Privacy Policy

1. Who provides Lajfka

In this policy, “Lajfka”, “we” and “us” refer to this sole trader. “Merchant” means the business selling goods through a Facebook Page or a connected store. “Customer” means a person interacting with that merchant or placing an order.

This policy covers Lajfka's merchant tools, customer order pages and connected Facebook/Messenger functionality, including enabled mobile and live-selling features. It also applies to people whose comments or messages reach Lajfka even if they never create a Lajfka account or use Facebook Login.

2. Our role and the merchant’s role

We determine how we handle our own merchant administration, service billing, support and legal obligations. For those activities, we act as a data controller.

The merchant generally determines why its customers' information is used to sell goods, manage reservations and orders, issue invoices and provide customer service. For these activities, we provide technology and process customer data on the merchant's instructions. The merchant's privacy notice explains its own processing and legal bases. A merchant's responsibility does not remove our obligations as Lajfka's operator or under Meta's terms.

You may contact us directly about information held in Lajfka. Where a request concerns a merchant's processing, we will coordinate with the relevant merchant rather than require you to have a Lajfka login.

3. Information we process and where it comes from

The information depends on the merchant's connected services, the permissions it grants and the features you use.

• Merchant and connection information: merchant contact details, store identifiers, authorized staff/accounts, Facebook account and Page identifiers, Page names, access permissions and access credentials issued for the integration. This comes from the merchant, Shopify and Meta's authorization services. We do not ask you to send us your Facebook password.
• Facebook interactions: the identifiers and content of relevant posts, comments and messages, timestamps, interaction and delivery events, and customer identifiers, names and available profile pictures supplied by Meta. Connected Page events can also include comments on a Page's posts shared to a group, where Meta makes these available through the authorized integration. Information may originate from public posts/comments or private Page conversations; a public comment is still personal data when it identifies someone.
• Orders and customer information: products and variants requested, quantities, reservations, order references and status, the relationship between a Facebook interaction and an order, and names, contact, billing or delivery details supplied by the customer, merchant or connected store. We do not obtain a customer's address, telephone number or email merely because that customer posts a sales comment.
• Live-selling content, where enabled: broadcast titles, session identifiers, status and related content. If a broadcaster uses mobile live publishing, camera and microphone permissions enable transmission of the audio/video the broadcaster chooses to publish to Meta. Permission can be managed in device settings.
• Service and diagnostic information: requests, event-processing records, errors, device/browser details, network information and URLs, performance information, and session replay data where enabled. Diagnostic context can contain identifiers or interaction/order information. Sentry's replay configuration masks text and blocks media; this does not make all diagnostic data anonymous.
• Communications with us: support correspondence and information supplied in privacy or security requests.

Please avoid putting sensitive personal information or payment-card details in sales comments, messages or support requests. Public comments remain subject to the visibility controls of Facebook and the merchant's Page.

4. How and why the information is used

• Connect the merchant's chosen Facebook Page and store, verify authorization and manage the integration.
• Interpret the merchant's sales commands, match products and quantities, manage availability and reservations, and create or update the appropriate customer's draft order or order.
• Show the merchant relevant customer interactions and order information, provide an order or checkout link and handle customer-requested order communication through the connected Page.
• Synchronize necessary customer and order information with Shopify and, when instructed by the merchant, its invoice or fulfilment services.
• Operate enabled live-selling tools and publish content the merchant chooses to broadcast.
• Maintain service reliability, investigate errors and security incidents, provide support, administer the service and meet applicable legal obligations.

What a sales comment means: when a merchant invites customers to comment a product code or another stated command, Lajfka may interpret that command as a request for a reservation or draft order under the merchant's displayed sales terms. The merchant determines when a purchase becomes binding. A sales comment is not blanket consent to unrelated advertising or profile enrichment.

Meta-derived data is used for the relevant merchant's service, not to sell data, build unrelated cross-merchant profiles, perform surveillance or determine eligibility for employment, credit or similar opportunities. Any use to build or augment a user profile requires the valid consent required by Meta's terms.

Automated product matching, quantity allocation and draft creation follow the merchant's configured rules and stock availability. A mistaken match or reservation can be raised with the merchant or with us for human examination and correction.

5. Legal bases and choices

For processing we control, the applicable basis depends on the purpose:

• Contract or requested pre-contract steps (GDPR Article 6(1)(b)): providing and administering Lajfka where the individual concerned is our contracting customer.
• Legitimate interests (Article 6(1)(f)): managing business contacts, assisting merchant staff, protecting the service and resolving operational issues, where necessary and balanced against individuals' rights. These interests do not authorize a use of Meta data prohibited by Meta's terms.
• Legal obligations (Article 6(1)(c)): applicable accounting, tax and other binding legal requirements.
• Consent (Article 6(1)(a)), where required: optional tracking or another optional activity that requires consent. Consent can be withdrawn without affecting the lawfulness of earlier processing.

For customer orders processed on a merchant's instructions, the merchant establishes and explains the appropriate basis, such as steps requested by the customer, performance of the sale contract or a legal accounting obligation. We do not treat merchant authorization through Facebook Login as the customer's consent to every possible use of their data.

You do not have to use comment-based ordering. Necessary order details are required to process an order; withholding them may prevent the merchant from completing it. A merchant can revoke Meta permissions or disconnect its Page, which may stop the related features. Revocation does not itself erase records already held by the merchant or Lajfka; deletion can be requested as described below.

6. Who receives information

Data is available to the relevant merchant and authorized people supporting its service. Connected services receive information needed for their role:

Shopify and invoice services may be contracted directly by the merchant. Additional fulfilment or other integrations receive information only where the merchant enables and directs that flow; the merchant's notice should identify the providers it uses.

