1. Introduction and Scope
1.1 This Policy explains how the operator of the VarrMall platform (the "Platform", "we" or "us") collects, uses, stores, shares and protects your personal data when you register for, log into and use the VarrMall Merchant Admin and related services (collectively the "Services"), and what rights you have.
1.2 This Policy applies to holders of a merchant master account and to users of merchants' staff sub-accounts.
1.3 Roles (important): The Services involve two categories of personal data, and our role differs between them —
- Your account information, Store operating information and usage logs: the Platform is the Controller of such personal data and processes it in accordance with this Policy;
- Personal data of your Store's consumers (order delivery information, customer support conversations, browsing and add-to-cart records and the like): you are the Controller and the Platform acts solely as a Processor on your behalf, processing such data on your instructions and under the Data Processing Agreement (DPA), and not for the Platform's own purposes. Consumers should assert their rights against you; where a consumer makes a request directly to the Platform, the Platform will forward it to you and assist in responding.
1.4 Privacy notices on the storefront (the Cookie consent pop-up, the privacy policy page and the like) are provided by you, as the Store operator, to consumers. The Platform provides the corresponding tools and Templates in support, but the final content and its compliance are your responsibility.
2. What Information We Collect
| Category | Specific information | Purpose of collection |
|---|---|---|
| Account and identity information | Mobile number, email address, password (stored encrypted), name or nickname, role | Registration, login and identity verification |
| Entity and qualification information | Name of the enterprise or sole proprietorship, registration number, legal representative, contact person, business licence and the qualification materials required by the Platform | Onboarding qualification review and compliance verification |
| Store operating information | Store name, logo, description, subdomain, custom domain, business categories, address, currency and language settings, payment and logistics channel configuration (keys stored encrypted) | Store setup, fulfilment and storefront display |
| Operational business data | Products and categories, orders, refunds, customer profiles, Coupons, Email templates, DIY pages and articles, image assets | Provision of the individual business features |
| Staff and permission information | Staff accounts, names, roles and permissions, operation records | Permission management and security auditing |
| Usage and device information | Login times and IP addresses, operation logs, browser and device information, anomaly and risk-control records | Security protection, risk control and troubleshooting |
| Billing and usage information | Plans and invoices, payment records, Token consumption details | Billing, reconciliation and customer support |
| AI interaction content | Customer support conversation content, text and images submitted for translation, GEO sampling keywords and results | Provision of AI capabilities and performance monitoring |
| Communication records | Tickets, emails and customer support communications | Support and dispute handling |
2.2 We do not actively collect sensitive personal data such as your identity card number, biometric information, precise location or financial account passwords. Where the business genuinely requires it (for example, real-name or qualification verification), we will separately inform you of the purpose of processing and obtain your Consent.
3. How We Use Information
| Purpose of processing | Description | Lawful basis |
|---|---|---|
| Provision and performance of the Services | Store setup and the operation of product, order, marketing and other features | Performance of a contract |
| Identity verification and account security | Registration, login, password reset, risk control and anomaly detection | Performance of a contract / Legitimate interests |
| Billing and invoicing | Plan and Token billing, reconciliation | Performance of a contract / Legal obligation |
| Notices and service messages | Verification codes, Plan expiry reminders, security alerts | Performance of a contract / Legitimate interests |
| Service improvement and statistics | Analysing feature usage in aggregated or de-identified form | Legitimate interests |
| Compliance and dispute handling | Cooperating with the requirements of regulatory and judicial authorities, handling complaints and disputes | Legal obligation / Legitimate interests |
| Marketing and product recommendations | Sending information about new features and offers | Consent (opt out at any time) |
3.2 We do not use your personal data for automated decision-making that has a material effect on you. Content produced by AI features is to be used after your review.
