This Policy covers the Radius application family, including Radius Delivery, Radius Ads Geofencing and Radius Pickup Scanner, our product websites, account administration and support. We process only the categories relevant to the application, integration and features you use.
1. Controller and processor roles
Multikapitał Sp. z o.o., ul. Krośnieńska 24, 87-100 Toruń, Poland (VAT ID PL9562302202; KRS 0000448302; REGON 341398889) is the controller for merchant account administration, billing records we hold, support, website operations and our own communications. Privacy contact: hello@radiusdelivery.app.
The merchant generally controls their store-customer and staff data. When Radius handles those data to provide merchant-authorized features, Multikapitał acts as a processor under the applicable Data Processing Agreement (DPA). This Policy does not replace the merchant's customer notice or a DPA. Payment and platform providers may separately act as controllers for their own services.
2. Sources and categories of information
We receive information from you, your authorized staff, the connected commerce or advertising platform, the payment provider, your browser and your support interactions.
Account and merchant administration: name, business contact email, business or store identifiers, store domain, billing address, tax identifiers where needed, installation date, language, selected plan, usage counters, trial dates and subscription/payment status. Authentication requires session records and connection credentials or access tokens.
Radius Delivery: store locations, addresses, delivery rules, area names, postal codes, radii, polygons and coordinates. Customer delivery-location information is used where needed to evaluate delivery eligibility; it is not used to build advertising audiences.
Radius Pickup Scanner: order and fulfilment identifiers, pickup location, code or token records, eligibility and payment status, staff permissions, collection timestamps and operation history. Authorized staff may see customer names and ordered products fetched from the connected store. The Shopify scanner's pickup database does not store customer names or product lists. Other integrations may process the order fields and notification contact information required for their selected workflow. Private pickup links can be passed to platform workflows or messaging services on the merchant's instructions.
Radius Ads Geofencing: authorized account and campaign/ad-set identifiers and labels, delivery geography, access and refresh tokens where required, selected mappings, geographic snapshots and synchronization/audit records. We do not use Shopify customer profiles, orders or delivery addresses to create advertising audiences. Google features and availability are described in the application, including any test-account restrictions.
Website and support: IP address, browser/device information, session identifiers, timestamps, error and security logs, messages and any attachments you choose to send. Avoid sending unnecessary customer data, passwords or active private pickup links.
3. Purposes and legal bases
We use data to authenticate users, connect the selected platforms, operate the selected application's features, enforce permissions and plan limits, administer subscriptions and trials, answer support requests, secure the service and comply with legal obligations.
Where we act as controller under GDPR, we rely on contract performance or requested pre-contractual steps for individual account users (Article 6(1)(b)); our legitimate interests in administering business accounts, assisting business representatives, preventing abuse and maintaining service reliability (Article 6(1)(f)); and legal obligations for required billing and compliance records (Article 6(1)(c)). Consent (Article 6(1)(a)) applies where required, including optional newsletters and non-essential tracking. You can withdraw consent without affecting earlier lawful processing.
Store-customer processing follows the merchant's documented instructions and applicable DPA. The merchant is responsible for its lawful basis. Providing account and necessary integration data is required for the relevant service; withholding it may prevent that feature from working. Optional marketing is not a condition of paid access. A trial or billing reminder is a service message.
4. Service providers and disclosures
Providers relevant to the selected service may include Render for application hosting and databases; the connected platform (Shopify, WooCommerce/WordPress, Wix or Shoper); Paddle for purchases it resells; and Zoho CRM, Desk and SalesIQ for business administration, support and website chat. Configured merchant notifications may use the platform's workflow/email services or the selected messaging provider. Direct-billing integrations may use Przelewy24 and Fakturownia when enabled. An integration mentioned here is used only where it is configured for your service.
Providers receive only the information needed for their role, under appropriate contractual safeguards where they act as processors. Connected advertising services receive the merchant-authorized geographic changes, not store-customer lists from Radius. We may disclose information to competent authorities where legally required or to protect legal rights. We do not sell personal data.
5. Paddle and payment information
For Paddle purchases, Paddle collects checkout, billing and payment information as Merchant of Record under its own Privacy Notice. We receive the transaction, customer and subscription information needed to provision access, reconcile billing and support your purchase. We do not receive or store full card numbers or card security codes. Payments handled by another platform are governed by that platform's privacy information.
