Privacy policy

Tend (“we”, “us”), operated by Convect Technologies Ltd, helps small shops run their Instagram DM and comment conversations with customers, take orders and payments out of those conversations, and reach nearby shoppers through its public marketplace at tendto.you. Shop owners also get an AI assistant, also called Tend, that works on their shop for them and, on paid plans, has a computer of its own. Tend runs on the web and in a mobile app. This policy explains what personal data we collect from shop owners, from the customers who message and buy from their shops, and from shoppers browsing the marketplace: why we collect it, and how we protect it.

Roles

Three kinds of people's personal data flow through Tend:

• Shop-owner data: your sign-in identity and the configuration you enter (products, prices, policies, notes). For this we are the data controller.
• Customer content: the DMs and comments your shop receives from third-party Instagram users, and the order details that come out of them, including any delivery or shipping address and the answers to any questions you ask at checkout. For this content your shop is the data controller and Tend acts as a processor on your behalf, under instructions set by your use of the product. A data processing addendum (DPA) is available on request at hello@tendto.you.
• Marketplace shoppers: people who sign in to search the marketplace and buy from the shops on it. For a shopper's own account, their searches, what their feed learns about them, and the view of their orders and tickets collected across shops, Tend is the data controller. (The order details a shopper gives a particular shop at checkout are that shop's customer content, controlled by the shop as above.)

What we collect

You can sign in four ways, and what we receive depends on which you use:

• Instagram: your Instagram user id, username, and an access token. Signing in or connecting a shop asks only for the scope that identifies your account and reads your public profile and posts (instagram_business_basic), plus the comment scope (instagram_business_manage_comments) where comment replies are available. The scope that reads and sends DMs (instagram_business_manage_messages) is a separate step: we ask for it only at the moment you turn on automatic replies, on Meta's own consent screen. Until you do that, Tend cannot see your DMs. We do not receive your email or phone number from Meta.
• Google: your name, email address, and Google account id. The same consent screen also includes the scope that lets Tend create and manage its single “Tend” calendar (see Google Calendar below).
• Apple (in the mobile app): Sign in with Apple returns a stable identifier for you and the name and email you agree to share. Apple lets you hide your real email behind a private relay address.
• Email & password: the email address you register. Passwords are kept only as a hash, never in plain text. We send verification and password-reset emails to that address through our email provider, Resend.

We store the customer-facing DM threads your shop receives: message text, attachments, the sender's Instagram handle, profile name and profile photo, and timestamps. We also store any shop policies, products, or notes you enter into the app yourself.

If you turn on comment replies, we also store the public comments left on your Instagram posts that the feature reads and responds to (comment text, commenter handle, timestamps). A related feature scans your recent public post comments to suggest answers to common questions for your shop; before that comment text is sent to an AI model, the commenter's identity is removed.

Once your shop is listed on the marketplace, we sync your public Instagram posts and stories on a schedule and re-host their images and video on our own storage. Stories are copied because they disappear from Instagram after 24 hours and their media links expire sooner than that. A story carries no caption, so we also generate a short written description of it from sampled frames using an AI model, including any text visible on screen, so the story can be searched. Both are your own public posts, not private content.

If you join the waitlist before signing up, we collect the email address you submit. We use it only to contact you about access and you can ask for it to be removed at any time.

Sometimes we set up a storefront for a business before it has signed up, from what the business already publishes (such as its public Instagram profile and the services and prices on its public booking page), so it can see what Tend would look like and claim it. For that we store the business email address or Instagram username that is allowed to claim it. Until it is claimed, the storefront is reachable only through the private link we send the business and is not listed on the marketplace. We delete it, with that address, if the business asks or does not want it.

If you send us feedback from the widget in the dashboard, we store what you wrote, the page you were on, and basic environment details captured at that moment (browser user agent, viewport size, language) so we can reproduce what you saw.

