Privacy Notice
Last updated 2026
Who we are
AVYRO, trading as AVYRO, is the data controller for the personal data described here. Contact us at support@commercelab.app.
What we collect and why
- Account data (name, email, password hash, login events) — to create and secure your account. Legal basis: performance of our contract with you.
- Business data you enter or sync (products, suppliers and their contact details, orders, customer email and country from your store, costs) — to provide the service. Legal basis: contract performance.
- Support messages — to answer you. Legal basis: contract and legitimate interests.
- Usage and technical data (feature usage, AI operation counts, error logs, IP address, device and browser) — for security, fraud prevention, billing limits and product improvement. Legal basis: legitimate interests and legal obligation.
- Marketing contact — only if you opt in. Legal basis: consent, withdrawable at any time.
Who we share it with
Service providers acting on our instructions: cloud hosting and database, email delivery, error monitoring and the AI model gateway used to generate text. Paddle, our Merchant of Record, for the sale of subscriptions, payments, invoicing and tax compliance. Professional advisers (legal, accounting) and authorities where the law requires it. We do not sell personal data.
International transfers
Some providers process data outside the UK/EEA. Where that happens we rely on adequacy decisions or Standard Contractual Clauses together with appropriate technical safeguards.
Retention
Account and business data are kept while your account is active and for up to 12 months after closure, then deleted or anonymised. Billing and tax records are kept as long as the law requires. Logs are kept for up to 12 months.
Your rights
You may request access, correction, erasure, restriction, portability, object to processing based on legitimate interests, and withdraw consent. Write to support@commercelab.app and we will respond within one month. If you are in the UK or EEA you may also complain to your supervisory authority.
Security
We use encryption in transit, access controls, per-business data isolation enforced in the database, and server-side-only storage of store credentials and API keys.
Cookies and advertising measurement
We always use cookies that are essential for signing in and keeping your session. You can clear cookies in your browser, though sign-in will stop working.
With your permission we also measure our advertising with Google Ads (Google Ireland Limited). What is shared: the page visited, the referring ad click, and whether you started a trial or a paid subscription, together with the subscription value and currency. We do not share your name, email address, phone number or any other identifier with Google, and we do not use this data for customer matching. Purposes: measuring which ads work and optimising our ad bidding. Legal basis: your consent. Google explains how it uses this data at business.safety.google/privacy.
Visitors in the EEA, the UK, Switzerland and Canada are asked before this measurement starts, and can accept or reject with equal ease. You can change or withdraw your choice at any time using the Cookie settings link in the footer; withdrawal applies immediately. Where consent applies and has not been given, Google receives only limited cookieless measurement signals. Elsewhere this measurement runs by default and any applicable opt-out is honoured.
With your permission we also measure our advertising with Google Ads (Google Ireland Limited). What is shared: the page visited, the referring ad click, and whether you started a trial or a paid subscription, together with the subscription value and currency. We do not share your name, email address, phone number or any other identifier with Google, and we do not use this data for customer matching. Purposes: measuring which ads work and optimising our ad bidding. Legal basis: your consent. Google explains how it uses this data at business.safety.google/privacy.
Visitors in the EEA, the UK, Switzerland and Canada are asked before this measurement starts, and can accept or reject with equal ease. You can change or withdraw your choice at any time using the Cookie settings link in the footer; withdrawal applies immediately. Where consent applies and has not been given, Google receives only limited cookieless measurement signals. Elsewhere this measurement runs by default and any applicable opt-out is honoured.