Privacy policy - Biklo apps and plugins

Last updated: 10 November 2026

This policy covers Biklo's shop integrations - Biklo for WooCommerce, PrestaShop, Magento, OpenCart and CS-Cart (plugins you install in your own shop), Biklo for Shopify (an app Biklo hosts) - and this website, apps.biklo.com.

Selling on Biklo itself - your seller account, your listings, your orders and payouts - is covered by the privacy policy of the Biklo marketplace you sell on: biklo.ro/legal/privacy. This page explains only what the integrations add to that.

#Who we are

BIKLO MARKET SRL, a Romanian company registered with the Trade Register under no. J2024018583007 (EUID ROONRC.J2024018583007), tax identification code (CUI) 50478827, with its registered office at Str. General Dumitrache nr. 4, ap. 5, 500168 Brașov, Județul Brașov, Romania.

Questions about this policy or your data: [email protected].

#The short version

• The plugins run on your own server. They keep their settings and your Biklo API key (encrypted) in your shop's database, and they send Biklo your product data so that your products can be listed, and what you do with Biklo orders.
• Biklo sends your shop the orders Biklo buyers place with you, including what you need to ship them: the buyer's name, delivery address and phone number.
• Biklo for Shopify runs on Biklo's servers. It keeps what it needs to connect your store and keep it in step with Biklo - not your customers' personal data - and deletes all of your store's data when Shopify asks after you uninstall it.
• This website sets no cookies and loads nothing from other companies. The country you choose on it is remembered in your browser only.

#1. The plugins (WooCommerce, PrestaShop, Magento, OpenCart, CS-Cart)

#What is stored in your shop

Everything a plugin keeps is in your own shop's database, on your server:

• your Biklo API key, encrypted, and the secret Biklo uses to sign the notifications it sends your shop;
• your settings and your choices for Biklo: which Biklo category, brand and condition your products and categories map to, and which products are left out;
• the state of the sync: which product is which Biklo listing, what was last sent, what is waiting, and a short activity log;
• a record of each Biklo order: its Biklo number, status, tracking and return status.

Biklo cannot read this database. Your shop's own data - your other customers, your other orders, your accounts - is never sent to Biklo.

#What is sent to Biklo

• Your products, so they can be listed on Biklo: titles, descriptions, photos (their web addresses, which Biklo then downloads), prices, stock, SKU, categories, brands, variants and their attributes (such as size, colour and condition), and the parcel size.
• What you do with Biklo orders: accepting them, the address the parcel leaves from, how many parcels, shipping, cancelling, accepting or rejecting a return (with the reason you write), and the invoices you attach.
• Technical details: the plugin's version, with every request; your shop's web address, once, so that Biklo knows where to send its notifications.
• A support report - only when you press Get help. You can read it in the window before you send it. It holds what our support team needs to help you: the versions of the plugin, your platform, PHP and the database; your shop's address, language, time zone and currency; your settings; your API key masked (only its first and last characters); the state of the sync and the orders (counts, not contents); the last 30 lines of the plugin's activity log; and the list of other plugins or modules active in your shop.

#What your shop receives from Biklo

The orders Biklo buyers place with you, created as orders in your shop so you can ship them: the products and prices, the buyer's name, delivery address and phone number (the courier calls that number), and, where the buyer gave them, the billing details and email address. Also: courier labels, tracking, payouts and return statuses.

From that moment these orders are part of your shop's data, and for the buyer's details in them you are a controller in your own right under the GDPR: you decide how your shop keeps them, and you answer for that. Use them only to fulfil the order and handle its return, keep them safe, and do not use them for your own marketing - as the terms of use of the integrations say.

#When you remove a plugin

Deleting (uninstalling) a plugin removes its API key, settings, sync state and log from your shop, and removes the notification address it registered on Biklo. Two things stay, on purpose: orders already created in your shop (they are your orders), and your per-product and per-category Biklo choices, so that reinstalling does not mean mapping your shop again. Your listings on Biklo stay in your Biklo account until you remove them there.

#2. Biklo for Shopify

Biklo for Shopify is an app Biklo hosts at shopify.biklo.com, on our servers in Romania (see Who else sees it below).

