Privacy Policy
This policy explains what personal data Valigara Online Ltd. (“Valigara”, “we”) handles when you use the Valigara platform — the Valigara manager at manager.valigara.com, the Valigara API and MCP server, and websites we build for our customers — and our website www.valigara.com. It also explains what happens when you connect an AI assistant to your Valigara account.
Valigara Online Ltd., HaMaklef 3, Suite 6, Haifa 3125301, Israel.
Our two roles
Your business data. Our customers are jewellery businesses. The products, listings and orders a customer keeps in Valigara — including the personal data of the customer’s own buyers — belong to the customer. The customer decides what is collected and why; we process it on the customer’s behalf, as a processor, under our Data Processing Addendum.
Our own records. For the accounts and users of our customers, and for visitors to our website, we decide how the data is used and are responsible for it as a controller.
What we collect
Account and user data — names, business contact details (company, phone, postal and email address) and sign-in details of the people who use Valigara, and a record of their activity, such as sign-ins and changes they make.
Customer content — products, images, listings, stock, orders and the rest of the data a customer puts into Valigara or brings in from connected sales channels. Orders carry the personal data of the customer’s buyers: names, email addresses, phone numbers, postal addresses and order details. Customer content may also include business contacts of the customer’s partners, vendors and clients.
Connection credentials — the credentials a customer supplies so Valigara can work with their sales channels and other services. We store them encrypted.
Technical data — IP addresses, and records of requests made to the platform, the API and the MCP server, kept for security, troubleshooting and support.
Website — the details you enter in our forms (for a demo request: first and last name, company, email address and phone number), your conversations with our website chat, and information collected by cookies — see Cookies on our website.
How we use it
We use personal data to provide the Valigara service: to sync products, listings and orders with the sales channels a customer connects, to fulfil and ship orders, to produce invoices and send emails the customer sets up, and to support our customers. We also use it to keep the service secure, to prevent and investigate misuse, and to meet our legal obligations.
We process customer content only on the customer’s instructions and as needed to provide the service. We do not sell personal data, and we do not use customer content to train AI models.
AI assistants (MCP)
You can connect an AI assistant, such as Claude or ChatGPT, to your Valigara account through our MCP server. An assistant is connected only when a user of your account does it — by signing in and approving it, or by creating an MCP access key.
What the assistant can access. Using the MCP tools, the assistant can read and change your account’s data — products, listings, orders, gemstones, stock and batches — including the buyer details stored on your orders and customer records. It acts as the user who connected it. Most tools work across the whole account, whatever that user’s role.
Where the data goes. When the assistant uses a tool, we send the result to the assistant provider you chose. From then on, that provider’s own terms and privacy policy apply to it. The provider is chosen by you, not by Valigara, and is not one of our subprocessors. We never receive your conversation with the assistant — only the tool requests the assistant sends us.
What we keep. For each connection: the name and return address the assistant registered with, which user approved it and when, and an access key listed in My Account → API. Sign-in codes and renewal tokens are stored only as one-way hashes; access tokens are not stored at all. For each tool request: which tool, which user and key, the information sent with the request, whether it succeeded and how long it took. We keep these records with our other logs, for security, troubleshooting and support.
Ending a connection. Remove the assistant’s key in My Account → API to cut its access immediately. A connection that is not used for 30 days also stops working, and the assistant has to be signed in again.
Who we share it with
Subprocessors. We use a small number of service providers to run the platform: hosting, backups, email delivery and customer support. They are listed, with their locations, on our subprocessors page, and they process personal data only to provide their service to us, under written agreements.
Services you connect. When a customer connects a sales channel, a shipping or accounting service, an email marketing tool or an AI assistant, we send that service the data needed for what the customer asked it to do. Those services act under their own terms.
AI features. Valigara’s optional AI features — content generation, image enhancement and insights — run on AI models from OpenAI, Anthropic or Google. The provider receives what the feature needs: product details and images, and, for insights, sales figures aggregated per channel and account (such as order counts, sales and profit). We do not send individual orders or buyer personal data to these providers.
The law. We disclose personal data when the law requires it.
Where it is stored and how it is protected
The platform and its database run on servers in Germany (Hetzner). Backups and a long-term legal archive are kept in Amazon Web Services storage in Sweden (eu-north-1).
Data is encrypted in transit (TLS 1.2 or higher) and at rest (AES-256). Particularly sensitive fields, including connection credentials, are also encrypted individually. Access to production systems is limited to authorised personnel, through personal accounts with multi-factor authentication, and is logged. We monitor the platform, and test it regularly for vulnerabilities.
How long we keep it
Customer content is kept while the customer’s account is active, or until the customer deletes it. When a customer leaves, we delete or return their data at their choice, except where the law requires us to keep it. Database backups expire after 30 days.
Buyer data from Amazon is removed from the live system 30 days after the order is closed, and never later than 90 days, and replaced with masked values. The original is kept in an encrypted archive for 7 years to meet tax and legal obligations.
Buyer data from eBay and Shopify is masked or deleted when the marketplace notifies us of a deletion request. Buyer data from other sources is kept for as long as the customer keeps it.
Logs — including records of API and MCP requests — are kept for up to 12 months.
Cookies on our website
On www.valigara.com, we and our partners use cookies and similar technologies:
Analytics — to understand how the website is used: Google Analytics, Yandex Metrica, Hotjar and Cloudflare Web Analytics.
Testing — to compare versions of our pages: VWO.
Advertising — to measure our campaigns and show our ads on other websites: Google Ads, Meta (Facebook), LinkedIn, Quora and HubSpot.
Forms, chat and pop-ups — HubSpot (forms, chat and the cookie banner) and Poptin (pop-ups).
Security — Google reCAPTCHA, to keep spam out of our forms.
The first time you visit, a banner asks you to accept or decline these cookies. If you decline, one cookie remembers your choice. You can also delete cookies or block them in your browser at any time.
Details you send through our website forms and chat go to our customer relationship system (HubSpot), which we use to reply to you and to follow up.
Your rights
Depending on where you live, you may have the right to access the personal data we hold about you, to correct it, to have it deleted, to restrict or object to its use, and to receive a copy of it. You can also complain to your data protection authority.
If you are a buyer from one of our customers, your data belongs to that jeweller: please contact them. If you contact us instead, we will pass your request on to them.
If you are a Valigara customer or user, contact us at the address below.
International transfers
Valigara is based in Israel, which the European Commission recognises as providing adequate protection for personal data. Our servers are in the EU. Where personal data moves from the EU, the UK or Switzerland to a country without such recognition, we rely on the Standard Contractual Clauses, as set out in our Data Processing Addendum.
Children
Valigara is a service for businesses and is not directed at children. We do not knowingly collect personal data from anyone under 16; if we learn that we have, we delete it.
Changes to this policy
We will post any change on this page and update the date below.
Contact
Questions and requests about privacy: security@valigara.com
Valigara Online Ltd., HaMaklef 3, Suite 6, Haifa 3125301, Israel
Last updated: September 29th 2026
