Privacy Policy

This Privacy Policy describes how Operula collects, uses, and protects personal data in accordance with applicable data protection regulations.

Data Controller

The data controller responsible for personal data processed through the Operula platform and the Operula mobile applications is Bluix Group LTD (UK Company No. 17097946), 41 Devonshire Street, Ground Floor, London W1G 7AJ, United Kingdom, which operates the Operula platform.

For any privacy-related inquiries, or to exercise the rights described below, users may contact our Data Protection contact at dpo@operula.com or use the addresses provided in the Contact section.

Personal Data Collected

Operula collects only the personal data strictly necessary for the operation of the platform. This may include:

basic technical data (IP address, browser type, device information)
usage and interaction data (pages visited, navigation patterns, search queries)
contact information voluntarily provided by users (e.g. via contact forms)
account information (email, name, password — hashed) for registered users
authentication data (2FA secrets, recovery codes — encrypted) for users with 2FA enabled
social profile information (optional: Facebook, Instagram, Twitter/X usernames, website, bio, location)
phone number (optional, for OTP authentication and password recovery)
premium subscription data (subscription status, billing information via payment processor)
wishlist and price alert data (for premium users)
public profile settings (profile, wishlist, collections visibility preferences)

Operula does not intentionally collect sensitive personal data beyond what is necessary for authentication and premium service delivery.

Mobile Application Data

When you use the Operula mobile applications for Android and iOS, we and our service providers may additionally process the following data:

Device and diagnostic data — device model, operating system version, app version, language, and crash/diagnostic information, used to operate, secure, and improve the app
App usage and analytics — screens viewed and in-app interactions, collected via Google Firebase Analytics, associated with a Firebase installation identifier
Push notification tokens — a device messaging token provided by Firebase Cloud Messaging (FCM), used to deliver order, wishlist, price-alert, and gift notifications (only when you enable notifications)
Camera and photo access — accessed only when you actively choose to upload an image (for example a profile photo, a listing image, or visual search); images are not accessed in the background
Payment data — in-app purchases and subscriptions are processed by Stripe; Operula does not store full card numbers
Identity verification data (optional) — where identity verification is required (for example artisan/seller onboarding), an identity document and a selfie may be collected and processed to confirm identity. The document number is stored only as a one-way hash and never in clear text
On-device biometric authentication — if you enable Face ID, Touch ID, or fingerprint / WebAuthn sign-in, the biometric match happens entirely on your device; Operula never receives or stores your fingerprint or face biometric templates

The Operula apps do not collect precise device location.

Purpose of Data Processing

Personal data is processed for the following purposes:

operating and maintaining the platform
improving content relevance and user experience
responding to user inquiries and communications
ensuring platform security and integrity (including 2FA authentication)
fulfilling legal and regulatory obligations
providing premium services (wishlists, price alerts, early notifications)
managing user accounts and authentication (email, social login, OTP)
processing premium subscriptions and billing
enabling public profile features (when user opts in)
sending newsletters and promotional communications (with consent)
tracking affiliate clicks and conversions (anonymized where possible)

Legal Basis for Processing

Personal data is processed on the basis of:

legitimate interest in operating and improving the platform
user consent, where applicable
compliance with legal obligations

Data Retention

Personal data is retained only for as long as necessary to fulfill the purposes for which it was collected, unless longer retention is required by law.

Data Sharing and Transfers

Operula does not sell personal data and does not share personal data with third parties for commercial purposes.

Data may be shared with trusted service providers solely for technical, operational, or legal reasons, and only where necessary, including:

Payment processors (for premium subscriptions) — billing information only
Social login providers (Google, Apple, Facebook) — authentication data only
SMS gateway providers (Vonage, generic OTP services) — phone numbers for OTP delivery only
Affiliate networks (Awin, CJ, Rakuten, Impact) — anonymized click/conversion data
Email service providers (for newsletters and notifications)

All data sharing is governed by strict agreements ensuring compliance with data protection regulations.

International Data Transfers

Some of our service providers (including Google Firebase and Stripe) may process data on servers located outside the European Economic Area and the United Kingdom, in particular in the United States. Where such transfers occur, they are protected by appropriate safeguards, such as the European Commission's Standard Contractual Clauses and equivalent UK transfer mechanisms.

User Rights

Users have the right to:

access their personal data
request correction or deletion of data
object to or restrict data processing
withdraw consent, where applicable
lodge a complaint with a supervisory authority

Account and Data Deletion

You may delete your Operula account, and the personal data associated with it, at any time. You can request deletion in either of the following ways:

from within the app or website, via your profile / account settings; or
by emailing dpo@operula.com from the address associated with your account.

Upon a verified request we will delete your account and associated personal data without undue delay, except for data we are required to retain for legal, tax, or fraud-prevention purposes (for example transaction and invoicing records), which is kept only for the period required by law and then deleted.

Children's Privacy

Operula is not directed to children. The platform and the mobile applications are intended for users aged 16 and over, and we do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact dpo@operula.com and we will delete it.

Data Security

Operula implements appropriate technical and organizational measures to protect personal data against unauthorized access, alteration, disclosure, or destruction.

Changes to This Privacy Policy

Operula reserves the right to update this Privacy Policy at any time. Changes take effect upon publication on the platform.

Continued use of Operula constitutes acceptance of this Privacy Policy and any updates.