For paying accounts, we store billing-related identifiers from Stripe for your own Tend subscription (your Stripe customer id, subscription id, plan, status, trial end, and current-period end date). We do not see or store your card number, CVC, or bank details. Those live with Stripe.

To take payment from your own customers you connect a payout rail, and we store what we need to charge on your behalf, pay you, and record the result. With Stripe Connect we store your connected-account id and its charge status, and per order the Stripe payment-intent id (or, for older orders, the Checkout Session id), the charge id, and whether it was paid. With Paystack we store your subaccount and transfer-recipient details (the account name, bank, and last four digits of the account number) and per-order transaction status. In both cases we never see or store your customers' card numbers; the payment provider handles those. This is separate from the Stripe subscription that bills you for Tend. How the money moves is described under Checkout, tickets, and shipping below. If you top up your Tend wallet with your own money, by card or bank transfer, we keep a record of each top-up (amount, currency, the provider's payment id, and whether it arrived) the same way.

We track per-day usage counters (number of drafts produced, owner calls placed, call minutes used, inbound and outbound messages) for billing, capacity planning, and the in-app usage dashboard. These counters are aggregate per shop and don't contain message content. For the assistant's computer we also keep one row per assistant turn recording how much computer time it used, which we add up each month against your plan's hours.

If you connect your Google Calendar, we ask Google for permission to create and manage one calendar in your Google account (named “Tend”). We do not request, and Google does not grant us, access to your primary calendar or any other calendar you own or share, only the single calendar Tend creates. When a booking is created, changed, or cancelled in Tend, we write it into that calendar: the booking time and duration, the product name, the customer's name or Instagram handle, and any notes you saved. We do not read your other calendars. We store an OAuth refresh token, an OAuth access token, and your Google account email (so we can show “Connected as <email>” in Settings). Tokens are encrypted at rest.

We log standard request metadata (timestamps, IP addresses, user agents) for security and debugging, retained for up to 90 days. Each active session record also stores the IP address and browser information it was created from. When you first sign up, we do a one-time, country-level lookup of your IP address to set your shop's default currency.

AI processing and retention

Instagram DM and comment content, and the order details drawn from it, is processed by AI models to classify customer messages, draft your shop's replies, build up orders and carts, describe your public posts and stories for search, learn how your shop writes so drafts sound like you, answer questions on your storefront, and surface order details. Whether a draft is sent automatically or waits for you to handle depends on your shop's settings.

Everything customer-facing runs on Anthropic's Claude, reached through AWS Bedrock in the EU, which is configured for zero data retention on our traffic. That covers the draft bot, the classifier, comment replies, the storefront Ask box, marketplace search, and the descriptions we generate for posts and stories.

The shop-facing assistant is different in one respect. The Tend assistant a shop owner talks to over WhatsApp runs on the same EU Claude models as above. The assistant in the dashboard and the mobile app runs on a larger Claude model, also through AWS Bedrock and started from the EU, but Bedrock offers that model only through its global cross-region service, so a request can be processed in an AWS region outside the EU. To answer an owner's question the assistant writes queries against that shop's own data, so such a request can include the shop's orders, bookings, customer names and contact details, checkout answers, reviews, the text of the shop's Instagram conversations, and screenshots of the assistant's computer (see below). Neither AWS nor Anthropic stores these requests or trains on them. If you would rather no shop data was processed outside the EU, use the assistant over WhatsApp or not at all; the rest of Tend works without it. When you connect an outside tool to Tend (see Connecting Tend to your own tools), no model of ours runs at all: the tool's own model reads what you let it.

We do not share conversation content with advertisers and we do not sell it.

Tend itself keeps a copy of each AI request and response for up to 180 days. Because a request carries the material the model needs to do its job, a copy can include message text, order details, the names inside them, and screenshots the assistant took of its computer. The same applies to marketplace searches: for each search turn we keep the query you typed, the area the search was grounded to, timings, and a trace of what the search agent did, including the database queries it wrote and the rows they returned. We keep these copies to debug problems, evaluate the quality of Tend's AI, and improve Tend's AI features. Access is restricted to a small number of named Convect staff. The copies expire automatically within 180 days, including after an account is deleted. A small index row about each call (which account and conversation it belonged to, how many tokens it used, how long it took) outlives the copy; it holds no message content.

