests: 90 days.
• Customer data request reports: until the store marks them sent, at most 30 days.
• Support assistant conversations: 90 days.
• Support messages: until you uninstall Tolra.
• Encrypted database backups: up to 35 days, then overwritten.
• When you uninstall Tolra, search on your store goes back to your theme's own search at once. We keep your store's data for 7 days in case you reinstall, then delete everything we hold for your store: the search index, settings, AI suggestions, search records, product requests, data request reports, support messages and support assistant conversations. If you reinstall within those 7 days, nothing is deleted.
• Customer requests through Shopify: for customers/data_request we prepare the report described above; for customers/redact we delete that customer's requests.

Your rights

Merchants can ask us about, correct, export or delete their data at support@tolra.app. Shoppers should contact the store they used; the store can reach us if needed. If you are in the EU or UK you can also complain to your data protection authority.

Children

Tolra is a business tool for merchants and is not directed at children.

Changes

We'll update this page when what we collect changes, and tell merchants in the app about significant changes.