Your data.
Plainly explained.

Last updated: October 2026 · Effective date: October 6, 2026 · Operator: Verdikx LLC

1. Who we are and what this policy covers

Verdikx is software for e-commerce merchants, including a Shopify app, that keeps an evidence history of orders, screens new orders for fraud signals, highlights refund-abuse patterns, and helps merchants prepare and submit chargeback responses. This policy explains what personal data Verdikx processes, why, who helps us process it, how long it is kept, and how to exercise your rights. It covers the Verdikx website, the Verdikx workspace and the Shopify app.

• Operator: Verdikx LLC
• Address: 111 Town Square Place, Suite 1201, PMB 1270, Jersey City, NJ 07310
• Country: United States (New Jersey)
• Privacy contact: privacy@verdikx.com

2. Merchants and their customers: controller and processor

Our customers are merchants. We process two kinds of personal data:

• Merchant account data (the people who sign up for and use Verdikx, and visitors to our website). For this data we decide why and how it is used, so we are the controller (a “business” under California law).
• End-customer (buyer) data that a merchant’s store, payment processors and connected services make available, such as the names, email addresses and order details of the merchant’s own customers. We process this data on the merchant’s behalf and on the merchant’s instructions, so the merchant is the controller and we are the processor (a “service provider” under California law). The Data processing page describes those terms.

Buyers who want to exercise privacy rights should contact the merchant they bought from. Shopify forwards buyer requests to us automatically and we help merchants respond (see section 9).

3. Information we process

Merchant account information

• Sign-in email and authentication records (passwords are handled by our authentication provider and are not stored by us in readable form).
• Store domain, store name, and the contact email and address Shopify returns for the store.
• Merchant details you enter in Settings for evidence packets, saved policy text, screening settings and notification preferences.
• Subscription status from Shopify Billing, or, for accounts billed by card on verdikx.com, from Stripe (plan, status, billing address and any tax ID you enter at checkout). Payment card and bank details are handled by Shopify or Stripe; we do not receive them.
• If you sign in with Google: the email address, name and Google account identifier Google returns.
• Messages you send to support.

Shopify store data

Verdikx reads only the data covered by the permissions you approve at install:

Shopify also notifies us when orders, refunds, disputes, customers and the app installation change, so the evidence history stays current.

End-customer (buyer) information, processed for the merchant

Order records can include a buyer’s name, email address, phone number, billing and shipping addresses, purchased items, amounts, fulfillment and tracking details, and, where the store or processor provides them, the checkout IP address and the card brand, BIN and last four digits. We use this to build the merchant’s evidence history and dispute packets, and to screen orders. We do not receive full payment card numbers.

Fraud screening data

When order screening is on, Verdikx also keeps the following for the merchant, only to screen orders for fraud:

• Blocklists and Trusted lists the merchant creates: an IP address or IP range, email address or email domain, phone number, shipping address (kept as a one-way key plus a short label the merchant recognises), card (BIN, last four digits and expiry, or a processor card fingerprint; never a full card number) or storefront device identifier, with the merchant’s reason, the chosen action (hold, hold for cancellation, or flag), an optional expiry date and which orders matched. Entries stay in the merchant’s own store and are never shared with other stores or the Verdikx Network.
• IP intelligence for the checkout IP address: country, region, city, approximate coordinates, network (ASN and organisation) and whether the address is a proxy or VPN, a Tor exit node or a hosting provider. It is stored with the order’s screening result. To look it up we use the public Tor exit-node list, a built-in list of hosting networks and MaxMind’s GeoLite2 country and network databases, which we download and query on our own servers, so the IP address is not sent to MaxMind. The databases give the country and network only; region, city and coordinates are available only if the deployment enables MaxMind’s paid GeoIP2 Insights service, which then receives only the IP address, with answers cached by IP address for 7 days without any store or customer reference. This product includes GeoLite2 data created by MaxMind, available from https://www.maxmind.com. IP location is only one signal: on its own it never cancels or holds an order by default.
• Storefront device signal from the Verdikx web pixel (only where the merchant’s store has it active, and only when the shopper’s analytics consent allows): a one-way hash of non-personal browser traits (such as screen size, time zone, language, graphics renderer and number of processor cores) and a random identifier kept in the store’s browser storage, plus the browser’s user agent and a one-way key of the checkout. We re-hash the device identifier with the store’s id, so the same browser cannot be linked across stores. It is used only to add risk (repeat orders or links from one device, or a device the merchant blocked) and never to lower it. Device signals not linked to an order are deleted after 2 days; others after 400 days.

