Last updated: October 2026 · Effective date: October 6, 2026 · Operator: Verdikx LLC
This notice supplements our Privacy Policy for California residents, as required by the California Consumer Privacy Act as amended by the California Privacy Rights Act (together, the “CCPA”). Words such as “personal information”, “sell”, “share”, “sensitive personal information” and “service provider” have the meanings the CCPA gives them. If this notice and the Privacy Policy ever seem to differ, the Privacy Policy describes what we do.
1. When we are the business and when we are a service provider
- Merchant account data and website visitors. For the people who sign up for and use Verdikx, visitors to our website and people who join our talent community, we decide how personal information is used, so we are the “business”. This notice covers that information.
- Merchants’ customers (buyers). Order, customer and dispute data that a merchant’s store, payment processors and connected services make available is processed on the merchant’s behalf and on the merchant’s instructions. For that data the merchant is the business and Verdikx is its service provider: we use it only to provide Verdikx to that merchant, as the processing terms listed in our Trust Center commit. If you are a buyer, please send privacy requests to the store you bought from; Shopify forwards them to us automatically and we help the store respond.
2. Personal information we collect, its sources, purposes and retention
In the past 12 months we have collected the following categories of personal information about merchants, website visitors and applicants. The Privacy Policy describes each item in detail.
| Category | Examples | Sources | Business purposes | Retention |
|---|---|---|---|---|
| Identifiers | Name, email address, sign-in email, internal account identifier, Google account identifier if you sign in with Google, IP address | You; your browser or device; Shopify; Google (if you choose Sign in with Google) | Creating and running your account, sign-in and security, support, billing | While your account exists; deleted when you delete your account or on a verified request, except records the law requires us to keep |
| Customer records (Cal. Civ. Code §1798.80(e)) | Store contact email and address returned by Shopify, merchant details you enter for evidence packets, billing contact for custom invoices (workspaces not on Shopify) | You; Shopify; Stripe (for workspaces billed by card) | Providing the service, evidence packets, billing | While the store or workspace is installed or active; deleted on Shopify’s store deletion request or when the workspace is erased |
| Commercial information | Plan, billing cycle and subscription status (never card or bank details) | Shopify Billing; Stripe | Billing, plan limits, keeping tax and billing records | While your account exists, and billing and tax records for as long as the law requires |
| Internet or other electronic network activity | Request and error logs (IP address, browser user agent, internal identifiers), account activity logs, the first landing page and referring domain if you sign up from a browser that recorded them | Your browser or device | Security, rate limiting, preventing abuse, troubleshooting, learning which pages bring people to Verdikx | Server logs for a limited period at our hosting provider, with personal details masked; account activity logs 2 years |
| Geolocation data (approximate, not precise) | Country only, for example reported with page-performance measurements inside Shopify admin; never precise location | Your browser or device; Shopify | Measuring and improving app performance, troubleshooting | As for server logs |
| Professional or employment-related information | Talent community sign-ups: name, email, role of interest, location, LinkedIn or portfolio link, résumé and note | You, on the Careers page | Considering you for roles and contacting you about them, with your consent | Up to 24 months from sign-up, then deleted automatically |
| Identifiers and request details in privacy requests | Name, email address, how you relate to Verdikx, the kind of request, the store web address and the details you give on our privacy request form, and a one-way keyed hash of the IP address you sent it from (never the address itself) | You, on the privacy request form | Handling your request and keeping the record the law requires; the IP hash only to spot abuse of the form | 24 months from receipt, then deleted automatically; the copy emailed to our privacy inbox is kept no longer than that |
| Content of communications | Messages you send to support or our team inboxes, files and text you add to cases | You | Answering you, providing the service | While your account exists; team inbox auto-reply records (a keyed hash of the sender, never the address) 30 days |
We do not collect biometric information, health information, precise geolocation or the contents of your communications with third parties. We do not knowingly collect personal information from anyone under 16.
3. Sensitive personal information
The only sensitive personal information we collect as a business is your account sign-in: your email address with the password or sign-in method that protects it. Passwords are handled by our authentication provider and are not stored by us in readable form. We use it only to sign you in and keep your account secure, which the CCPA permits without a right to limit, and we do not use any sensitive personal information to infer characteristics about you. We never receive full payment card numbers.
