By connecting this tool, you acknowledge that you may be processing personal data (e.g. customer names, addresses, order details) from your ePages shop. You are responsible for ensuring that your use complies with applicable data protection regulations, including the GDPR. This includes obtaining any necessary consents, implementing appropriate security measures, and respecting data subject rights.
Vilkas Group Oy (Business ID: 1033996-4) Finlaysoninkuja 19, 33210 Tampere, Finland Phone: +358 20 743 1919 Email: privacy@vilkas.fi
Noora Kahra Finlaysoninkuja 19, 33210 Tampere, Finland Phone: +358 50 536 4620 Email: noora@vilkas.fi
Shop Conductor is a service that connects AI assistants (such as ChatGPT, Claude, opencode, and Gemini) to ePages online shops. It acts as a secure bridge: when you instruct your AI assistant to perform tasks in your shop, those requests are routed through this server to the ePages API. The server does not store your shop data beyond what is necessary for authentication and session management.
When you use Shop Conductor, we process:
Shop Conductor does not proactively collect, store, or analyse your product catalogues, customer lists, orders, or any other ePages shop data. That data is only transmitted transiently through the server when you explicitly instruct an AI assistant to perform an operation.
Shop Conductor uses the following cookies: vilkas_session (httpOnly session cookie, 8-hour expiry) to keep you logged in, and vilkas_lang (language preference cookie, 365-day expiry). The web interface also stores a JWT in browser local storage for API authentication. Shop Conductor does not use third-party tracking, analytics, or advertising cookies.
We process your personal data for the following purposes:
We process your personal data based on the following legal grounds: performance of a contract (providing the service you registered for) and our legitimate interest (for security audit logging and service improvement).
We retain your account information for as long as your account is active. Audit logs are retained for a maximum of 90 days. MCP tokens and OAuth tokens are retained until revoked or expired. If you delete your account, all associated data is removed within 30 days.
We do not sell your personal data. We do not share your personal data with third parties for their own marketing purposes. Data may be disclosed only where required by law or to protect our legal rights. When you use an AI assistant (ChatGPT, Claude, etc.), your data is also processed by that assistant's provider under their own privacy policy - you should review those policies separately.
Shop Conductor is hosted in a European data centre. However, when you use an AI assistant via the MCP protocol (ChatGPT, Claude, Gemini, opencode), your shop data may be transmitted to and processed by that assistant's provider, which may be located outside the European Economic Area. For example, OpenAI (ChatGPT), Anthropic (Claude), and Google (Gemini) are US-based companies. We recommend reviewing the privacy policies of your chosen AI assistant for information about their data processing practices and transfer safeguards.
Under the General Data Protection Regulation, you have the right to:
To exercise any of these rights, please contact Noora Kahra at noora@vilkas.fi or privacy@vilkas.fi.
We implement appropriate technical and organisational measures to protect your personal data. Passwords are bcrypt-hashed, OAuth codes and MCP tokens are SHA-256-hashed in the database, and all communications are encrypted over TLS. The server is hosted in a European data centre and protected by firewalls and access controls.
Last updated: June 2, 2026. We may update this policy from time to time; changes will be posted here.