We do not use this content to train the model providers' models. If we ever use stored content to improve our own models beyond debugging and evaluation, we will update this policy before we do.

The Tend assistant, its memory, and its computer

Shop owners can talk to the Tend assistant in the dashboard, in the app, and over WhatsApp. It is one conversation across all three, and the assistant remembers it: we keep every message between you and the assistant, any photos you send it, and a record of each step it took while working (what it looked up, what it asked you, and what it did), so it can carry on where it left off and you can see what happened. This history is kept for as long as your account exists and is deleted with it. Photos you send are kept in your shop's storage with us, under unguessable addresses, and shown back to you through short-lived links.

When you ask, the assistant can search the web and read web pages. Its searches go to Amazon's web search service and the pages it opens are fetched through an Amazon-run browser, both in AWS eu-west-1, so the sites it visits see a request from AWS on the assistant's behalf, not from you.

Each assistant runs in a small computer of its own on our servers in AWS eu-west-1, which holds the conversation while it works, keeps files the assistant makes or downloads for you, and can run tasks you schedule with it. On paid plans the assistant also has a desktop computer with a web browser, which it uses to work on websites for you. On that computer:

• Whatever the assistant does there happens in its own browser, on our servers, not on your device. You can watch its screen live from the app.
• If you sign in to a website there, or let the assistant sign in, that site's sign-in stays on the computer between conversations, like a browser you leave signed in. Passwords you give the assistant for a sign-in are held only in memory on the server running your computer, not in our database, and are cleared after two hours of inactivity.
• The assistant sees the computer through screenshots, which are sent to the AI model like any other part of the conversation.
• When the computer has been idle for a while it is put to sleep, and after longer it is saved, encrypted, to our private storage in AWS eu-west-1. A saved computer includes its files, its browser data (including those sign-ins), and the contents of its memory at that moment. It is kept for as long as your account exists so the assistant can pick up where it left off, and deleted with your account.
• The websites the assistant uses on your behalf handle what it sends them under their own privacy policies, not this one.

Owner calls and your phone number

Tend can call you when the bot needs a decision on a customer message. Here is how that works and what it involves:

• We collect a phone number from you and verify it with a one-time code. Depending on the number and the surface, that code is sent either over WhatsApp or by SMS, which we send through Amazon SNS.
• Calls are placed to you over WhatsApp calling.
• During a call, the audio is streamed in real time to Google's Gemini Live API through infrastructure Convect runs. The AI on the call is briefed with your shop context (products, prices, delivery area) and the details of the order in question, including the customer's name, so it can ask you the right question.
• We store the transcript and a written summary of the call, not the audio.
• After the call, an Anthropic model turns your answer into the customer-facing reply.

You can also message the Tend assistant from WhatsApp. We identify your shop from the sending phone number and store that conversation alongside the rest of your assistant history.

Your number is never shared with customers and never used for marketing. You can pause owner calls at any time, set quiet hours, or remove your number to opt out entirely.

Notifications

Tend tells people when something happens to them: a shop that it has been paid or that a booking came in, a buyer that an order was paid, dispatched, or refunded. A notification can go by push, email, or WhatsApp, and each topic has its own switches in Settings.

For push we store a device token issued by Expo (the service that hands the message to Apple or Google for delivery), which platform the device runs, an install identifier, the app version, and the device language, so we can send to the right handset and stop sending to one that has gone away. Signing out revokes the device. For each notification we keep a record of what was sent, on which channel, to which address, and what the provider said happened, so a message that never arrived can be explained. The body of a push is short by design and passes through Apple's or Google's delivery service on its way to the lock screen.

