Privacy policy
Melsho · Last updated: 2026-10-22
This is a translation for your convenience. The Spanish version is the binding one and prevails over this translation in case of any discrepancy.
This policy explains what personal data Melsho processes when providing Orbit, for what purpose and what rights people have, under Uruguayan Law No. 18,331 on the Protection of Personal Data (Ley N° 18.331 de Protección de Datos Personales) and its regulatory decree.
Two different roles
For the data of Orbit’s users (name, email, account activity) we act as data controller.
For the data of each store’s end customers (buyers, people who write through social networks or messaging) the store is the controller and we act as processor: we only process that data to provide the service to the store, following its instructions.
What data we process
From users: name, email, password (stored only as a hash), role, preferences, sessions and activity and security logs.
From end customers, when the store connects its channels: order data (name, contact, delivery address, products, amounts), payments (status and references, never full card data), messages and comments received through the connected channels, and invoicing and shipping data.
What for
To operate the store (orders, stock, shipping, invoicing, customer service), generate business metrics and recommendations, secure the service, provide support and comply with legal obligations. We do not sell personal data or use it for our own advertising.
Artificial intelligence
Some features send content to a language model provider (OpenAI) to generate responses. The general business context the assistant uses is built without identifiable personal data of end customers; the customer service bot processes the message the person wrote in order to answer it. Under the provider’s terms for its API, that content is not used to train its models.
Who it is shared with
With providers that help us deliver the service (sub-processors): infrastructure and hosting, backups, sending the platform’s emails and the AI provider. All of them are bound by confidentiality and security obligations.
With the platforms the store itself decides to connect (for example its sales channel, its payment processor or its shipping company), to the extent needed to operate with them.
Some of these providers may be located outside the country; in those cases we apply the safeguards the law requires.
Security
We keep each store’s data separate, encrypt integration credentials, restrict access by role, log sensitive access and make daily backups.
Retention
For as long as the store has the service active and, when it ends, 30 days to allow the export; then the data is deleted, except what we must keep by law. Technical logs are kept for limited periods.
Rights
Anyone can request access to, rectification, updating or deletion of their data. If you are a customer of a store that uses Orbit, contact that store first; if you write to us at privacidad@melsho.com, we will forward the request to the responsible store and help it answer.
You can also file a complaint with Uruguay’s data protection authority, the Unidad Reguladora y de Control de Datos Personales (URCDP).
Contact
Melsho — privacidad@melsho.com. Last updated: 2026-10-22.