WaveGo Privacy Policy

Last updated: 28 September 2026

WaveGo is operated by Växthuset Utemiljö i Täby AB, organisation number 5565899167 ("WaveGo", "we"). WaveGo is a Shopify app that connects suppliers with retailers for dropshipping. This policy explains what personal data we process, why, who receives it, and your rights. It applies alongside our Data Processing Agreement and Data Processing Terms.

1. Our two roles

• For your end customers' order and delivery data, you (the retailer) are the controller and WaveGo acts as your processor, processing on your documented instructions to help fulfil orders.
• For your own retailer/supplier account, subscription, billing, security, fraud-prevention and business purposes, WaveGo is the controller.
• A supplier you activate or order from processes data for its own purposes after it lawfully receives it; its GDPR role depends on the actual processing and is not always the same.

2. Personal data we process

Retailer company & contact data (that you enter in the app, e.g. in "My Company", or that is needed from your connected Shopify store): company name, registered address, billing address, contact person, email, phone number, organisation/registration number and VAT number; your Shopify store domain and access token; subscription and billing records.

End-customer data (from your orders, used only to fulfil them): customer name and delivery address (street, postal code, city, country) and phone number, and the products and quantities ordered. We do not store end-customer payment-card details.

Supplier data: name, email, contact details and payout-connection identifiers.

Technical/security data: IP address, log and security-event data.

3. Why we process it

To provide and secure the WaveGo platform; to let you manage suppliers and products; to forward confirmed, paid orders to the supplier you selected; to make your company and billing details available to that supplier so it can identify and where required approve you, process the order, determine the applicable B2B and VAT terms, issue an invoice or credit note to the correct retailer, and handle delivery, complaints and necessary communication; to administer your subscription; to prevent fraud and abuse; and to meet our own legal and accounting obligations. Legal bases: performance of contract, legitimate interests, and legal obligation, as applicable.

4. Who receives data

• The supplier you activate or order from: receives your company and billing details (company name, registered address, VAT and registration number, contact email) to invoice you, and the end customer's name, delivery address and phone number only to the extent needed to fulfil the order. These are made available in connection with an order.
• Shopify: your store and order data via its API (source platform).
• Stripe (Stripe Payments Europe): supplier payments are settled via Stripe Connect to the supplier's connected account; WaveGo receives its platform fee. Stripe receives the transaction data needed to process the payment.
• Operational service providers (e.g. database hosting, application hosting, transactional email) that process data on our behalf to run the platform.

We do not sell personal data.

5. Infrastructure and international transfers

WaveGo uses third-party infrastructure and service providers to operate the platform, including database hosting and backend hosting. These providers process personal data only to the extent necessary to provide their services to WaveGo. Information about relevant service providers, processing locations and applicable safeguards is maintained by WaveGo. Where personal data is transferred outside the EU/EEA, an applicable transfer mechanism under the GDPR is used.

6. Retention and deletion

We keep identifiable personal data only for as long as necessary for the purposes described above and for applicable legal obligations. We handle deletion in accordance with applicable data-subject and platform requests — including Shopify's shop-redaction and customer-redaction webhooks — and applicable law.

• When we receive and process a valid Shopify shop-redaction request, we delete the account and order data held for that store. We may keep a minimal record that the store's operator accepted a supplier's terms and our data-processing terms — the supplier, the versions accepted and the date, without the IP address — for up to ten years, where needed to establish, exercise or defend legal claims.
• On a valid customer deletion or redaction request, we anonymise the affected customer's data in the relevant order (such as the customer's name and address).

Separately, other information may need to be retained for a limited period where required by law (for example accounting or tax records) or where necessary to establish, exercise or defend legal claims; such information is then deleted or anonymised when no longer required.

7. Your rights (GDPR)

You may request access to, correction, deletion, restriction or portability of your personal data, and object to certain processing. For your end customers' data, you are the controller and primary contact and we assist you; for our own controller data, contact us.

8. Cookies

WaveGo uses session cookies required for authentication. We do not use advertising cookies. Our in-app support chat is provided by a third party (Crisp), which may set its own cookies or local storage when you use the chat.

9. Contact

Data-protection enquiries: info@wavego.eu — Växthuset Utemiljö i Täby AB, Sweden.