Marketplace (tendto.you)

Tend runs a public marketplace at tendto.you where shoppers can find local shops. Your shop is listed there automatically once it meets the listing requirements: a claimed public shop handle, a shop name, a location, and a connected Instagram account. The listing is drawn from information you have already published or entered: your shop name and handle, your tagline and trade, your logo, your location at the precision you choose in Settings (a neighbourhood or area such as “Rathmines, Dublin 6”, or a full street address if you opt into that), your products and prices, your opening hours, your published answers to common questions, and your public Instagram posts and stories. It does not include your DMs, your customers' messages, or your private contact details. If you fill in a public contact email or a shop phone number, it is shown on your storefront so customers can reach you.

To power search, this published shop content is turned into numerical embeddings by an embedding model running on AWS Bedrock (Cohere's model), including the images on your Instagram posts. When a shopper searches, their typed query is embedded the same way and matched against shops.

Searching or chatting on the marketplace requires signing in. We store your search conversation and your recent searches on your account and show them back to you as “recents”. By default we work out an approximate, city-level location from your IP address so we can show nearby results: on the website from the connection details our hosting provider passes us, and where that isn't available (and in the mobile app) by looking your IP address up through ipwho.is, a third-party service. We never ask your browser or phone for precise location on its own; you can grant it yourself, from the location picker, for more accurate nearby results. When you type a place into a location search, that text goes to Photon, a geocoding service run by Komoot (komoot.io), directly from your browser or the app. Map backgrounds are loaded from third-party tile services (OpenFreeMap and CARTO), which means those services see the requests your browser or app makes for the map squares you are looking at.

Your feed and personalisation

The marketplace feed is ordered for you rather than shown to everyone in the same order, so this part is personal by design. Against your account we keep:

• A taste profile: a numerical summary rebuilt about once an hour from what you have searched for recently and which shops you have favourited, plus a weighting of how strongly you lean towards each trade. It is derived data, not a copy of your searches.
• A seen ledger: which feed cards have already been on your screen, when, and how long each one was the card in view, so the feed does not repeat itself. We read this over roughly the last week.
• Any shops you have chosen to see less of. This affects only your own feed. The shop is not told and nobody else's feed changes.

This is used to order what you see on Tend and for nothing else. It is not sold, not shared with advertisers, and not used to target you anywhere off Tend. Deleting your account deletes all three.

Favourites, reviews, and reports

Saving a shop to your favourites stores the shop against your account. Favourites also feed the taste profile described above.

After an order reaches its first fulfilment milestone you can leave a review of it: a star rating, optional written text, up to three photos you upload, and optionally which items in the order you are talking about. Reviews are shown to the shop you bought from and back to you on your own receipt. You can edit a review for 48 hours after posting it. A review stays with the shop's history if you later delete your Tend account: we unlink it from you, so it is no longer associated with your account, but the rating and what you wrote remain. Don't put anything in a review, or in a photo, that you would not want to leave behind.

If you report a shop, we store the reason you picked, any details you typed, and which page or card you reported it from. Reports are read by us for moderation and are not shown to the shop. A report also outlives the account that filed it, unlinked from you, because moderation still needs the signal afterwards.

Asking a shop a question

Some storefronts carry an Ask box that answers questions from the shop's own products, policies and published answers using an AI model. If you use it, we store the question you typed, what happened to it, and which of the shop's items the answer drew on. We do not store the answer text, your IP address, or your identity: to stop one person flooding the box we store a hash of the asker that is re-salted daily and is not reversible past that day. The shop sees the questions people asked so it can write better answers, except for questions the model marked as abusive or off-topic, which are not shown to the shop. These rows are deleted after about 90 days.

