Privacy Policy — 50lution Commerce Assistant

1. Who is responsible?

50LUTION COMPANY LIMITED, 28 Thanh Luong 20, Da Nang, Viet Nam (“50lution”, “we”) is responsible for personal data used to operate this website, customer accounts, billing, security and support. Tax identification number: 0402210945. Legal representative: Mac Tran Hoai Hung. Contact: [email protected].

For Shopware data processed through Commerce Assistant, the merchant normally determines why and how that data is used and remains the controller. 50lution processes that data as a service provider or processor on the merchant’s instructions, depending on the specific context. Merchants are responsible for informing their customers and employees and for having a lawful basis for using the service.

2. Data we process

Account data: name, email address, password hash, language preference and account timestamps.
Session and security data: IP address, browser or user-agent information, session identifiers, request and security logs.
Form-protection data: Cloudflare Turnstile may process IP address, browser and interaction signals when you use the contact, registration or login forms to distinguish legitimate visitors from automated abuse.
Optional website analytics: when you consent, Google Analytics may process page views, interactions, referrer information, device and browser characteristics, approximate location derived from IP address, and analytics identifiers.
Shop connection data: Shopware shop name and URL, environment, installation and connection identifiers, pairing status and sales-channel metadata.
Billing data: plan and subscription status, billing reference, Paddle customer, subscription, price and transaction identifiers, and billing event records. Complete payment-card data is handled by Paddle and is not stored by 50lution.
Communications: support messages and transactional email delivery information.
Operational Shopware data: the products, orders, customers or other store records requested by an authorised user through a tool call. The exact data depends on the requested operation and the capabilities enabled by the merchant.

3. Why and on what basis?

To create and manage accounts, connect a shop, provide requested Commerce Assistant functions and administer subscriptions — performance of a contract or steps requested before entering a contract (GDPR Art. 6(1)(b)).
To secure the service, prevent misuse, diagnose errors and maintain reliable operations — our legitimate interests in operating a safe service (GDPR Art. 6(1)(f)).
To send essential account, connection, security and billing messages — performance of a contract and our legitimate interests.
To keep invoices and records required by tax, accounting or other law — compliance with legal obligations (GDPR Art. 6(1)(c), where applicable).
To measure and improve the website with Google Analytics only after you opt in — your consent (GDPR Art. 6(1)(a), where applicable). You may reject analytics without losing service access and withdraw consent at any time through Cookie settings without affecting earlier processing.

4. How Shopware and AI data flow

Your Shopware installation remains the source of store data. Commerce Assistant uses the connection authorised by the merchant to fulfil a specific request. Store records may pass through the Commerce MCP service and be returned to the AI workspace that initiated the tool call. We do not use merchant store data to build advertising profiles or sell it.

The AI workspace or model provider used by you (for example ChatGPT or Claude) is a separate service with its own privacy terms and settings. Do not submit data to an AI provider unless your organisation permits it. 50lution does not control the AI provider’s independent handling of conversation content.

5. Service providers and recipients

We may also disclose data when required by law, to protect rights and service security, or in a corporate transaction subject to appropriate confidentiality safeguards.

DigitalOcean: primary application and Commerce MCP infrastructure in the FRA1 region in Frankfurt, Germany. See the DigitalOcean Data Processing Agreement.
Paddle: checkout, subscription administration, invoicing and payment-related communications. Paddle acts in its own role for buyer and payment data. See Paddle’s Privacy Policy.
Transactional email provider: delivery of account, password-reset, security and lifecycle messages. The configured provider receives only the data necessary to deliver the message.
Cloudflare Turnstile: necessary abuse and bot protection for contact, registration and login forms. See Cloudflare’s Privacy Policy.
Google Analytics: optional website usage measurement, loaded only after analytics consent. Advertising storage, advertising user data and ad personalisation remain disabled. See Google’s Privacy Policy.
Your Shopware installation and chosen AI provider: recipients or sources only as required to perform the operation you requested.

6. Location and international access

Primary application infrastructure is hosted in DigitalOcean’s FRA1 region in Frankfurt. Authorised 50lution personnel in Viet Nam may access data when necessary for service operation, incident response or customer support. Viet Nam is outside the EEA and does not currently have an EU adequacy decision.

Where GDPR transfer rules apply, we use applicable contractual and organisational safeguards with service providers and customers, including EU Standard Contractual Clauses where appropriate. Hosting in Frankfurt does not mean that every support, analytics or payment-related processing activity remains exclusively in the EU.

7. Retention

We keep account and connection information while the account or connection is active and for a limited period afterwards where necessary for security, dispute handling, recovery or legal obligations. Pairing and reset credentials are short-lived. Web sessions expire according to the configured session lifetime.

Billing and transaction records are retained for the periods required by applicable accounting and tax law. Operational Shopware data is fetched as needed; it may be retained temporarily in logs, responses or audit records when necessary to deliver, secure or document an operation. We delete or anonymise data when it is no longer needed, unless continued retention is legally required.

8. Your rights

Depending on applicable law, you may request access, correction, deletion, restriction, portability or object to processing based on legitimate interests. You may also withdraw consent and lodge a complaint with the competent data-protection authority. These rights can be limited by legal requirements and the rights of others.

Contact [email protected]. If your request concerns data held in a merchant’s Shopware store, contact that merchant first; we will assist the merchant where we act as its processor.

9. Cookies, automation and children

We use technically necessary session and security cookies for login, language choice, protection of forms and remembering your privacy selection. These are required to operate the website and cannot be disabled through our settings.

Google Analytics is optional. Its tag is not loaded until you accept analytics cookies. When enabled, it may set cookies such as _ga and _ga_* to distinguish visits and measure website usage. We keep Google Consent Mode advertising storage, advertising user data and ad personalisation denied; we do not enable advertising cookies through this consent control.

You can accept, reject or later change analytics consent through the Cookie settings link in the website footer. Rejecting or withdrawing analytics consent does not limit your access to the service. The consent choice itself is stored in a necessary first-party cookie for up to six months so the website can remember it.

Commerce Assistant can automate store operations, but it does not make legal or similarly significant decisions about individuals on behalf of 50lution. The service is for business users and is not directed to children.

10. Changes

We update this policy when the service, providers or legal requirements change. The date above identifies the current version. Material changes may also be communicated through the service or by email.