Optional connections

• Stripe (if you connect it): Stripe dispute records for your account, and the evidence you explicitly choose to submit to Stripe.
• Other sales channels through Rutter (if you connect them): orders from those channels, including customer email, items, totals and fulfillment details.
• Other payment processors (PayPal, Square, Braintree, Adyen, Checkout.com, Authorize.net, Klarna, Afterpay/Clearpay; each only if you connect it): dispute and transaction records for your account, and the evidence you explicitly choose to submit.
• WooCommerce (if you connect your own store): orders, customer details and fulfillment details from your store.
• Help desks and mailboxes (Gorgias, Zendesk, Intercom, Gmail, or others through Merge; each only if you connect it): conversations with the customer behind a disputed order, attached as evidence.
• Subscription, returns and tracking apps (Recharge, Skio, Loop Returns, AfterShip; each only if you connect it): subscription, return and tracking history for disputed orders.
• Forwarded emails and alerts: dispute notices you forward to your intake address (received through our inbound email provider, Resend or Postmark), and pre-dispute alerts (Ethoca, Verifi RDR/CDRN) that your alert provider sends to Verdikx.
• Shipment tracking through Shippo and, where configured, direct carrier APIs: we send the carrier and tracking number and store the tracking events returned. Names of people who signed for or collected a parcel are removed from scan text, and Shippo addresses, ZIP codes and object identifiers are not retained. Where authorized direct carrier access is configured, proof-of-delivery documents returned by the carrier may be stored as evidence.

Emails to our team inboxes

When you email one of our team addresses (such as support@, hello@, billing@, security@, privacy@, legal@ or careers@), we send one automatic confirmation. To send at most one per sender per inbox every 24 hours and never twice for the same message, we keep a one-way keyed hash of the sender’s email address (never the address itself), a hash of the message identifier, the inbox and the time, for 30 days. The confirmation never quotes the body of your message (it repeats your subject line, so the reply threads with your email) and contains no tracking. Automated, bulk and no-reply mail gets no confirmation.

Privacy requests

When you send a request through our privacy request form, we keep your name, email address, how you relate to Verdikx (merchant, shopper or other), the kind of request, the store web address and the details you choose to give, with the time it arrived and its status. We also keep a one-way keyed hash of the IP address you sent it from (never the address itself), used only to spot abuse of the form. We use this only to handle your request and keep a record of it, as the law requires. A copy of the request is emailed to our privacy inbox so the team can act on it, and a confirmation that contains nothing you typed (only our reference and fixed text) is emailed to you. See section 8 for how long we keep them.

Early access requests

If you ask for early access (the form on our early-access, sign-up and get-started pages, shown while the Shopify app or card billing is not open yet), we keep the email address and store web address you give us, your answers about whether you run the store, its platform and roughly how many orders it gets a month, the time you asked and whether we have told you that you can start, together with the first-page and campaign details described under How visitors find our website. We use them to tell you when you can start using Verdikx and to see which pages and campaigns bring store owners to us: no newsletter, no marketing list, and nothing is shared except with our email provider to send that message (and, only if you accepted advertising cookies, as described under Advertising cookies and pixels). If a store with the web address you gave us later installs Verdikx from a browser without our cookie, only the campaign tags of the request’s links are copied to it; your advertising choice, Meta’s ids and the email hash are never copied to a store, and we never compare the store’s email address with your request. A copy is emailed to our team inbox so we can follow up. The legal basis is steps you asked us to take before a possible contract (or, where that does not apply, our legitimate interest in answering your request), and, for the campaign details and answers used in measurement, our legitimate interest in knowing which pages and campaigns bring store owners to us. We delete a request once you start using Verdikx, or 24 months after you made it, whichever comes first, and sooner if you ask (section 9).

Files you upload and content you write

Supporting documents you upload to a case, response drafts you edit and evidence packets you generate.

Technical information and website visitors

Request and error logs, including IP addresses, browser user agent and internal account identifiers, used for security, rate limiting and troubleshooting. Advertising and analytics tags run on our public website only with your consent, as described under Advertising cookies and pixels; nothing of the kind runs in the app. The Verdikx web pixel runs only in merchants’ storefronts, for fraud screening, as described under Fraud screening data.