Meta receives API requests and content needed to authorize the integration, send Page messages and publish merchant-selected content. Meta's own processing is explained in Meta's Privacy Policy.

We require applicable agreements to restrict service providers to the authorized service and provide appropriate confidentiality, safeguards and deletion. Disclosure to public authorities is limited to applicable legal requirements, with the legal basis and scope assessed for the particular request.

7. Processing locations and international transfers

Lajfka's configured Hetzner hosting and backups are in Germany, and its operator is based in the Czech Republic. Our Sentry projects store service data in the EU/Germany region. These storage locations do not mean that all processing by connected providers occurs only in those countries.

Shopify and Sentry operate internationally. Their services and support may involve processing outside the European Economic Area, including in the United States. Other recipients and subprocessors may also process information internationally under their applicable arrangements.

For transfers requiring a GDPR transfer mechanism, we require a valid European Commission adequacy decision or appropriate safeguards, such as the Commission's Standard Contractual Clauses and any necessary supplementary measures. A provider's EU storage region alone is not such a mechanism for all remote access. Contact [email protected] for information about relevant destinations and the applicable safeguards or a copy of them, subject to necessary redactions.

8. Retention

Retention is determined by the information's purpose, the merchant's instructions, applicable law and Meta's requirements. We do not use one blanket period for every record.

• Connection information and credentials: only while needed for the authorized connection or its secure termination.
• Comments, messages, customer mappings and order-processing records: only while needed for the merchant-directed interaction, reservation, order or related support. Raw interaction content is not an accounting record merely because it led to a sale.
• Queues, logs and diagnostics: only for the period necessary to process or recover an event, resolve an issue or protect the service. Failed processing records are removed when no longer needed for recovery or investigation.
• Accounting and legally required records: only the records and fields required for the applicable statutory period. A merchant's accounting obligations may apply to its invoices independently of Lajfka's service records.

We delete Meta Platform Data promptly on a valid user or Meta request, and as soon as reasonably possible when it is no longer necessary, when the applicable client relationship ends or when the service through which it was obtained stops, unless applicable law requires particular data to be kept. We document any legal exception and limit it to the necessary data and period.

We include relevant operational copies, queues and service providers in deletion handling and prevent deleted information from returning to ordinary use if a backup is restored. We will explain any applicable legal retention exception or remaining backup handling when responding to a deletion request.

9. Your privacy rights

Depending on the legal conditions, you can request access, correction, deletion, restriction or portability of your personal data, and object to processing based on legitimate interests. You may withdraw consent for processing based on consent. You can object to direct marketing at any time.

Send a request to [email protected] or to the registered business address above. We may ask for proportionate information to locate your records and verify your authority. Do not send passwords, access tokens or unnecessary identity documents.

Where we are the controller, we respond without undue delay and normally within one month of receiving the request. If the GDPR permits an extension because of complexity or number of requests, we explain it and the reasons within that first month. Where a merchant is the controller, we assist and promptly coordinate the request with that merchant. Requests are ordinarily free of charge.

You can complain to the Czech Office for Personal Data Protection (Úřad pro ochranu osobních údajů), Pplk. Sochora 27, 170 00 Praha 7, Czech Republic, or another competent supervisory authority, including where you habitually live or work.

10. How to request deletion of Facebook or other Lajfka data

You can request deletion even if you only commented on a merchant's Facebook post and never logged into Lajfka.

1. Email [email protected]. The suggested subject is “Lajfka data deletion request”; using that exact subject is not required.
2. Tell us which merchant, Page or store is involved and provide enough context to find your records, such as an order reference, a link to the relevant comment, or your Facebook profile name and approximate interaction date. Include only information you know; a numeric Facebook ID is not required.
3. State whether you want all your information in Lajfka deleted or describe the specific records. A merchant requesting deletion for its store should identify that store and its authority to act.

We will verify the request proportionately, coordinate with the relevant merchant and providers, and explain the result and any specific legal reason for retaining certain records. A deletion request to Lajfka does not itself remove the original post, comment or message held by Meta. Use Facebook's own controls or contact the Page administrator for those originals.

For a separate, shareable version of these instructions, see Lajfka data deletion instructions. This is an email-based request process; it does not claim that a Meta automated deletion callback has been deployed.

11. Cookies, diagnostics and external services

Service pages may use cookies or similar storage for authentication, security and maintaining the requested session. The merchant's Shopify checkout and Meta's login or messaging services have their own notices and controls.

Sentry diagnostics can record errors, performance information and, where enabled, a masked reconstruction of interactions with service pages. We keep optional tracking that requires consent off until the required choice has been obtained; consent can be withdrawn through the applicable controls. Privacy questions or objections can also be sent to our contact above.

12. Security and communication preferences

We apply safeguards proportionate to the data, including authorized access, protection of integration credentials, separation of merchant data and appropriate transport and storage protection. No system can guarantee absolute security. Report a suspected vulnerability or exposure to [email protected]; please do not include live access credentials or other people's data in an initial report.

Customers can ask the merchant or email us to stop further automated messages and can use Messenger's controls to manage or block the Page. We will coordinate the request for the relevant Page and customer. Required order or legal communications may need another suitable channel. A customer interaction does not authorize unlimited future Messenger messages: we limit messages to those permitted by Meta's current eligibility rules.

13. Changes to this policy

We will identify the revision date when this policy is published and update it when our processing changes. Material changes will be communicated through an appropriate service notice. Where new processing requires consent or Meta review, publication of a revised policy alone does not supply that consent or approval.

For questions about this policy or which merchant holds your information, contact [email protected].