4. How We Share, Entrust Processing and Disclose Information
4.1 We do not sell your personal data. We share information or entrust its processing only in the following circumstances:
| Category | Recipient | Purpose | Information involved |
|---|---|---|---|
| Cloud and storage services | Alibaba Cloud (including Alibaba Cloud OSS and image services) | Data storage, backup and image delivery | The categories of data listed in Article 2 of this Policy |
| AI model services | OpenAI, Google (Gemini), Perplexity, Alibaba Cloud Model Studio (Qwen), DeepL | Provision of translation, AI Customer Support, image processing and GEO sampling capabilities | The text and image content you submit, and GEO sampling keywords |
| Payment services | Alipay, and PayPal, Stripe and Airwallex that you contract with directly | Collection of subscription fees and, if you enable it, collection of Store payments | Necessary information such as order amounts and merchant numbers; the Platform does not have access to full card numbers or payment passwords |
| Communication services | SMS providers and email providers | Sending verification codes, expiry reminders and notifications | Mobile number, email address and the necessary notification content |
| Analytics and diagnostic tools | Third-party analytics tools that you configure yourself on your Store (such as Microsoft Clarity) | Analysis of Store traffic and visitor experience | Collected by you on the storefront in accordance with your own notice obligations |
| Professional services and compliance | Audit, legal and accounting service providers, and regulatory and judicial authorities | Compliance, auditing and dispute handling | Provided to the extent necessary |
4.2 Notice on transfers to AI services: In order to provide AI translation, AI Customer Support, AI image processing and GEO optimization, the text, images and related context that you submit are transferred to the AI service providers listed above for processing. Please do not submit to the relevant features any sensitive information that you do not wish to be transferred to third parties or across borders.
4.3 In the event of a merger, demerger, reorganization or transfer of assets, we may transfer your information and will require the successor to continue to be bound by this Policy; otherwise we will obtain your Consent again.
4.4 Where required by law, or where necessary to protect the lawful rights and interests of the Platform, you and others, we may disclose the necessary information.
5. Cross-border Transfer
5.1 Our primary data storage and service deployment are located within China.
5.2 Because we use overseas AI models and payment or email services, some information may be transferred outside China. We protect it by entering into standard contractual clauses, selecting service providers with the appropriate compliance credentials and minimizing the fields transferred. By using the relevant AI features, you acknowledge and agree to those necessary cross-border transfers; if you do not wish your information to be transferred abroad, please stop using the relevant features.
6. Data Retention Periods
6.1 We store information for the following periods, after which it is deleted or anonymized:
| Data category | Retention period | Basis |
|---|---|---|
| Account and Store operating data | For the term of the Services; retained for 90 days after the Services end | Service restoration and data disposal rules |
| Order, payment and refund records (including consumer transaction information) | 7 years, after which personal data is anonymized | Financial and tax compliance |
| Plan and Token billing records | 2 years after the Plan is terminated | Billing and auditing |
| AI Customer Support conversation records | 36 months; after that the original conversation text is deleted and only statistical data is retained | Data minimization and privacy compliance |
| Token consumption logs | 24 months | Usage and billing verification |
| Operation and audit logs | 90 days | Security auditing |
| Notification delivery logs | 90 days | Delivery confirmation and troubleshooting |
| Cookie consent records (storefront) | 24 months | Record of Consent and compliance evidence |
| Browsing and add-to-cart data of unregistered visitors (storefront) | No more than 30 days | Data minimization |
| Personal data after account closure | Deleted or anonymized within 7 days | Responding to user requests |
6.2 Where laws or regulations impose a longer retention requirement, those provisions prevail; such data will be restricted to the statutory purposes.
7. How We Protect Information
7.1 Technical measures: HTTPS/TLS encryption in transit across the site; passwords stored using an irreversible algorithm; payment and channel keys stored encrypted; multi-tenant data isolated at row level within the same database tables by tenant identifier (tenant_id), with business queries mandatorily filtered by tenant; access control and least privilege; audit trails for key operations; and regular data backups.
7.2 Organizational measures: internal permission approval and offboarding revocation mechanisms, confidentiality requirements for staff, and emergency response procedures for security incidents.
7.3 Security incidents: If a security incident such as disclosure, tampering with or loss of personal data occurs, we will promptly take remedial measures and, as required by law, notify the affected users and the competent authorities.
7.4 Please note that no system can guarantee absolute security. Please keep your account and password secure and avoid weak passwords or sharing an account among several people.
