Thenia Privacy Policy
Last updated: 28 October 2026
1. Controller and Scope
1.1 The controller for website visitors and Store representatives is OPTIMAL TRADE E.E., 19th km Spaton Avenue, 190 04 Spata, Attica, Greece, Greek Tax ID 801579680, Pallini Tax Office, GEMI 159506203000, hello@thenia.io. For Store customer data, the Store is controller and the Company is processor.
1.2 Customers may unsubscribe through each email; other privacy requests should be directed to the Store.
2. Data, Purposes and Legal Bases
| Data | Purpose | GDPR Article 6 basis |
|---|---|---|
| Store name, username, email, password hash | Account access and service | 6(1)(b) for sole traders; 6(1)(f) for representatives |
| Legal name, tax ID, address, country, payments | Billing and accounting | 6(1)(c), (b) or (f) |
| Encrypted plugin keys | Secure connection | 6(1)(b) or (f) |
| Store logo, name, address, email, phone | Sender identification | 6(1)(b) or (f) |
| Terms acceptance, consent choices, actor, time, IP | Audit trail and compliance | 6(1)(c) or (f) |
| Credit requests, support and correspondence | Support and disputes | 6(1)(b) or (f) |
| Security logs: IP, timestamp, actions | Security | 6(1)(f) |
| thenia.io contact form | Respond to inquiries | 6(1)(f) |
2.1 Card details are stored with Stripe, not the Company.
2.2 The thenia.io website uses Vercel Web Analytics without cookies or visitor identification. Anonymous statistical events are recorded for clicks on the sign-up button, use of the revenue calculator, language changes, and visits originating from the "Sent with Thenia" link in emails. This processing is carried out to evaluate the website's performance and improve its functionality, based on the Company's legitimate interest (Article 6(1)(f) of the GDPR). This data is not used to track individual visitors.
3. Uses and Recipients
3.1 We do not sell data, serve third-party advertising, build third-party profiles or train AI models on data. Reports, billing notices and service alerts to Store owners are part of the Service.
3.2 Recipients include DPA subprocessors, our accountant for billing only, and authorities when legally required.
4. International Transfers
4.1 Hosting and databases are located in the United States; email sending occurs in Ireland. Transfers rely, as applicable, on the EU–US Data Privacy Framework adequacy decision of 10 July 2023 for certified recipients and Standard Contractual Clauses under Decision 2021/914, with supplementary safeguards where needed. Copies of safeguards are available on request.
5. Retention and Security
5.1 Account data are kept during use and up to 90 days after closure, or 30 days after connection without activation. Billing records follow statutory retention. Backups are retained 30 days and security logs up to 30 days unless an incident investigation requires longer.
5.2 Security measures are described in the DPA.
6. Rights and Complaints
6.1 Data subjects may exercise GDPR Articles 15–22 rights as applicable, including access, rectification, erasure, restriction, portability, objection and safeguards regarding solely automated significant decisions.
6.2 Use Settings → Privacy & data or hello@thenia.io. We respond within one month, subject to lawful extensions. Complaints may be lodged with the Hellenic Data Protection Authority at https://www.dpa.gr.
## 6A. Website Information and Estimates
6A.1 Examples, figures and illustrative scenarios presented on the website are provided for information and explanation only and do not constitute a guarantee or promise of any particular commercial outcome. The revenue calculator provides an estimate based on the inputs and assumptions used, not a prediction or assurance of actual sales or revenue.
7. Changes
7.1 Material policy changes are announced by email. The Greek version prevails.