Privacy policy

Shop CMS is made by me, Ruslan Bilohash. I run my business as Bilohash Studio, a sole proprietorship (enkeltpersonforetak) registered in Norway: org.nr. 938 857 245, Gotskalk Johnsons vei 1, 3014 Drammen. For the public pages and demo on bilohash.com I am the data controller. Contact: support@bilohash.com. I have no phone line for privacy questions — e-mail is the way to reach me.

• On bilohash.com (bilohash.com/shop/) you see a showcase of the product with fictional content. This page describes what happens to data there.
• On your own server. When you install Shop CMS under a license on your own domain, you decide what your site collects and why. You are then the data controller for your site and its visitors and need your own privacy policy. I receive no data from your installation. If you ask me for help and give me access, I handle your data only to solve that task, as your data processor, and we agree on this in writing.

Based on the code of the demo, this is everything it stores or sends:

• The demo admin panel is read-only: you can look around, but nothing can be saved there. Its login lasts at most one hour, and e-mail addresses, phone numbers and keys are masked.
• Your language choice is saved in a cookie (sh_lang) for 12 months.
• A technical session cookie (PHPSESSID) protects the forms (security token) and keeps you logged in where the demo has a login. It is deleted when you close the browser.
• Product reviews: name, text, rating and your IP address are saved in the demo database and shown on the product page right away.
• Quick order: name and phone number are saved in the demo database as a request. Nothing is delivered.
• Newsletter form: the e-mail address is saved in the demo database. The demo sends no newsletters.
• Shopping cart: kept in the session only.
• Demo statistics: each page view is logged together with your IP address, so I can see how the demo is used.
• Contact form: your name, e-mail, message and IP address are sent to me by e-mail. They are not saved in a database. The form is protected by Google reCAPTCHA.
• Some demo pictures load directly from Unsplash, which sees your IP address.
• Online payment is switched off in this demo: no card or payment data is collected.

Please do not enter real personal data in demo forms. Use invented names and test addresses.

• Server logs: my hosting provider records technical data for each request (IP address, time, page, browser) to keep the server secure and running.
• Cookie banner: your choice is saved in your browser, so the banner does not ask again.
• Fonts and icons come from Google Fonts and cdnjs (Cloudflare). These services see your IP address when the files load.
• No third-party analytics, no advertising and no tracking cookies.

• Running and protecting the site, server logs and spam protection: my legitimate interest in a secure, working site (GDPR art. 6(1)(f)).
• Answering your messages and requests: steps before a possible agreement, or my legitimate interest in replying (art. 6(1)(b) and (f)).
• Storage that is not strictly necessary and embedded third-party content: your consent (art. 6(1)(a) and the Electronic Communications Act, ekomloven). You can withdraw it at any time.

• Hostinger — my hosting provider; stores the site, the demo data and server logs on my behalf (data processor).
• cdnjs / jsDelivr — icons and scripts; they see your IP address.
• Google reCAPTCHA — spam protection on forms; Google receives your IP address, browser data and how you use the form.
• Unsplash — demo pictures; sees your IP address.
• My e-mail provider — delivers the messages you send me.

Google, Cloudflare, xAI and OpenAI may process data outside the EEA, including in the USA. Such transfers rely on the EU–US Data Privacy Framework or the EU standard contractual clauses.

I do not sell personal data and do not share it for marketing.

• Demo entries stay until I clear the demo. If you entered real data by mistake, write to me and I delete it within one month.
• E-mails and messages to me: as long as needed to answer, normally no longer than 12 months. If they lead to an agreement, invoices and accounting records are kept for 5 years under the Bookkeeping Act (bokføringsloven).
• Settings in your browser (cookies, localStorage): until they expire or you delete them.
• Server logs: for a short period under the hosting provider’s routines.

Under the GDPR and the Personal Data Act (personopplysningsloven) you can ask for access, correction, deletion, restriction and data portability, and you can object to processing based on legitimate interest. Write to support@bilohash.com; I answer within one month. If you think I process data unlawfully, you can complain to the Norwegian Data Protection Authority, Datatilsynet (datatilsynet.no), or to the authority in your own country.

The site uses HTTPS, the data folders of the demos are closed to the public, and demo admin panels are protected. No system is completely secure, so never send sensitive data (health, ID numbers, bank details) through a demo.

Any legal texts that come with the script are templates. Before your site goes live, adapt them:

• Name yourself (company, address, contact) as the data controller.
• List what your installation really collects: orders, bookings, accounts, messages, uploads, server logs.
• Name your providers: hosting, e-mail, payments, maps, spam protection and AI services if you switch them on.
• Set retention periods and check local rules, for example bookkeeping rules for orders and invoices.
• Ask for consent before loading analytics, maps, video or other services that set non-necessary cookies.

I can help with the technical side, but I do not give legal advice. Check the final text yourself or with a lawyer.

I update this page when the demo or the law changes; the date at the top shows the current version. The general privacy policy of bilohash.com is here.