Privacy Policy
Last updated: 15 November 2026
1. Who we are
StoreWave (storewave.gr) is owned and operated by RocketSavvy, a company based in Toronto, Ontario, Canada (rocketsavvy.com) ("RocketSavvy", "we", "us"). We are the controller of the personal data described in this policy. StoreWave is a business-to-business service. It is not established in Greece or elsewhere in the European Union, but it is offered to businesses in the EU, so the EU General Data Protection Regulation (GDPR) applies to our handling of your data (Article 3(2) GDPR), together with Canada's PIPEDA and applicable Ontario law. Privacy contact: use the self-service tools in your account (Settings > Privacy and your data) or write to us through the contact details published at rocketsavvy.com, marking your message "StoreWave privacy".
2. Scope and our two roles
• As controller, we decide why and how we use your account, billing, usage and security data. This policy mainly covers that data. • As processor, we handle content you place in the service (for example promo texts or recordings that may mention staff members) only on your instructions. You are the controller of that content, and we handle it under Article 28 GDPR. A data processing agreement is available on request. StoreWave is intended for business customers and their staff. It is not directed to children, and we do not knowingly collect data from anyone under 18.
3. Data we collect
• Account data: name, business email, optional mobile number, language preference, login credentials handled by our authentication provider. • Business and billing data: company name, billing address, VAT/tax identification number, invoices, plan, credit balance and payment status. Card numbers are entered directly with Stripe and are never stored by us. • Content you create: store names and cities, playlists, songs you generate or upload, promotion texts and audio files, prompts and lyrics you submit. • Usage and technical data: generation requests and results, credit ledger entries, timestamps, IP address, browser and device type, error and security logs. • Communications: transactional emails and SMS we send you and their delivery status, and any message you send us. • Consent records: your cookie choices, language and time of the choice. We do not collect special-category data and ask you not to put personal data of third parties, or any sensitive data, into prompts, lyrics or promo texts.
4. Why we use your data and our legal bases
• To create your account, provide the player, generate music and voice announcements, and manage plans and credits (performance of the contract, Art. 6(1)(b) GDPR). • To take payments, issue invoices and keep accounting and tax records, including VAT reverse-charge documentation (legal obligation, Art. 6(1)(c)). • To send service messages by email and SMS, such as welcome, payment and low-credit notices (performance of the contract and our legitimate interest in keeping you informed, Art. 6(1)(b) and (f)). • To secure the service, prevent fraud and abuse, enforce limits and fix errors (legitimate interests, Art. 6(1)(f)). • To improve the service through aggregated analytics (your consent, Art. 6(1)(a), and cookie rules of the ePrivacy Directive). • Marketing messages, if we ever send them, only with your consent or where the law allows for existing business customers, always with a free opt-out. Where we rely on legitimate interests we have weighed them against your rights and you may object at any time (see GDPR Rights).
5. AI generation
To create songs and voice announcements, the prompts, genres, moods, lyrics and promo texts you submit are sent to the technology suppliers behind the StoreWave AI engine, which return the audio. They process this data only to deliver the result for us. We do not use your private content to build profiles about you, and no decision with legal or similarly significant effects is taken about you solely by automated means (Art. 22 GDPR).
6. Who receives your data
We do not sell personal data. We share it only with: • Our application hosting and database platform provider. • Stripe, for payments, subscriptions, invoices and tax-ID collection. • Email delivery and SMS delivery providers (SMS is sent through sms.net.gr, a Greek provider, only if you saved a mobile number). • AI music and voice generation suppliers (see section 5). • Professional advisers (accountants, lawyers) and authorities where the law requires it. Each supplier acts under a contract that limits use of the data to our instructions, or as an independent controller in the case of Stripe for its own payment, anti-fraud and legal duties.
7. International transfers
We are located in Canada. The European Commission has recognised Canada as providing adequate protection for commercial organisations subject to PIPEDA (Decision 2002/2/EC), so transfers of your data from the EU to us rely on that adequacy decision. Where our suppliers process data in the United States or other countries, they rely on the EU-US Data Privacy Framework, Standard Contractual Clauses (Art. 46 GDPR) or another valid transfer mechanism. You can request a copy of the safeguards that apply.
8. How long we keep data
• Account, store, playlist, song and promotion data: while your account is active. When you delete your account in Settings, this content is erased immediately; backups are overwritten within 35 days. • Invoices, payment and credit records: 7 years, to meet accounting and tax obligations. • Consent records: up to 5 years, to prove your choices. • Security and error logs: up to 12 months. • Messages and support correspondence: up to 3 years after the last contact.
9. Security
We use encryption in transit, access controls, per-customer data isolation, private storage for your files and signed, expiring links to open them. No system is perfectly secure; if a personal data breach affects you, we will notify you and the competent authority within the deadlines set by Articles 33 and 34 GDPR.
10. Your rights
You can access, correct, export or delete your data, restrict or object to processing, and withdraw consent at any time. Most requests can be done yourself in Settings > Privacy and your data. Full details are on our GDPR Rights page.
11. Cookies
We use essential storage and, only with your consent, analytics. See the Cookie Policy and use Cookie settings in the footer to change your choice.
12. Complaints
If you are unhappy with how we handle your data please contact us first. You may also complain to your supervisory authority, for example the Hellenic Data Protection Authority (dpa.gr) in Greece, or to the Office of the Privacy Commissioner of Canada (priv.gc.ca).
13. Changes
We may update this policy when our service or the law changes. The date at the top shows the latest version. For material changes we will notify account holders by email or in the app.