Customer Support OS

1. Identity of the Data Controller

Customer Support OS is a private customer support management application used to manage business communications for the online stores Nerelias, Serelias, and Nornelle.

The person responsible for operating the application and processing personal data is Álvaro Carcedo, with a registered address or contact address at Baldomero Alonso 14, 33930 Langreo, Principality of Asturias, Spain

For any questions regarding this Privacy Policy or the processing of personal data, please contact help.nerelias@gmail.com.

2. Purpose of the Application

Customer Support OS centralizes and automates certain customer support tasks for the following online stores:

The application uses the official Google Gmail and Shopify APIs to access messages related to orders, identify customer inquiries, check commercial information, and prepare responses.

When automatic sending is enabled by the administrator, the application may respond to certain routine customer inquiries. Cases involving refund decisions, cancellations, disputes, defective products, or other sensitive matters are reserved for human review.

The application does not automatically perform financial modifications to orders, issue refunds, or cancel orders.

3. Information We Access

Gmail Information

With the express authorization of the owners of the connected business Gmail accounts, the application may access the following categories of information:

  • Email addresses of senders and recipients.

  • Email subjects, message content, and dates.

  • Message and conversation identifiers.

  • Order references included in customer communications.

  • Information required to identify inquiries, manage conversations, and prepare responses.

The application requests the following Google permissions:

Gmail Modify (gmail.modify): Allows the application to read and manage email messages, including certain organizational operations.

Gmail Send (gmail.send): Allows the application to send responses from authorized email accounts.

These permissions are used exclusively for customer support operations involving the connected business accounts.

Shopify Information

The application accesses order information when necessary to respond to a customer inquiry, including order numbers, associated email addresses, order dates, fulfillment or shipping status, and available tracking information.

Shopify access is read-only and is managed separately for each store.

4. How We Use Information

We use information to identify and categorize customer support inquiries, verify the relationship between a sender and an order, retrieve tracking information, prepare responses, and manage cases requiring human review.

Message content may be processed temporarily for these purposes. The application does not systematically store complete copies of all email messages in its operational database.

However, it may retain limited information related to case management, such as message identifiers, sender addresses, order numbers, inquiry classifications, processing statuses, suggested responses, and technical execution logs.

Information obtained through Google APIs is not used for personalized advertising, commercial profiling unrelated to customer support, selling data, or training artificial intelligence models.

5. Limited Use of Google User Data

Our access to and use of information obtained through Google APIs will comply with the Google API Services User Data Policy, including its Limited Use requirements.

Gmail data will only be used to provide or improve the customer support features described in this Privacy Policy.

We will not sell Gmail data or transfer it to third parties for advertising, commercial data brokerage, or purposes unrelated to those expressly described in this policy.

Human access to this information is restricted to authorized individuals who need access for customer support, security, or service operation purposes.

6. Data Storage, Security, and Technology Providers

Customer Support OS operates on Cloudflare Workers infrastructure and uses Cloudflare D1 to store operational information.

Access credentials are managed through server-side secrets. Gmail authorization tokens are stored in encrypted form.

The application uses HTTPS connections to communicate with Google and Shopify services.

The technology providers involved in operating the system include Google, Shopify, and Cloudflare, each subject to its respective terms and privacy policies.

The application does not currently transmit email content to external artificial intelligence providers to generate responses. Any future integration involving additional data processing must be assessed and reflected in this Privacy Policy before implementation.

7. Data Retention and Deletion

Authorization to access Gmail accounts is retained for as long as necessary for the operation of the application, or until access is revoked or removed.

Operational records, message identifiers, and suggested responses are retained for as long as necessary to manage incidents, maintain service continuity, or comply with applicable legal obligations.

The current version of the system does not include a general automatic deletion procedure for all stored records. Accordingly, the deletion of such records must be expressly managed by the data controller.

Google account owners may revoke the application's access through their Google Account security settings. Revoking access prevents further use of that authorization but does not necessarily result in the immediate deletion of previously stored operational records.

To request deletion of information retained by the application, please contact help.nerelias@gmail.com. Requests will be handled in accordance with applicable legal obligations.

8. Legal Basis and Individual Rights

The processing of information related to orders and customer inquiries is based, as applicable, on the performance of contractual relationships, compliance with legal obligations, and legitimate interests in providing customer assistance and managing business operations.

Access to Google accounts requires the express authorization of the relevant account owner through Google's OAuth authorization process.

Where the General Data Protection Regulation (GDPR) applies, individuals may exercise their rights of access, rectification, erasure, objection, restriction of processing, and data portability, subject to the applicable legal conditions.

Requests can be submitted to help.nerelias@gmail.com.

Individuals may also lodge a complaint with the relevant data protection supervisory authority, including the Spanish Data Protection Agency (AEPD), where applicable.

9. Changes to This Privacy Policy

This Privacy Policy may be updated to reflect changes in the application's functionality, technology providers, or applicable legal requirements.

If new uses of Google user data are introduced that require additional notice or consent, the appropriate measures will be implemented before the data is used for those new purposes.

The current version of this Privacy Policy will remain publicly available on the website hosting this document.

10. Artificial intelligence for customer support

When enabled, Customer Support OS uses Cloudflare Workers AI, a model-processing service hosted by Cloudflare, to prepare draft replies. Limited extracts of customer emails and verified order information strictly needed to address an inquiry may be transmitted for this purpose. Information is minimized where possible and is not used for advertising. AI-generated drafts are subject to human review and are not sent automatically. Cloudflare's processing, retention and access practices are governed by its applicable service terms. To exercise your rights or request further information, contact the controller identified in this policy.