How visitors find our website (first-party, no cookies)

To learn which pages, search engines and AI assistants bring people to Verdikx, our website notes, in your browser’s local storage for 30 days, the first page you visited, the website that referred you (its domain only, never the full address) and any campaign tags in the link. We keep only an anonymous daily count of those landings, with no IP address, cookie or other identifier. If you create an account or ask for early access from that browser, the same details are saved with your account or request so we know which page you came from; with each store and account we also record when its free trial started and when it first paid, to see which pages and campaigns lead to paying customers. We also count, per day, page and campaign tags, how many visits arrive from a tagged link or ad and how many install buttons are clicked: anonymous counts only, with no IP address, cookie or identifier, and only once you accept cookies. None of it is shared with third parties or used for advertising unless you accept advertising cookies (see Advertising cookies and pixels), and browsers that send Global Privacy Control or Do Not Track are not counted. You can clear it at any time by clearing this site’s data in your browser.

Advertising cookies and pixels (public website, with your consent)

On our public website only (never inside the Verdikx app, the workspace or Shopify admin), and only if you accept them in our cookie banner, we use advertising and analytics tags from Meta (Meta Pixel and Conversions API). They tell us which pages, searches and ads bring merchants to Verdikx, measure whether an ad led to a sign-up, and let those providers show Verdikx ads to people who visited this site. Until you choose, and if you choose Reject all, none of them loads and nothing is sent to them. A browser that sends a Global Privacy Control or Do Not Track signal is treated as rejecting, without being asked.

When you accept advertising cookies, each page you view and each sign-up or install button you use is reported to those providers from your browser. The same events are also sent to Meta from our server (Meta’s Conversions API) with a shared event id so each is counted once; that server copy carries your IP address, browser type and the page address. If you then ask for early access, our server sends Meta a one-way SHA-256 hash of the email address you entered, never the address itself, so the ad that brought you here can be credited; when your answers show that you run a store with a platform and more than the smallest monthly order range, the request is also reported as a qualified request, with the platform and order range you chose. If you then install Verdikx or sign up, we keep Meta’s ad click id and browser id (the _fbc and _fbp values) and your browser type with that store or account, so that when its free trial starts and when it first pays, our server can tell Meta, with a one-way hash of our own id for the store or account and, for an account you signed up for on our website, a one-way hash of the email address you signed up with, and the ad can be credited. We never send Meta the email address Shopify holds for your store, and we never use it to recognise you. We delete those ids and that hash after 90 days, or sooner once the first payment has been reported, and never send these events for a store or account whose visitor did not accept advertising cookies. Your choice and these ids are carried over to a store only from the browser you installed it from: never from an early-access request, even one made with the same email address the store has. Accepting cookies also lets our website keep a first-party cookie (vx_attr) with the first page you visited, the referring site’s domain and the campaign tags of the link, so that an install or sign-up from this browser can be credited to the page or ad that brought you; it is read only by our own servers and deleted when you withdraw consent. Apart from what is described here, we store none of this ourselves. Each provider uses what it receives under its own privacy policy, as an independent controller for its advertising services.

You can change or withdraw your choice at any time with (also in the footer of every page), or by clearing this site’s data in your browser.

4. How we use information, and our legal bases

Where the EU or UK GDPR applies, we rely on these legal bases for merchant account data:

For buyer data, the merchant decides the legal basis; we use that data only to provide Verdikx to that merchant. We do not sell personal information, and we do not share it for cross-context behavioral advertising. We do not use it for advertising or share it with data brokers.

5. Order screening

When screening is enabled, Verdikx scores new orders using signals such as a high-value first order, especially with express shipping (compared with your store’s order history or, until Verdikx has 20 of your store’s recent orders, with a fixed amount in some currencies), prior refunds and chargebacks for the same customer, recent orders from other buyers shipping to the same address, disposable or shared role email addresses, billing and shipping location mismatches, your earlier decisions about the same customer, and Shopify’s own risk assessment. The stored screening result contains the score, the reasons and a one-way hashed customer key instead of the customer’s email. The underlying order records still contain the buyer details listed above.

Screening runs after an order is placed and never blocks checkout. If order actions are enabled, Verdikx adds tags or notes to the order and publishes its assessment to the Shopify order risk panel. It holds High-risk orders automatically by default (you can turn this off in your screening settings, Automation → Order screening), and it holds orders from customers you blocked and orders a risk rule you created or a blocklist entry holds. Without order screening (Starter), Verdikx does not hold or tag new orders. You can release, approve or cancel any held order. Verdikx never cancels an order on its own: an order is cancelled only when you confirm it. Screening never refunds an order. Verdikx acts by itself on a pre-dispute alert, such as a Stripe early fraud warning, only if you turn that on (Growth and up, off by default): a prevention policy can hold the linked order and refund it within your cap, and a separate setting can cancel the buyer's subscription on Recharge, or pause or cancel it on Skio or Stripe Billing, when an early fraud warning arrives.