Checkout, tickets, and shipping

When you buy from a shop through Tend, at checkout we collect your name, email, and phone number, and, for delivery, a delivery address. As you type an address, the text is sent to Google Places (through our server) to offer autocomplete suggestions; once an order has a delivery address, we send it to Google's Maps Geocoding API to turn it into coordinates and check it against the shop's delivery area. A shop can add its own questions at checkout; the shop sees and can export your answers together with the order, so answer them as you would answer the shop directly. Tend does not control what a shop asks. An order page is reachable by an unguessable link, so you can pay without an account; anyone who has that link can view that order, so don't forward it. Buyers receive order-confirmation, dispatch and refund messages by email through our email provider, Resend, and as push notifications if you use the app. If you are signed in as a shopper, your orders and tickets are collected under your account so you can find them again.

Payments are collected by Tend on the shop's behalf and passed on to the shop afterwards, so the payment record sits with us as well as with the payment provider: which order was paid, when, for how much, the provider's charge identifier, and what we subsequently transferred to the shop. The card details themselves are entered with Stripe or Paystack and we never see them.

A ticket's QR code is an unguessable token. If you add a ticket to Apple Wallet or Google Wallet, the pass contains the ticket barcode, the event, the tier, the venue (including its location), and the attendee name; Google Wallet passes are issued through Google. At the door, the shop scans the QR code and sees the attendee name; scanning decodes the code on the device and captures no photos.

When a shop buys a shipping label for your order, your name, address, and contact details are sent to the shipping account the shop has connected (Packlink, or An Post through Intersoft Sapient) and printed on the label. The label itself is stored privately and reachable only through short-lived links.

Some shops run their appointments on Acuity Scheduling and connect it to Tend. When you book one of those shops' services through Tend, the booking is made on the shop's Acuity account with your name, email, phone number, and your answers to the shop's booking questions. We also keep a copy of the shop's Acuity appointments, including each customer's name, contact details, and notes, so the shop sees all its bookings in one place. That copy is the shop's customer content, controlled by the shop, and it stays with the shop's records if the shop later disconnects Acuity.

Emails a shop sends you

Separately from the order emails above, a shop can send its own emails to its customers. These come in two kinds: messages tied to something you bought or booked, for example a reminder the day before an appointment or event, or a follow-up the day after; and one-off emails to a group of the shop's past customers, chosen by what they bought or booked and when (for example everyone who held a ticket, or everyone who has not ordered in the last few months).

The shop writes the words, chooses who receives them and when; Tend works out the recipients from the shop's own orders, sends the emails through Resend to the address on the order or booking, and records each send so nobody is mailed the same email twice. They arrive under the shop's name, from a no-reply address on our domain, so replying to one reaches nobody. These are the shop's messages, not ours: the shop is responsible for what it sends and is the right party to ask to stop. These emails do not yet carry an unsubscribe link, so if you want them to stop, tell the shop, or contact us at hello@tendto.you and we will pass your request to the shop and follow it up.

Referrals

Tend runs a referral programme. If you sign up through someone's referral link, we record which referrer it was against your account, along with the terms in force at that moment, so any discount you were promised is applied and any commission owed can be calculated. Commission is worked out from your Tend subscription invoices. A referrer sees how many shops they have referred and what they have earned, and, where a referral has to qualify, whether it did. Referrers are paid through their own Stripe Connect account. Your DMs, your customers, and your sales are never visible to a referrer.

The mobile app

Our mobile app for iOS and Android can, with your permission, use some of your device's features:

• Location: optional, and used only while the app is open, to show shops and availability near you. If you don't grant it, we fall back to the approximate IP-based location described above.
• Camera: used only to scan ticket QR codes at event check-in. Nothing is recorded; the code is read on the device.
• Photo library: used when a shop owner adds product or shop images, sends a photo to the assistant, and when a buyer attaches photos to a review.
• Microphone and speech recognition: optional, for shop owners designing their storefront in the app, so you can say what to change instead of typing it. Once you grant it, the microphone listens while the design assistant's bar is open and not busy; tapping the bar to type turns it off, and the moving bars show when it is on. Speech is turned into text by your phone's own speech service (Apple's or Google's), the same one the keyboard's dictation key uses, which may process it on their servers. We receive only the resulting text, never the audio.
• Notifications: optional. We ask only at a moment where it is useful, never on first launch, and you can turn individual topics off in Settings or revoke the permission entirely in your device settings.