4. Disclosures, sale and sharing
We disclose each category above for business purposes only to our service providers and contractors (hosting, database and authentication, email, error monitoring, billing and the other providers listed in the Privacy Policy and in our Trust Center), each limited to its stated purpose, and when the law requires it.
We do not sell personal information. On our public website, and only if you accept advertising cookies in our cookie banner, advertising tags send visit and sign-up events (page addresses, your IP address and browser type, and a hashed email address when you ask for early access) to Meta for ad measurement and advertising, which may be “sharing” for cross-context behavioral advertising under the CCPA. You can opt out at any time with Reject all in the banner or Cookie settings in the footer, and we honor Global Privacy Control as that opt-out. We do not knowingly share the personal information of consumers under 16. Nothing of the kind runs in the app or workspace. The opt-in Verdikx Network shares fraud outcomes between participating stores only as one-way keyed hashes, only for fraud and abuse prevention, and is never sold (see Verdikx Network).
5. Your rights
- Right to know and access: the categories and specific pieces of personal information we hold about you, its sources, the purposes we use it for and the categories of recipients, with a portable copy.
- Right to delete personal information we collected from you, subject to exceptions in the law (for example, billing and tax records).
- Right to correct inaccurate personal information.
- Right to opt out of sale or sharing. We do neither; we honor Global Privacy Control signals as described on Your privacy choices.
- Right to limit the use of sensitive personal information. We use it only for purposes the CCPA permits, so there is nothing further to limit; you may still ask.
- Right not to be discriminated against. We will not deny you the service, charge a different price or give a different level of service because you exercised a right.
6. How to exercise your rights
- Online: use our privacy request form.
- By email: write to privacy@verdikx.com, from the email address on your Verdikx account if you have one.
- In the app: delete your account yourself in Settings → Delete account (outside Shopify admin), and download your cases at any time with Results → Export CSV and each evidence packet from its case. There is no self-service export of your whole account yet; ask for one through the form or by email.
Merchant account deletion in Settings ends any card subscription at once, erases every workspace’s data and deletes your login. A Shopify store must be uninstalled first; Shopify’s store deletion request then removes its data, as described in the Privacy Policy.
7. Verification
We verify your identity only for requests to know or access, delete or correct personal information. Requests to opt out of sale or sharing, or to limit the use of sensitive personal information, do not need verification; we may decline one only if we have a good-faith, documented reason to believe it is fraudulent.
To protect you, we verify each request to know or access, delete or correct before acting on it. If you have an account, we match the request to the email address on the account and may ask you to confirm from that address or while signed in. If you do not have an account, we ask for the information needed to find any records about you; because our website keeps only anonymous counts of visits, we may hold nothing that can be linked to you, and we will tell you if so. We use the information you provide only to verify and answer your request.
8. Authorized agents
You may ask an authorized agent to make a request for you. We will ask the agent for your signed permission (or a valid power of attorney) and may ask you to verify your identity with us directly or confirm that you gave the agent permission.
9. Response times
These are the same commitments as in the Privacy Policy.
- We confirm receipt of every request within 10 business days. Requests sent through our online form are confirmed on screen straight away, and by email.
- We aim to answer every request within 30 days.
- Under California law (the CCPA, as amended by the CPRA) and similar US state laws, we answer within 45 calendar days of receipt. If we reasonably need more time, we may extend this once by up to 45 more days, and we will tell you why before the first 45 days end.
- Under the GDPR and the UK GDPR, we answer within one month of receipt. For complex or numerous requests we may extend this by up to two more months, and we will tell you why before the first month ends.
- Requests to opt out of the sale or sharing of personal information, or to limit the use of sensitive personal information, are acted on as soon as feasible and within 15 business days.
Verified deletion requests are completed within 30 days.
10. If we decline your request
If we cannot fulfil a request, in whole or in part, we will explain why. You may ask us to reconsider by replying to our answer or emailing privacy@verdikx.com with “Appeal” in the subject line; a different member of our team will review it and reply in writing with the result and our reasons. Residents of states that give a formal right to appeal can also contact their state attorney general if they are not satisfied.
11. Contact
Questions about this notice: privacy@verdikx.com. This notice is also available in other formats on request.