Verdikx Network

The Verdikx Network is opt-in. Verdikx stores whose merchant chose to join share fraud outcomes with each other, so that a buyer with a history of chargebacks or refund abuse at other participating stores can be recognized, and a buyer with a long good history can be trusted. The network is used only for fraud and abuse prevention; it is never used for advertising, marketing or profiling unrelated to fraud, never used to decide anyone’s eligibility for credit, employment, insurance or housing, and nothing in it is sold.

• What is shared: outcome events (a chargeback, a dispute the merchant won, refund abuse flagged by Verdikx, or an order that reached 120 days without a dispute) together with one-way keyed hashes (HMAC-SHA256) of the buyer’s normalized email, phone number, shipping street and postal code, billing name and postal code, card BIN and last four digits, and IP address range. The hashing key is held only by Verdikx’s servers. The network never contains raw buyer details, order contents or amounts.
• What other participating stores see: only aggregate, time-decayed counts (for example, “chargebacks at 3 other stores”) as screening reasons and risk-rule values, and only when at least three other participating stores reported the same kind of outcome. Signals flow only between stores that joined: a store that has not joined neither contributes nor receives anything. No store can see which store reported an outcome, its orders or its customers, and no store can read the network data directly.
• Choice: participation is off until a merchant joins in Settings by agreeing to the Verdikx Network terms; we record the terms version and the date of that agreement. A merchant can leave at any time in Settings: the store stops contributing and receiving signals immediately, and the outcomes it already contributed are deleted. Receiving network signals in screening requires the Growth plan or above. Internal test stores never take part.
• Retention: hashed identifiers captured at screening are kept for up to 200 days so that later outcomes can be attributed; outcome events lose weight over time and are deleted after three years. A store data deletion request deletes everything the store contributed, and a customer redaction request deletes that customer’s network events from the store.

6. AI processing

Verdikx uses OpenAI, through the OpenAI API, for five features:

• Dispute response drafts. For each draft we send a limited subset of the case evidence: the dispute reason, payment and fulfillment status, order total and currency, order date, item titles, variants, quantities and prices, carrier names, tracking numbers and carrier tracking events, your published store policies, and our own consistency findings. We do not send customer names, email addresses, billing or shipping addresses, payment details, or files you upload. Orders whose customer has been redacted are excluded.
• Contradiction finder. Short summaries of the case facts and excerpts of customer messages, with email addresses, phone numbers and long numbers removed before sending.
• Risk explanations. For orders Verdikx screens as Needs review or High risk, or that are on hold, and for customer profile summaries, we send only results Verdikx has already computed: the risk score and screening reasons; the checkout IP address reduced to its network prefix (for example 185.220.101.x) with its country, its state or region when the deployment uses MaxMind’s optional GeoIP2 Insights lookup and it found one (never its city), its network (AS number and name) and VPN, proxy, Tor or hosting flags; the billing and shipping country and state; a masked email (first letter and domain only); counts of the customer’s orders, refunds, returns and disputes in your store; which detail matched your blocklist (for example “shipping address”, never the blocked value) and how many other customers share the device or IP; and your SEON verdict if you use SEON. Names, full email addresses, full IP addresses, street addresses, postal codes, phone numbers and payment details are not sent, and phone or card numbers inside screening reasons are removed first. The AI states places, and which detail matched your blocklist or Trusted list, by inserting short facts Verdikx writes from what was sent (for example “the order’s shipping address is on your blocklist”), each as a sentence of its own with none of the AI’s words in it. In its own words it may name only a place that is true for the IP and every address, a sentence that mentions a list may not name an order detail, and the title of a factor or point may name no place and no order detail unless it repeats a screening reason’s label exactly. Verdikx does not use the answer, and shows its own rules-based explanation instead (as it does when the AI is unavailable), if any number (network AS numbers included), IP prefix, email or listed place name anywhere in it is not in what was sent, or if its summary or rationale breaks one of these rules. A factor, or a point in the order’s favour, that breaks one of these rules is left out. Network names are not compared.
• Ask Verdikx (the in-app assistant). The question you type and the conversation so far, the name of the page you are on, matching Help Center articles, and a few non-sensitive account facts (whether a store is connected, your plan and whether it is active, which services are connected or need attention, and your Autopilot setting). It does not receive your customers’ details, case evidence or payment details.
• Reading forwarded dispute notices. The subject, sender and text of an email you forward to your intake address, so the dispute details can be extracted. Before sending, we mask email addresses (including the sender’s), IP addresses, IBANs and card-like numbers, and common formats of phone numbers (international, North American and national numbers written in groups, or numbers after a phone label), street addresses (house-number-and-street forms and anything after an address label) and buyer names (after labels such as Name, Customer or Ship to, in greetings and sign-offs, and next to an email address). Order numbers, case references and amounts are kept so the dispute can be matched. Masking is pattern-based, so a detail written in an unusual format, such as a name mentioned mid-sentence, can still reach OpenAI.