On your device, the app keeps your session token, your cart, your last known location, and cached images in the app's own sandboxed storage. If the app crashes, a report is sent to Convect's self-hosted error tracker; it includes a trail of the recent screens and taps, scrubbed of account identifiers (such as your email and IP address) before it leaves your device. The app records the same first-party product-analytics events as the web (see Product analytics below). The app can also receive over-the-air updates to its code from us.

The app contains no advertising or tracking SDKs and does not track you across other apps or websites.

Google API user data

Tend's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Specifically:

• We use Google Calendar data only to provide the calendar sync feature you opted into, reflecting your Tend bookings on your phone & desktop alongside the rest of your life.
• We do not transfer Google user data to any third party except as necessary to provide that feature, comply with applicable law, or as part of a merger or acquisition with equivalent privacy protections.
• We do not use Google user data to serve advertisements.
• We do not allow humans to read Google user data unless we have your explicit consent for a specific message, it is necessary for security investigations or to comply with law, or it is aggregated and de-identified for internal operations.

You can disconnect Google Calendar at any time from Settings → Calendar in Tend, or by revoking access at myaccount.google.com/permissions. On disconnect we revoke our token at Google and delete the encrypted token + email from our database. The Tend calendar in your Google account remains under your control; you can delete or keep it as you wish.

Connecting Tend to your own tools

A shop owner can create an access token, or authorise an outside assistant or app to connect to Tend (for example over MCP). A connection like that acts with your own access to your own shop: whatever you can see and change, it can see and change. We store the application's registration, which permissions you granted it, when a token was last used, and a hash of the token itself, never the token in readable form. Revoke a connection at any time from Settings. Anything you send to an outside assistant is then subject to that assistant's own privacy policy, not this one.

Subprocessors

We rely on a small set of providers to run the service:

• Meta Platforms: the source and delivery channel for Instagram DMs and comments, and for WhatsApp messages and calls. The one-time codes that verify your phone number, the flag notifications sent to you, and the owner calls themselves are all carried over WhatsApp.
• Amazon Web Services(EU, Ireland): serverless compute, queueing, storage, AI inference, and SMS, plus the servers that run each assistant's own computer, the private store where a sleeping computer is saved, and the web search and browser service the assistant uses. Media (product and shop images, event covers, buyer review photos, and the Instagram attachments, posts and stories mirrored from your account) is stored in S3 and served over unguessable public links. A separate, private store holds the AI request / response and marketplace search diagnostics described above, and another private store holds our first-party analytics events. AI inference runs on AWS Bedrock, in-region, except the dashboard and app assistant's model, which runs through Bedrock's global cross-region service. Amazon SNS delivers verification codes by SMS.
• Anthropic: the AI model provider (Claude), used only through AWS Bedrock, for classification, drafting, cart-building, describing posts and stories, marketplace search, the storefront Ask box, the storefront design assistant, turning owner-call answers into replies, and the Tend assistant shop owners talk to.
• Cohere: the embedding model (through AWS Bedrock, in-region) that turns marketplace shop content, shopper searches and taste profiles into vectors for semantic search and ranking.
• Google: several services. Sign-in (name, email, account id); Google Calendar sync (the single “Tend” calendar only); Maps Places autocomplete (the address text a customer types at checkout is sent to Google under a per-session token) and Geocoding (turning a delivery address into coordinates); Gemini Live (the audio model used during owner calls); Google Wallet (event passes are issued through Google); and Firebase Cloud Messaging, which delivers push notifications to Android devices.
• Apple: Sign in with Apple (in the mobile app), Apple Wallet passes, and the Apple Push Notification service, which delivers push notifications to iPhones and iPads.
• Expo: hands our push notifications to Apple and Google for delivery, and serves over-the-air updates to the mobile app. It receives the device token and the notification's contents.
• Stripe: processes your Tend subscription payments and, via Stripe Connect, the card payments shops take from their own customers, which Tend collects and then transfers on to the shop, and wallet top-ups shops make with their own money. Stripe handles the card details; we never see card numbers, only Stripe identifiers, subscription state, and per-order payment status.
• Paystack: a live payment rail for shops in supported regions. Each shop gets its own Paystack subaccount and transfer recipient. The payer enters their card details on Paystack's own hosted page; Tend never sees card numbers.
• Photon by Komoot (komoot.io): turns location-search text into places. The text is sent straight from your browser or the app.
• OpenFreeMap and CARTO: map backgrounds. Your browser or app requests map tiles from them directly.
• ipwho.is: works out an approximate location from your IP address, in the mobile app, and on the website when our hosting provider doesn't already tell us the city.
• Resend: sends our transactional emails (verification and password-reset emails, order-confirmation, dispatch and refund emails to buyers, sale notifications and a trial-ending reminder to owners) and the emails a shop sends its own customers. We do not send marketing email of our own.
• Shopify: for shops that connect Shopify, syncs the product catalogue only (read-only product access). No customer data is exchanged.
• Eventbrite: for shops that connect Eventbrite, imports event listings using the connecting owner's own Eventbrite identity. Imported events link out to Eventbrite; Tend does not take those ticket payments.
• Acuity Scheduling: for shops that connect Acuity, we receive the connecting owner's Acuity identity (name, email), the shop's appointment types and booking questions, and its appointments, including each customer's name, contact details, and notes. Bookings customers make through Tend for those services are sent to the shop's Acuity account with the customer's name, contact details, and answers.
• Packlink and Intersoft Sapient (for An Post): shipping. When a shop buys a label, the recipient's name, address, and contact details are sent to the shipping account the shop has connected and printed on the label.
• Vercel: hosts the web app and, for shops on a custom domain, serves that domain.

