Privacy & Policy

OyaShop Privacy Policy
Effective date: 10/102025 This Privacy Policy explains what personal information OyaShop collects, why we collect it, who we share it with, and the rights you have.
It applies to the OyaShop website (oyashop.app), the OyaShop shopping app, the OyaShop Vendor app, Oya (our AI assistant available through our apps, website and WhatsApp), and every other way you interact with us.
1. Who We Are
OyaShop is a product of MisTech Global Ltd, a company registered in England and Wales (company number 16531283, with its registered office at 1 Erasmus Drive, Derby,, Derby, Derbyshire, United Kingdom, DE1 2DN.
MisTech Global Ltd is the data controller of your personal information under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
For privacy enquiries, contact us at oyashop@mistech.io or write to us at the address above, marked “Privacy”.
2. Who This Policy Is For
This policy applies to:
Shoppers — people who browse or buy on OyaShop.
Vendors — shops that sell on OyaShop and the staff who operate them.
Riders and couriers — people who deliver OyaShop orders.
Ambassadors — people who introduce shops to OyaShop.
Website visitors and other contacts — people who visit our website or contact us.
If a shop records a sale to you at its counter using OyaShop, the shop may enter your name and phone number. This information is also covered by this Privacy Policy.
3. Information We Collect
Information You Give Us
Your account:
We may collect your name, email address, phone number, profile photo and password. Passwords are stored in hashed form, meaning we cannot read your password.
If you sign in using Google, Apple or Facebook, we receive your name, email address and an identifier from that service. We do not receive your password for those services.
Shopping:
We may collect delivery addresses, orders, baskets and wish lists, including baskets shared with another person, reviews, ratings and comments, coupons, rewards and wallet balances, returns, refunds and disputes.
Selling:
For vendors, we may collect your shop name, address, phone number, opening hours, social links, logo and banner; your company's name, number and registered details; documents uploaded to verify your business; products, prices, stock and photos; spreadsheets you upload; sales recorded at your counter; your subscription plan; and information about staff or branches linked to your shop.
Delivering:
If you deliver for OyaShop, we may collect your name, contact details, delivery areas, deliveries completed and earnings.
Ambassadors:
We may collect your name, contact details, information about the shops you introduce, your earnings and how you are paid.
Messages:
We may collect what you write to a shop or shopper about an order, messages sent to our support team by email, website chat or WhatsApp, and anything you send to Oya.
Payments
Card and bank details are collected directly by our payment providers rather than by us.
We do not see or store your full card number. We receive confirmation that a payment or refund has been completed, together with limited information about the transaction.
Vendors are paid through Stripe Connect. Stripe collects the identity and bank information it requires directly from the vendor and tells us whether the vendor's account is able to receive payouts.
Information We Collect Automatically
Device and usage information:
This may include your IP address, device and browser type, operating system, app version, pages and screens you use, and error reports.
Location:
If you give permission, the shopping app uses your device's location while the app is open to show nearby shops and delivery options. We do not track your location in the background. You can disable location access through your device settings.
Microphone, camera and photos:
We only access these when you use the relevant features. Your microphone allows you to speak to Oya. Your camera and photo library allow you to add product photos, profile pictures or shop banners, or send photos to Oya.
Notifications:
We use a token that identifies your app on your phone so that we can send order updates and, for vendors, notify you when an order arrives.
Cookies and similar technologies:
See Section 15.
Information We Receive From Others
We may receive information from:
Google, Apple or Facebook when you use their sign-in services.
Payment providers regarding whether a payment, refund or payout was successful.
Companies House, using publicly available information to verify that a vendor's business is genuine.
Couriers regarding the progress of deliveries.
Shops and shoppers, such as when a shop reports an item is out of stock or a shopper reports a problem with an order.
4. How We Use Your Information and Our Legal Bases
UK data protection law requires us to have a lawful basis for processing your personal information.
Contract
We use your information where it is necessary to provide services you have agreed to receive, including:
Creating and managing your account.
Taking and delivering orders.
Processing payments and refunds.
Paying vendors, riders and ambassadors.
Operating vendor shops, products and sales.
Sending order-related messages by email, text message, WhatsApp and push notification.
Providing customer support.
Legitimate Interests
We may use your information where we have a legitimate interest and have balanced that interest against your rights. This includes:

- Keeping OyaShop safe and preventing fraud and misuse.
- Verifying that vendors are genuine businesses.
- Resolving disputes between shoppers and shops.
- Displaying and moderating reviews.
- Understanding how OyaShop is used so we can fix and improve the service.
- Telling existing customers about similar products and offers. You can opt out at any time.
- Protecting our legal rights.