Requests are made with OpenAI’s response storage turned off. Under OpenAI’s API terms, data sent through the API is not used to train OpenAI’s models; OpenAI may keep API data for a limited period to detect abuse. We do not use your data or your customers’ data to train AI models.

AI output is a suggestion. It may be incomplete or wrong, and nothing is submitted until you review it, or until Autopilot rules that you turned on allow it.

7. Service providers and other disclosures

We share personal data only with service providers (subprocessors) that help us run Verdikx, each limited to the purpose listed on our Data processing and subprocessors page. The core providers are:

• Vercel: application hosting.
• Supabase: database, authentication and file storage.
• OpenAI: AI drafting and analysis (section 6).
• Shopify: the platform the app runs on, and subscription billing for Shopify stores.
• Stripe: card billing for workspaces not billed through Shopify, and invoices for custom agreements with workspaces not on Shopify, sent through Stripe (card and bank details stay with Stripe).
• Google: sign-in, if you choose Sign in with Google.
• Payment processors you connect, such as Stripe and PayPal: to import disputes and submit the evidence you approve.
• Resend and Postmark, when enabled: sending notification emails and receiving the emails you forward.

Other providers are used only if you connect them or the feature is configured; the full list is on the Data processing page. We may also disclose information when required by law, to protect the rights and safety of our users or others, or as part of a merger or acquisition, in which case this policy continues to apply to the transferred data.

8. Retention and deletion

• While installed: store data is kept while the app is installed so the evidence history is available when a dispute arrives.
• Operational records: raw webhook payloads are redacted about 30 days after receipt (only the event’s id, topic, store and status are kept, so a repeated delivery is recognised) and deleted about 30 days later. A payload that belongs to an open dispute is kept until the dispute closes, and never more than 180 days. Background job payloads are redacted about 14 days after the job is queued (a job still waiting by then is stopped) and the job record is deleted about 30 days later. Storefront device signals that never matched an order are deleted after 2 days; hashed identity signals, IP intelligence and device signals linked to an order are deleted after 400 days. Team inbox auto-reply records (a keyed hash of the sender, never the address) are deleted after 30 days. Server logs are kept by our hosting provider for a limited period, with email addresses, IP addresses (reduced to their network), IBANs, card-like numbers, secrets and common phone number formats masked before they are written.
• AI and usage records: AI-written risk explanations are removed from screening results after about 400 days (a rules-based explanation is shown instead), and cached AI customer summaries that have not been refreshed for 180 days are deleted. Usage records used to run the service (counts of AI requests, tokens, emails, API calls and storage, with no prompt or response content) are kept for about 400 days, and monthly totals for about 25 months. Read or resolved in-app alerts are deleted after 180 days, and account activity logs after 2 years.
• Uninstall: when you uninstall, Shopify revokes the app’s access and Verdikx stops collecting data for that store. Shopify then sends a store data deletion request (typically 48 hours after uninstall). On that request we delete the store’s orders and their evidence history, refunds, disputes, customers, risk and refund-abuse records, screening results, settings, subscription records, uploaded files and evidence packets (including the stored files), and the store record, and we redact stored webhook payloads.
• Workspaces not on Shopify: when you remove a workspace, its connections stop at once and its data is erased 48 hours later. When a card subscription ends and is not reactivated, the account’s workspaces are erased 30 days later. Erasure deletes the same records as a Shopify store deletion request.
• Customer redaction: when Shopify sends a customer redaction request, we delete that customer’s order evidence history and case files and packets, replace their email with a non-identifying placeholder, remove their name and addresses from order records, unlink their hashed screening key and delete their orders’ Verdikx Network identifiers and events, their orders’ IP intelligence and device signals and blocklist matches, blocklist and Trusted entries for their email address or created from their orders, and the matched value in their orders’ screening reasons. Non-identifying transaction details (such as amounts and statuses) remain part of the merchant’s records.
• Customer data requests: when Shopify sends a customer data request, we automatically gather the records held for that customer into a JSON export, list it under Settings → Privacy requests and email the merchant a download link, so the merchant can answer within 30 days. Exports are deleted after 30 days, or earlier if the customer is redacted. Questions: privacy@verdikx.com.
• Merchant account: you can delete your account yourself in Settings → Delete account (outside Shopify admin) by typing your account email to confirm. It ends any card subscription at once, erases every workspace’s data and deletes your login immediately. A Shopify store must be uninstalled first; Shopify’s store deletion request then removes its data. You can also email privacy@verdikx.com to request deletion or a copy of your account data; there is no self-service export yet. After we verify an emailed request, we complete deletion within 30 days. Records we must keep by law (such as billing and tax records) are kept only for as long as the law requires.
• Talent community: sign-ups and résumés are deleted automatically 24 months after sign-up (section 15).
• Early access requests: deleted automatically once you start using Verdikx, or 24 months after the request, whichever comes first (section 3). The copy emailed to our team inbox is kept no longer than that.
• Privacy requests: the record of each request sent through the form (the details listed under Privacy requests in section 3, including the keyed IP hash) is kept for 24 months from when we received it, as California’s regulations require, then deleted automatically. The copy emailed to our privacy inbox is kept no longer than that.