#What Shopify lets the app do

When you install it, Shopify asks you to allow the app to read your products, inventory and locations (to list your products and keep their stock right) and to read and write orders and the fulfilment orders you manage (to bring Biklo orders into Shopify and fulfil them with Biklo's tracking number). The app asks for nothing else.

#What the app stores, on Biklo's servers

• your store's address, the date you installed it, and the access token Shopify gives the app - encrypted;
• your Biklo API key and the notification settings - encrypted - and which Biklo account they belong to;
• your settings and your category and brand choices for Biklo;
• the state of the sync: which Shopify product and variant is which Biklo listing, what was last sent (stock, price, a fingerprint of the rest), what is waiting, and an activity log;
• a record of each Biklo order: the Biklo and Shopify order numbers, status, tracking number and link, the invoice reference, the total, and per product line its title, quantity and return status.

Your customers' personal data is not stored by the app. The buyer's details of a Biklo order go straight from Biklo into the order the app creates in your Shopify store; the app keeps only the order numbers. It does not read your other Shopify orders or your customer list.

#What is sent to Biklo

The same as for the plugins (section 1): your products, what you do with Biklo orders, technical details, and a support report only when you press Get help.

#When you uninstall it

Uninstalling stops the app at once. Shopify then asks the app, 48 hours later, to erase your store's data (shop/redact), and the app deletes everything it holds about your store: tokens, keys, settings, sync state, log and order records. Requests about a single customer (customers/data_request, customers/redact) find nothing to return or delete, because the app keeps no customer data.

#3. This website

apps.biklo.com is a set of static pages. It sets no cookies, runs no analytics and loads nothing from other companies - its fonts, images and its one small script are served from the site itself.

When you choose the country you sell in, the site remembers it in your browser (its local storage), so that marketplace links, currency and legal details follow it on every page. It is never sent to us or anyone else; Forget my country in the country picker, or clearing your browser's site data, removes it.

The web server keeps a technical log of requests (IP address, time, page, browser) for security, for up to one year. The site sits behind Cloudflare, which protects it from attacks (see below).

#Why we process this data

• To provide the integration you asked for - connecting your shop to your Biklo seller account (Article 6(1)(b) GDPR, a contract with you).
• Support reports, at your request, to help you (Article 6(1)(b)).
• Server logs and the security of our systems - our legitimate interest in keeping the service safe and working (Article 6(1)(f)).

We do not sell this data, use it for advertising, or use it for anything other than the integration and supporting you.

#Who else sees it

• Hosterion SRL (Romania), our hosting provider, which runs the servers of Biklo and of Biklo for Shopify.
• Cloudflare, Inc., which sits in front of our websites and APIs to protect them from attacks and to deliver them faster; it sees the traffic passing through it (such as IP addresses).
• Google (Google Workspace), whose mail service carries the emails Biklo sends, including support reports to our team.
• Shopify, for Biklo for Shopify - under Shopify's own privacy policy, as the platform your store runs on.
• Couriers, through Biklo, for the orders you ship - as the marketplace privacy policy describes.

Each works for us under a data processing agreement. Our servers are in Romania. Cloudflare, Google and Shopify may process data outside the European Union; where they do, it is under the safeguards the GDPR requires (the EU-US Data Privacy Framework or the European Commission's standard contractual clauses).

#How long we keep it

• Plugin data in your shop: until you remove the plugin (see above).
• Biklo for Shopify: until Shopify's erase request after you uninstall it.
• Support reports: for as long as your Biklo seller account exists, so that we can see the history of a problem if it comes back. Ask us at any time to delete them sooner.
• Server logs: up to one year.
• Data in your Biklo seller account (listings, orders): as the marketplace privacy policy says.

#Your rights

You have the right to access your data, have it corrected or erased, restrict or object to its processing, and receive it in a portable format. Write to [email protected]; we answer within one month.

You can also complain to a data protection authority. Ours, as a Romanian company, is the Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP), www.dataprotection.ro. You may also turn to the authority of the country where you live or work.

In your country, that is your national data protection authority.

#Changes

When this policy changes, we update it here and change the date at the top. A change that matters for you is also announced in the integrations' release notes.