Consent
Where required, we rely on your consent for:

- Non-essential cookies and similar technologies, including analytics and advertising.
- Marketing messages where consent is legally required.
- Use of your device's location, microphone, camera, photos and notifications.

You can withdraw your consent at any time through your device or account settings, by using the unsubscribe option in a message, or by contacting us.
Legal Obligations
We may process your information where necessary to comply with the law, including:

- Keeping tax and accounting records.
- Responding to lawful requests from regulators, courts and the police.
- Meeting consumer protection and product safety obligations.

You do not have to provide us with your information. However, if you do not provide information that we identify as required, we may not be able to open your account, deliver an order or pay a vendor.
5. Oya — Our AI Assistant
Oya helps shoppers find products and helps vendors manage their shops.
When you use Oya, information you provide — including what you type, photos you send and, where applicable, your voice — may be sent to the AI companies that power Oya. These currently include OpenAI and Anthropic, with ElevenLabs used for Oya's spoken voice.
We may also send the information needed to answer your request, such as your shop's products or recent orders.
Under our agreements with these providers, they process this information only to provide the service to us and do not use it to train their models.
Voice recordings are converted into text and then deleted; we do not retain the recordings.
Conversations while you are signed in are stored with your account so that you can continue them later. Conversations from people who are not signed in are deleted after 7 days.
Please do not send Oya sensitive information such as health information or card numbers.
Oya can make mistakes. You should therefore check important information before relying on it. Oya does not make decisions that have legal or similarly significant effects on you.
Product photos uploaded by vendors may also be automatically improved, for example by removing backgrounds using specialist image services.
6. Automated Checks
When a shop registers, we compare its company details with publicly available Companies House information.
Most shops are approved automatically. If the information cannot confirm the business, a member of our team may review the registration.
We and our payment providers may also use automated tools to detect fraud.
You can ask for a person to review an automated decision that affects you.
7. Who We Share Your Information With
We do not sell your personal information.
We share information only where necessary, including with:
Shops you buy from:
They receive your name, delivery address, phone number and order information so they can prepare your order and contact you about it.
Couriers and riders:
Currently including Gophr and Stuart. They may receive collection and delivery addresses, a contact name and phone number, and delivery instructions.
Payment providers:
Stripe and any other payment method displayed at checkout, such as PayPal, may process information to take payments, prevent fraud and pay vendors. These providers are responsible for their own processing of your information under their respective privacy policies.
Service providers:
Companies that provide services to us may process information under contract and only on our instructions. These include:

- Hosting and file storage, including Amazon Web Services in the European Union.
- Email, text-message and WhatsApp delivery, including Vonage and Meta's WhatsApp Business Platform.
- Push notifications, including Google Firebase, Apple and Expo.
- Sign-in services, including Google, Apple and Facebook.
- Maps and address lookup, including Google Maps and getAddress.io.
- Spam protection, including Google reCAPTCHA.
- Website chat, including Tawk.to.
- Analytics and advertising measurement, where you have consented, including Google Analytics and Meta Pixel.
- AI services described in Section 5.
- Image services for product photos, such as remove.bg or PhotoRoom.

Professional advisers, insurers and auditors:
Where necessary for our business operations.
Regulators, courts and law enforcement:
Where required by law, to protect someone's safety or to protect our legal rights.
A buyer or successor:
If OyaShop or MisTech Global Ltd is sold, merged or reorganised, your information may be transferred as part of that transaction. We will tell you before your information becomes subject to a different privacy policy.
8. What Information Is Public
The following information about a shop may be publicly visible on OyaShop:

- Shop name.
- Address.
- Opening hours.
- Products.
- Prices.
- Photos.
- Badges.
- Social links.

Reviews and comments may appear alongside the name associated with your account.
Please do not include personal information in reviews.
9. Vendors' Own Responsibilities
Shops on OyaShop are independent businesses.
They receive your order information so they can fulfil your order and must not use it for other purposes, such as their own marketing, without your permission.
Each shop is responsible for how it handles the information it receives from OyaShop.
10. Sending Information Outside the UK
Some companies we use are based outside the UK or store information outside the UK, including in the European Economic Area and the United States.
When we transfer personal information internationally, we use appropriate safeguards. These may include UK government adequacy decisions, including those covering the EEA and US companies certified under the UK Extension to the EU–US Data Privacy Framework, or the ICO's International Data Transfer Agreement or Addendum.
You can contact us to request a copy of the relevant safeguards.
11. How Long We Keep Your Information
Account and profile information:
For as long as your account remains open.
Orders, invoices, payments, payouts and refunds:
For 6 years after the end of the financial year to which they relate, where required by tax and company law.
Order messages, disputes and support requests:
For as long as your account remains open, and for up to 6 years where they relate to an order or complaint.
Conversations with Oya:
See Section 5.
Business verification documents:
While the shop is on OyaShop and for up to 12 months after it closes, unless we need to retain them for a legal claim.
Marketing preferences:
Until you unsubscribe. After this, we retain only enough information to ensure we do not contact you again.
Security and server logs:
Up to 12 months.
Backups:
Backups are overwritten on a rolling basis.
When we no longer need personal information, we delete it or make it anonymous.
12. Your Rights
Depending on the circumstances, you have the right to:

