Privacy policy
Version 1.0, effective November 5, 2026
Who processes your data
The data controller and the provider of the Tobto.shop service is the party identified below.
- Provider
- ФОП Жемчужний Р.Є.
- Tax / registration ID
- 3242511579
- Address
- м. Київ, вул. Хрещатик, 44
What data and why
| Category | Data | Purpose | Basis |
|---|---|---|---|
| Sign-up and account | e-mail, password (stored only as a hash), store name and address, chosen plan and period | create the account and store, sign in, send service e-mails (confirmation code, store ready, invoices) | performance of the contract |
| Payment | amount, date, payment status, card label (scheme and last digits) | issue an invoice, renew the subscription, refund. Card details are entered on the «plata by mono» (monobank) payment page and never reach us | performance of the contract, accounting duties |
| Enquiries | name, e-mail, phone, message | answer your request, including Enterprise requests | your request; legitimate interest |
| Technical data | IP address, request time, browser type in server logs | abuse protection, incident investigation | legitimate interest |
| Site analytics | de-identified events: pages opened, sign-up steps (never passwords, payment data or form text) | understand which pages and steps are useful. Enabled only after your consent | consent |
Who receives data
Only parties the service cannot run without: the payment service (plata by mono / monobank; LiqPay when you connect it in your own store), the e-mail delivery service, the hosting provider whose servers run the site and stores, and, if you consented, Google and Meta analytics. We do not sell data or use it for third-party advertising.
Cookies and analytics
Essential cookies are needed for sign-in and form protection. Analytics cookies (Google Analytics, Meta) are enabled only after your consent; you can change or withdraw it in «Cookie settings» at the bottom of the page. Without consent no analytics script is loaded.
How long we keep data
Account and store data — while the subscription is active. If the subscription is not paid: for 7 days the store keeps working, then it is suspended; for another 30 days the data stays available for restore and export; then 30 more days until the store and its backups are deleted for good (60 days after suspension in total). Invoices and payment records are kept as long as accounting requires. Server logs are kept only as long as security needs.
Your store’s customers’ data
Your customers’ data belongs to you: you are the controller, we are the processor and handle it only to run your store on your instructions. Export of products, customers and orders (CSV/XLSX) is available in the store admin; a full archive is prepared on request and automatically before deletion.
Your rights
You may request access, correction, deletion, restriction, portability and withdraw consent. Write to the support address on the «Contacts» page from the e-mail registered in your account; we verify identity and respond within the time limits set by law.
Changes
Every new version has a number and an effective date. We announce material changes by e-mail to the account address.