8. Your Rights
8.1 You have the following rights in relation to your own personal data:
- Access and copy: view account, Store and staff information in the Merchant Admin;
- Rectification and completion: correct information yourself when you find it inaccurate, or contact us to have it corrected;
- Export: Export your Store's business data; if you need a copy of your personal data, you may submit a request and we will respond within 72 hours;
- Deletion and account closure: apply to close your account; personal data will be deleted or anonymized within 7 days after closure;
- Withdrawal of Consent: you may withdraw at any time your consent to processing carried out on the basis of Consent (such as marketing messages);
- Restriction of or objection to processing: request restriction of, or object to, specific processing in the circumstances provided by law;
- Complaints: lodge a complaint with a competent supervisory authority.
8.2 How to exercise these rights: through the relevant features in the Merchant Admin, or by sending an email to [email protected]. For security reasons, we may ask you to complete identity verification first. We will reply within the period prescribed by law (generally no more than 15 working days).
8.3 If your request concerns the personal data of your Store's consumers, we will assist you in handling it in accordance with the Data Processing Agreement; where a consumer makes a request directly to us, we will forward it to you.
9. Cookies and Similar Technologies
9.1 The Cookies used in the Merchant Admin are mainly strictly necessary ones:
- Login state: auth cookie (httpOnly, not readable by page scripts);
- Security: cross-site request forgery (CSRF) protection token, used to validate write operations;
- Preferences: local preference settings such as interface language.
9.2 The Merchant Admin does not use marketing Cookies for cross-site advertising, and we do not embed third-party advertising tracking scripts in the Merchant Admin.
9.3 Storefront (consumer-facing): The Platform provides a Cookie consent Component that obtains Consent separately for three categories — "necessary / functional / marketing". Necessary Cookies may be set without Consent, while functional and marketing Cookies are disabled by default and are set only after the consumer has given explicit Consent; consumers may review and change their choices at any time through the "Cookie settings" entry on the storefront. We keep logs of consent and refusal (including timestamp, masked IP address and the type of choice, retained for 24 months) as compliance evidence.
9.4 You may delete or block Cookies in your browser, but this may mean that you have to log in again, or that some features do not work properly.
10. Minors
The Services are intended for business operators and not for minors under the age of 18, and we do not actively collect the personal data of minors. If we discover that such data has been collected in error, we will delete it promptly.
11. Updates to This Policy
11.1 We may update this Policy. In the event of material changes (such as changes to the purposes of processing, the categories of information or the recipients), we will post an announcement in the Merchant Admin and inform registered users by in-site notification or email, usually at least 7 days in advance of material changes.
11.2 You may view the latest version of this Policy and its update date in the Merchant Admin at any time.
12. Contact Us and Complaints
12.1 For questions, requests and complaints relating to personal data protection, please contact: [email protected]; you may also submit them through the feedback entry in "System Settings" in the Merchant Admin.
12.2 If you consider that our processing has harmed your lawful rights and interests, you may lodge a complaint with a competent supervisory authority or seek judicial remedies in accordance with law.
12.3 If you are a consumer of a Store, please contact the Store from which you placed your order first; you may also contact us, and we will forward your request to the relevant merchant and assist in handling it.
13. Appendix: Data Processing Agreement (DPA)
13.1 At merchant onboarding, the Platform presents the Data Processing Agreement, which you are required to confirm and accept. That agreement specifies the following matters:
- Data categories: delivery information, contact details, customer support conversations, browsing and add-to-cart records and other information required for fulfilment;
- Purposes and means of processing: solely to provide the Services to you and to perform your business instructions;
- Retention period: see Article 6 of this Policy;
- Security measures: see Article 7 of this Policy;
- Sub-processors: the service providers listed in Article 4 of this Policy;
- Assistance obligations: assisting you in responding to consumers' access, deletion and Export requests, and notifying you promptly when a security incident occurs.
13.2 As the Controller, you shall ensure that you have a lawful basis for transferring consumers' personal data to the Platform and its Sub-processors, and that you have fully informed consumers.