- Be informed about how we use your information.
- Request a copy of your personal information.
- Ask us to correct inaccurate information.
- Ask us to delete your information.
- Ask us to restrict how we use your information.
- Object to our use of your information, including an absolute right to object to direct marketing.
- Receive information you provided to us in a portable format.
- Withdraw consent at any time.
- Not be subject to decisions made solely by automated means where those decisions have legal or similarly significant effects on you.

To exercise any of these rights, contact us using the details in Section 1.
There is normally no charge. We may ask you to verify your identity. We will generally respond within one month. For complex requests, the law allows us to extend this period by up to two additional months, and we will let you know if this is necessary.
You can also complain to the Information Commissioner's Office (ICO) through its complaints process or by calling 0303 123 1113.
We would appreciate the opportunity to address your concerns before you contact the ICO.
13. Deleting Your Account
You can delete your account at any time:

- OyaShop app: Settings → Delete account
- OyaShop Vendor app: Menu → Settings → Delete account
- Website: oyashop.app/delete-account
- By contacting us

If you have orders in progress — or, for vendors, orders that still need to be fulfilled, money waiting to be paid out, other branches or an active plan that renews — we will explain what needs to be completed first.
When your account is deleted, your profile, addresses, wish list, reviews and sign-in details are erased. A vendor's shop and products are also removed from OyaShop.
We may retain order, payment and tax records for the periods described in Section 11. Where the law allows, personal details will be removed from these records.
14. Marketing and Notifications
We may send marketing messages by email, text message, WhatsApp or push notification where you have agreed to receive them, or where permitted by law for existing customers and similar products or offers.
You can opt out of marketing at any time, including through the unsubscribe option provided in the message.
Order updates and other service messages are not marketing and may be sent while you have an account.
You can manage notification settings through the OyaShop app and your device settings.
15. Cookies and Similar Technologies
Strictly Necessary Cookies
These cookies are required for functions such as keeping you signed in and maintaining website security. Examples include oyashop_session and XSRF-TOKEN.
These cookies are always enabled where necessary for the service.
Optional Cookies
With your consent, we may use optional cookies and similar technologies, including:

- Analytics cookies, such as Google Analytics, to understand how the website is used.
- Advertising cookies, such as the Meta Pixel, to measure and support advertising on Facebook and Instagram.
- Website chat cookies, such as those used by Tawk.to, to remember your conversation.

You can choose which optional cookies to allow when you first visit our website and change your preferences at any time through the “Cookie settings” link at the bottom of the website or through your browser.
Our apps do not use advertising trackers.
16. How We Protect Your Information
We take reasonable measures to protect your personal information.
These measures include:

- Encrypting information in transit.
- Storing passwords in hashed form.
- Storing sign-in tokens in your phone's secure storage.
- Limiting access to personal information to people who need it.
- Requiring our suppliers to protect personal information under contract.

However, no system can be guaranteed to be completely secure.
If a personal data breach is likely to result in a high risk to your rights and freedoms, we will notify you and the ICO where required by law.
17. Children
OyaShop is intended for adults.
You must be 18 or over to create an account. We do not knowingly collect personal information from anyone under 18.
If you believe that a child has provided us with personal information, please contact us and we will take appropriate steps to delete it.
18. Links to Other Websites
OyaShop may link to other websites and services, including a shop's social media pages or Stripe's dashboard.
Those websites and services have their own privacy practices. We encourage you to review their privacy policies before providing them with personal information.
19. Changes to This Privacy Policy
We may update this Privacy Policy from time to time.
We will publish changes on this page and update the effective date.
If we make significant changes, we will notify you by email or through the app before the changes take effect, where required.
20. Contact Us
MisTech Global Ltd (OyaShop)
Registered office: 1 Erasmus Drive, Derby,, Derby, Derbyshire, United Kingdom, DE1 2DN.
Email: admin@mistech.io