Privacy policy
Last updated: 16 October 2026. Controller: Ardenns Capital S.à r.l., 12C, Rue Guillaume J. Kroll, L-1882 Luxembourg, Luxembourg, RCS Luxembourg B288949. Contact: [email protected].
1. What Lens is
Lens (app.lens-source.com) is a product sourcing service. Shop owners ("buyers") use it to find manufacturers for products; manufacturers ("sellers") use it to reach buyers. This policy explains what personal data we process, why, and what your rights are under the General Data Protection Regulation (GDPR).
2. Data we process
| Category | Examples | Purpose | Legal basis |
|---|---|---|---|
| Account data | Name, e-mail address, password (hashed), company name, country | Creating and securing your account, contacting you about the service | Contract |
| Shop connection data | Shop domain, platform (Shopify, WooCommerce or other), access tokens or API keys, product catalogue (titles, descriptions, images, prices, SKUs) | Matching your products to manufacturers; writing product text back to your shop only when you request it | Contract |
| Search data | Photos, texts and URLs you submit, search results, favourites, notes | Providing search results and your history | Contract |
| Messages | Messages, quote requests and attachments exchanged through Lens | Enabling contact between buyers and sellers | Contract |
| Payment data | Invoices, transaction references, credit balance; card details are handled by our payment provider and never stored by Lens | Billing, accounting | Contract, legal obligation |
| Technical data | IP address, browser, device identifiers, log data, error reports | Security, abuse prevention, rate limiting, improving the service | Legitimate interest |
We do not process data of your shop's customers (consumers). Shop connections are limited to product and shop data. Where a platform sends us consumer data anyway, we delete it on receipt.
3. Shop connections (Shopify, WooCommerce and others)
When you connect a shop, the platform issues Lens an access token limited to the permissions you approve (reading products, and writing products if you enable that). We store tokens encrypted. We read your catalogue to build matches and, if you use the write-back feature, write only the fields you select. You can disconnect at any time from your Lens dashboard or by uninstalling the app in your shop platform. Within 48 hours of disconnection we delete the access token, the imported catalogue and the matches built from that catalogue. Messages you exchanged with manufacturers remain in your Lens account until you delete them.
For Shopify, Lens implements the mandatory compliance webhooks: when a merchant uninstalls the app, or when Shopify forwards a data request or deletion request, we respond within the required period.
4. Sharing
We share data only with processors who act on our instructions: hosting and storage providers (EU or with EU standard contractual clauses), our e-mail delivery provider, our payment provider, error-monitoring tools, and the AI service providers named in section 5. Buyers and sellers see each other only through anonymised codes, and that does not change when a conversation starts: a manufacturer's name and link are never revealed to a buyer. All contact runs through the platform. We never publish a shop's domain or a manufacturer's identity without that party's action. We do not sell personal data.
5. AI service providers
Parts of Lens use external AI models. These providers receive only the data listed here, only when the feature runs, and act on our instructions as processors. We do not send them your account data (name, e-mail, password), your access tokens or payment data.
| Provider | What it receives | Purpose | Where |
|---|---|---|---|
| Alibaba Cloud (Model Studio / DashScope; Qwen models) | Search texts you type; photos you upload for a search (only when the search needs a visual description or check); product titles, descriptions and images of a connected shop when you ask Lens to match, describe or write a listing; the texts you give the listing, advertisement and SEO tools; the search text and message snippets of your own conversations when you use message search; product photos and text that sellers submit for verification | Understanding a search, describing and checking product photos, generating listing, advertisement and SEO text, searching your messages, verifying seller listings | Alibaba Cloud's United States endpoint (dashscope-us.aliyuncs.com) |
| Google (Gemini API) | A product photo and a text instruction, when a seller asks Lens to generate an advertisement image; and, for our own internal quality measurements, product titles from our public catalogue (no account, shop or message data) | Generating the advertisement image the seller requested; measuring the quality of our own search results | Google's Generative Language API; Google decides the processing location |
We have no other AI provider at the moment. If we add one, we will name it here before it receives data.
6. Retention
Account data: for the life of the account and 12 months after closure. Shop connection data: until disconnection, then deleted within 48 hours. Messages and search history: until you delete them or close your account. Invoices: 10 years (Luxembourg commercial and tax law). Logs: 90 days.
7. Your rights
You can access, correct, export or delete your personal data, object to processing based on legitimate interest, and withdraw consent where consent applies. Most of this you can do from your dashboard; for anything else write to [email protected]. We answer within 30 days. You can complain to the Luxembourg data protection authority, the CNPD (Commission nationale pour la protection des données).
8. Security
Data is transmitted over HTTPS. Shop access tokens and API keys are encrypted (AES-256-GCM) with a key held separately from the database; other data in the database is not encrypted at the application level. Access to production systems is limited to named staff with two-factor authentication.
9. Cookies
Lens uses only functional cookies and local storage needed to keep you signed in and remember your settings. We do not use advertising cookies.
10. Changes
We will announce material changes to this policy by e-mail or in the dashboard before they take effect.