Who operates the service
Noni Shops at shop.nonifoods.online is operated by noniapps. Contact the operator through our contact and privacy form. We do not publish an administrator’s private login email as a support address.
Marketplace information
We use information you supply to operate accounts, stores, product listings, inquiries and orders. This can include your name, email, account role, store and product content, contact details, order items and fulfillment information. Passwords are stored as password hashes, not readable passwords. Public store and approved product content is visible to shoppers. Relevant order and contact information is available to the fulfilling seller.
Location and delivery
With your permission, location information is used for store locations and driving-road delivery quotes. Mapping and routing services receive the coordinates needed to provide their services. A submitted order may retain destination and delivery details for fulfillment. You can decline location access, although some delivery features may then be unavailable.
Optional TikTok connection
The TikTok feature is initially restricted to authorized sandbox test accounts. A seller can authorize access through TikTok’s official login and permission screens. Noni Shops does not collect your TikTok password. Requested permissions are user.info.basic and video.list.
With your authorization, we use your TikTok account identifier, display name, access and refresh tokens, and supported public-video identifiers, captions, titles, temporary covers and source links to create private import drafts. Optional automatic checks run hourly; the seller can also sync recent videos and page through older videos. The official API does not provide unrestricted video downloads or general photo-post import through this feature.
Imports are not automatically published. You must review each product’s description, media rights, price, currency, actual quantity and condition before approving publication. Detected prices are suggestions only. Synchronization does not change products you have already approved and does not publish posts to TikTok.
Third-party media
Product photos and media may load from the hosts selected by sellers. A TikTok product-video player loads only when a shopper chooses to load that video. This connects the shopper to TikTok, which may receive device and network information and use cookies under its own policies. TikTok handles its authorization pages and video player under its own privacy policies.
Contact and privacy requests
Our request form stores the name, email or phone number, request type and message you provide. Requests go to a private administrator inbox with review status and private notes. Do not send passwords, payment-card details or identity documents. The administrator may use your supplied contact method to clarify or respond; the inbox does not automatically send email or SMS.
Security and cookies
Social access and refresh tokens are encrypted on the server. App credentials and encryption keys stay outside the public web directory with restricted file permissions. Admin access uses secure, HttpOnly session cookies, request-forgery checks and session expiry. Marketplace sign-in uses an authorization token stored by your browser. These safeguards reduce risk but cannot guarantee absolute security.
The request form uses a session cookie and keyed identifiers for submission and sign-in rate limits. Raw IP addresses are not stored in the form’s rate-limit table. Our hosting provider may separately process technical access and security logs.
Opt-in customer recognition
You may choose a public display name and optional profile-photo URL under Account → Public customer profile. Recognition is off unless you enable it. If you qualify based on completed purchases from a store, that store’s tablet/desktop showcase may display your chosen name, photo and recognition rank. Your phone number, email address, delivery address and spending amounts are not displayed in this recognition feature. If no photo is provided, initials are used.
You may turn recognition off or update your public details through the same account control. Future showcase responses will then exclude your profile. Public images may be hosted by the provider you choose. Product-registration dates are recorded to apply automatic ten-day new-arrival labels; store owners may also publish optional text or image announcements.
Retention and disconnection
We keep marketplace information while needed to provide accounts, listings, orders, support and applicable recordkeeping obligations. Contact requests and review notes are retained for handling and documenting requests until removed by the administrator when no longer needed. You may ask for access, correction or deletion through the form.
Social tokens are retained while your connection is authorized and needed. Disconnecting in Social imports removes stored tokens and unpublished import records and stops future synchronization. We attempt to revoke access with TikTok; if TikTok cannot be reached, also remove Noni Shops from your TikTok app permissions. Products you already approved remain in your store unless you remove them or request deletion. Minimal approved video/product references may remain to prevent duplicate imports. Temporary video cover links expire and are not used as permanent product photos.
OAuth verification records expire after ten minutes. Expired state records and request-rate identifiers are cleaned by scheduled maintenance. Some information may need to be retained to fulfill orders, resolve disputes or meet applicable legal obligations; we will review the scope of any deletion request rather than deleting records automatically.
Your requests and choices
Use the privacy request form to ask about your information, or request data deletion. Identify the relevant account or store and give a contact method where we can reach you. We may need to verify account control before disclosing or deleting information. Keep the reference provided after submission.
Updates
Changes to this policy will be published on this page with an updated effective date.