Privacy Policy

ShopYA (https://shopya.com.ar) is an Argentine marketplace for small entrepreneurs and is the controller of the personal data described in this policy. You can contact us at [email protected].

Depending on how you use ShopYA, we collect:

• Buyer or seller account: name, email address, phone number and password (stored in protected form).
• Shipping and billing addresses that you add to receive your purchases.
• Orders: purchased products, amounts, order status and the data needed for shipping.
• Payments: payments are processed by Mercado Pago or Plus Pagos (Billetera Santa Cruz), depending on the method you choose. ShopYA does not store card numbers or security codes; we only receive the status and identifier of the transaction.
• Shop data (sellers): shop name and description, products, images, prices and stock.
• Technical data: IP address, browser and device type, pages visited and cookies, for operation, security and statistics.
• Meta data (Facebook and Instagram): only if a seller links their account; detailed in the next section.

To measure site usage we use Google Analytics and the Meta (Facebook) pixel. These tools place cookies in your browser and are separate from the data obtained when connecting a Facebook account from the seller dashboard. You can block or delete cookies in your browser settings.

Sellers can optionally link their Facebook account from the dashboard ("Connect with Facebook", using Facebook Login for Business) to publish their products to their Facebook Pages and Instagram accounts. When they do, we store:

• Your Facebook app-scoped user ID and name.
• A long-lived user access token, encrypted with AES-256-GCM.
• The permissions you granted.
• The Facebook Pages you manage and choose to publish to: Page ID, name, picture URL and the Page access token (encrypted).
• The Instagram professional account linked to each Page: ID, name, @username and picture URL.

We do not obtain or store your email address from Meta.

For each post we publish we store: the caption, the product images used (resized 1080x1080 copies kept in our storage and deleted 7 days after publishing), the Meta post ID, its permalink and its status.

Permissions we request from Meta:

• pages_show_list
• pages_read_engagement
• pages_manage_posts
• instagram_basic
• instagram_content_publish
• business_management

We use these permissions only to link the account, list your Pages and Instagram accounts, and publish the products you create or share in ShopYA (manually or through the optional auto-publish). We do not read messages, comments, followers or insights.

• Create and manage your account and shop.
• Process orders, payments and shipping, and communicate with you about them.
• Provide support and prevent fraud and abuse.
• Improve the operation and security of the site.
• Publish to Facebook and Instagram the products you choose to publish, if you linked your account.
• Comply with legal obligations.

We do not sell or share data obtained from Meta with third parties, and we do not use it for advertising. We also do not use it to profile people or for any purpose other than those described in this policy. We share data with others only when necessary to provide the service (for example, with the seller or the carrier to deliver an order) or when required by law or a court order.

To operate ShopYA we use infrastructure and service providers that process data on our behalf:

• Google Firebase (Firestore, Cloud Storage and related services): data storage and processing, including Meta data.
• Mercado Pago and Plus Pagos (Billetera Santa Cruz): payment processing.
• Google Analytics and the Meta pixel: site usage statistics.
• Meta Platforms: only when you link Facebook or Instagram, to carry out the posts you request.

These providers act as data processors and may host data outside Argentina, under the corresponding contractual safeguards.

Meta access tokens are stored encrypted (AES-256-GCM) and are only decrypted on our servers at the moment they are used; they are never sent to the browser or to the user's app. Access to data is restricted by permissions and communications use encrypted connections (HTTPS). No system is completely infallible; if we detect an incident affecting your data, we will act in accordance with applicable law.

We keep your account data while it is active and for as long as needed to meet legal, accounting and dispute-resolution obligations.

Regarding Meta: we keep the data while your account remains linked. When you unlink it, we immediately delete the tokens. If you request deletion of your data (or use "Unlink and delete my Meta data"), we delete or anonymize the tokens, the Page and Instagram data and the post IDs. Image copies created for publishing are deleted 7 days after publishing. Posts already published on Facebook or Instagram remain on Meta, and you can delete them there.

You can unlink your Meta account and delete the associated data at any time. Step-by-step instructions are at /data-deletion/en. In short: from the dashboard (your shop → Social networks) use "Unlink and delete my Meta data", remove ShopYA from your Facebook settings, or email us at [email protected].

As a data subject you have the right to:

• Access: know the data we hold about you.
• Rectification, update and deletion: ask us to correct, update or delete your data. We respond within a reasonable period (generally within 30 days).

To exercise them, email [email protected].

ShopYA is not directed to people under 18 and we do not knowingly collect their personal data. If you believe a minor has provided us with data, email [email protected] and we will delete it.

We may update this policy. We will publish the current version on this page with its last-updated date and, if the change is significant, we will notify you by reasonable means.

ShopYA · [email protected]