We previously offered SumUp as a payment rail. We no longer process new SumUp payments. We keep historical SumUp payment records, and the stored SumUp credentials are retained only to complete the wind-down.

Cookies & local storage

We use a session cookie (set by our authentication library) to keep you signed in; the mobile app holds the equivalent token in its own storage. A few other first-party cookies do one job each: one per shop that remembers your cart for 30 days, one that remembers which referral link you arrived from for 30 days, and short-lived ones (about ten minutes) that protect a connection to Stripe or Shopify while you set it up. On the payment form, Stripe may set its own cookies to prevent fraud, under Stripe's privacy policy. We do not use third-party advertising or analytics cookies, and no tracking pixels or cross-site trackers, so there is no consent banner to click through. The app also keeps non-tracking UI preferences in browser storage, and two first-party analytics identifiers: a session id that resets when you close the tab, and a random device id that persists between visits so we can tell a returning visitor from a new one. Neither carries your name, email, or account id, and you can clear both by clearing site data. Fonts are served by us, not fetched from a third party as you browse.

Product analytics

To understand what's useful and improve the product, above all which results and features people actually engage with, we collect a small set of first-party interaction events as you use Tend on the web and in the mobile app: that a card or element was shown (an impression) or tapped (a click), which kind of element it was, and which screen you were on. This covers both the marketplace and the shop dashboard.

These events are first-party and self-hosted: they are sent only to our own infrastructure on AWS (eu-west-1), never to any third-party analytics or advertising service, and they are used only to measure and improve Tend. Each event carries the two anonymous identifiers described above (a per-session id and a per-device id), the identifiers of the shop, product, or element involved, the screen, and a timestamp. Where you run a search or tap a suggested prompt, the text you entered is included too. Events never contain message content or your customers' data. We keep them for about 13 months, after which they are deleted automatically.

These events are never joined to your name or account id, and we use them for aggregate analysis rather than to build a picture of a named person. The one place Tend does personalise for an individual is your marketplace feed, which is described under Your feed and personalisation above and runs on your account rather than on these events.