6. Google and Meta connections
Advertising connection data is used only for merchant-authorized account views, geographic synchronization, verification, restoration, security and support. We do not sell those data, transfer Google data to Meta or TikTok, build customer advertising profiles from them or use them to train generalized AI models. Human access to Google data is limited to user-authorized support, necessary security investigation or legal requirements.
Radius Ads Geofencing's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements. Disconnecting an advertising integration removes its stored credentials and associated mappings and snapshots as described in that application's help. Separately revoking a provider's authorization prevents further API access but may not notify Radius to delete local records; also disconnect in Radius or contact us. Valid provider deauthorization and deletion requests are handled by the relevant integration.
7. Retention and deletion
Account and connection data is kept while needed for the active service and removed or anonymized when no longer necessary, subject to platform deletion workflows, an applicable DPA and legal retention requirements. Installation records may be retained separately where needed to administer trial eligibility, prevent abuse or establish contractual rights. Uninstalling is not an instruction to erase legally required billing records.
For the WooCommerce Radius Pickup Scanner: pickup, point, personnel and bulk-operation metadata is stored in SQLite on a persistent Render disk in Frankfurt. Customer names and product lists are read from WooCommerce for verification, not stored in the central pickup-record table. Revocation or uninstall blocks the integration but does not itself erase hosted history. Return and deletion requests are handled after verification of authority under the WooCommerce DPA. Operator-created SQLite backups are separate from Render disk snapshots; the Shopify-specific retention periods above do not describe this integration.
For the Shopify Radius Pickup Scanner: completed pickup history is retained for 365 days; completed bulk-job details and Flow payloads for 90 days; minimal notification deduplication records remain for as long as needed for the pickup; unresolved pickups remain until resolved. The minimal DPA-acceptance record is kept during service and for three years afterwards. Its Render database is located in Frankfurt and managed recovery copies expire within a cycle of up to seven days. These product-specific periods do not describe every other integration.
For Ads Geofencing, connection credentials, approved geography, mappings and snapshots remain while the connection is active; disconnecting or uninstalling removes the related operational records according to the integration's deletion process. Necessary legal or security records and protected backup copies may remain for their justified retention period. Delivery-location inputs are processed for delivery calculations and are not intended to be retained beyond the relevant operation.
We retain billing/tax records for the applicable statutory period, support correspondence for resolving the request and reasonably necessary follow-up or claims, and security logs for investigating incidents and preventing abuse. Newsletter subscription data remains until withdrawal or the end of the newsletter, with minimal opt-out/consent evidence where justified. Backup copies are isolated from normal use and expire through the relevant provider's rotation. Contact us for retention details for your specific installation.
8. Cookies, chat and camera
Essential cookies or similar storage support authentication, security and remembered interface preferences. Website chat is provided by Zoho SalesIQ and processes the information you provide and technical session information; its chat entry can include the Radius product, website and source-page path without query strings or fragments. We request consent before non-essential cookies or similar tracking where required by law.
Browser-camera access is requested only for an action that needs scanning and can be refused or revoked in browser settings. Scanner video is used for code reading; Radius does not use it to identify people or build biometric profiles. Marketing subscriptions are optional and include an unsubscribe option.
9. International transfers and security
Some providers may process data outside the European Economic Area. Where GDPR requires safeguards, we use recognized transfer mechanisms, such as an applicable adequacy decision or Standard Contractual Clauses, together with required supplementary measures. You may request information about applicable safeguards at our privacy contact.
We use access controls, limited permissions, secure transmission and appropriate protection of integration credentials. No system can guarantee absolute security. Report suspected exposure of credentials or private pickup links promptly so access can be revoked.
10. Your rights
Depending on applicable law and the processing basis, you may request access, correction, erasure, restriction, portability or objection, and withdraw consent. In particular, you may object to processing based on legitimate interests on grounds relating to your situation. Contact hello@radiusdelivery.app; we may verify identity proportionately before disclosing data. GDPR requests are generally answered within one month, subject to lawful extensions that we explain.
Store customers should normally contact their merchant first for requests concerning purchases or pickup records; we assist the merchant under the applicable DPA. You may lodge a complaint with a competent supervisory authority, including the Polish President of the Personal Data Protection Office (UODO). We do not make decisions about you producing legal or similarly significant effects solely through automated processing; operational delivery and pickup checks apply the merchant's configured rules.
11. Changes and linked notices
We update this Policy when services or legal requirements change and provide additional notice of material changes where appropriate. The applicable product DPA and third-party privacy notices remain relevant to their respective processing. These business services are not directed at children. The latest update date is shown above.