Your rights

You can:

• Disconnect a linked account at any time: Instagram via its Settings → Apps and Websites, or Google via your Google account permissions. We'll receive the deauthorization signal (or revoke our own token) and immediately drop the linked credentials.
• Revoke Sign in with Apple from your Apple account settings. Apple notifies us, and we delete the link and sign your Tend sessions out.
• Turn off any notification topic, or any channel within it, in Settings, and revoke push permission in your device settings.
• Request access, correction, export, or deletion of all data associated with your account by emailing hello@tendto.you. We carry that out within 30 days. See our data-deletion page for how to make the request, and for the few things that outlive an account.
• Use Meta's data deletion request flow; we honour those via the data-deletion callback registered with our Meta app.
• If you're in the EU/UK, you can lodge a complaint with your local data protection supervisory authority. The Irish Data Protection Commission is our lead authority.

Customers of your shop

If you messaged or bought from a shop that uses Tend: your messages and order details reach Tend only because you chose to contact or buy from that shop. Your shop is the controller of that content and is the right party to handle deletion or access requests in the first instance. You can also contact us directly at hello@tendto.you and we'll route or action the request as appropriate.

Children's privacy

Tend is a tool for shop owners and their customers and is not directed at children. We don't knowingly collect personal data from anyone under 16. If a customer message arrives that you believe came from a child, treat it according to your local rules and contact us if you need the data removed.

Data location and retention

Tend's own systems run in the European Union: the database, all stored files, the analytics and diagnostics stores, the assistant's computers and their saved copies, and the Claude models we call, all in AWS eu-west-1 (Ireland), with the web app on Vercel in Dublin. That is where your data lives.

Some processing happens outside the EEA in the course of doing the job it is there for. The model behind the dashboard and app assistant is reached through AWS Bedrock's global cross-region service, so a request to it can be processed in an AWS region outside the EU, though nothing is stored there. And, depending on the feature you use, personal data reaches Google, Apple, Expo, Resend, Stripe, Paystack, Shopify, Eventbrite, Acuity, ipwho.is, CARTO, and Vercel. Those transfers rely on the safeguards in each provider's own data processing terms, in most cases the European Commission's standard contractual clauses, or on an adequacy decision where one covers the country in question.

Your DM and comment messages are kept for as long as your account is active. When you ask us to delete your account, we carry that out within 30 days; backups roll off within 90 days.

Some things keep their own clocks. The AI request / response and marketplace search copies described above expire automatically within 180 days, and outlive account deletion only until that expiry. Product-analytics events are kept for about 13 months. Questions asked through a storefront's Ask box are deleted after about 90 days. Your conversation with the assistant, its memory, and its computer (including any saved copy) are kept while your account exists and deleted with it. Reviews you wrote and reports you filed are unlinked from your account on deletion but are not erased, for the reasons given in their sections above; the same is true of an order's record on the shop's side, which the shop keeps as its own business record. See our data-deletion page for how to request deletion of your account and data.

Security

Access tokens are stored encrypted at rest, under a key managed with AWS KMS. Tokens you create for outside tools are stored only as a hash. Webhook payloads are verified against the sending platform's signature, or, where a platform sends none we can check, treated only as a prompt to fetch the real record from that platform with the shop's own access. Each assistant computer is a separate virtual machine, its saved copies are encrypted under a key managed with AWS KMS, and every instruction our servers send to one is signed. Connections to our database are TLS-encrypted, and infrastructure access uses IAM-scoped credentials. When our AI features query your data, they do so through restricted, shop-scoped database views rather than direct table access. Error and crash reporting runs on Convect's own infrastructure, and reports are scrubbed of account identifiers (emails, IP addresses, and cookies) before they are stored (on mobile, before they leave your device). No system is perfectly secure; we'll notify affected accounts without undue delay if we become aware of a breach.

Changes to this policy

We'll update this page when our practices change and bump the “Last updated” date above. Material changes will be communicated to active accounts via email.

Contact

Questions? Reach us at hello@tendto.you.