9. Your rights and how to exercise them

Merchants and website visitors can ask for access to, a copy (export) of, correction of or deletion of their personal data through our privacy request form or by emailing privacy@verdikx.com from the address on the account. Merchants can also delete their account themselves in Settings (section 8).

How long it takes.

• We confirm receipt of every request within 10 business days. Requests sent through our online form are confirmed on screen straight away, and by email.
• We aim to answer every request within 30 days.
• Under California law (the CCPA, as amended by the CPRA) and similar US state laws, we answer within 45 calendar days of receipt. If we reasonably need more time, we may extend this once by up to 45 more days, and we will tell you why before the first 45 days end.
• Under the GDPR and the UK GDPR, we answer within one month of receipt. For complex or numerous requests we may extend this by up to two more months, and we will tell you why before the first month ends.
• Requests to opt out of the sale or sharing of personal information, or to limit the use of sensitive personal information, are acted on as soon as feasible and within 15 business days.

Verification. We verify your identity only for requests to know or access, delete or correct personal information. Requests to opt out of sale or sharing, or to limit the use of sensitive personal information, do not need verification; we may decline one only if we have a good-faith, documented reason to believe it is fraudulent. Verified deletion requests are completed within 30 days.

EU, UK and similar laws: you have the right to access, rectify and erase your data, to restrict or object to processing (including processing based on legitimate interests), to data portability, to withdraw consent at any time, and to complain to your local data protection authority.

California and other US states (CCPA/CPRA and similar): you have the right to know what personal information we collect, use and disclose; to access and receive a portable copy; to correct it; to delete it; and not to be discriminated against for exercising these rights. We do not sell personal information. If you accept advertising cookies on our website, the advertising tags described in section 3 send visit and sign-up events to Meta, which California law may treat as “sharing” for cross-context behavioral advertising; you can opt out at any time by choosing Reject all in the cookie banner or Cookie settings in the footer, and we treat a Global Privacy Control signal as that opt-out. We do not use sensitive personal information to infer characteristics, so there is nothing further to limit. You may use an authorized agent; we will ask for proof of the agent’s authority and may verify your identity directly.

Buyers should contact the merchant; Shopify forwards buyer requests to us through its privacy webhooks, which we handle as described in section 8.

10. Cookies

The Verdikx app and workspace use only cookies that are strictly necessary for sign-in, security and the site to work. Our public website also offers advertising and analytics cookies from the providers named in section 3; they are set only after you accept them in the cookie banner, where rejecting is one click, and your choice is kept in your browser’s local storage (vx_consent) so you are not asked again. The first-party landing-page note described under Technical information and website visitors is kept in local storage, not a cookie, and is never shared; once you accept cookies, a copy is also kept in our own first-party vx_attr cookie, described under Advertising cookies and pixels. The full list of cookies and browser storage, with lifetimes, is on Your privacy choices.

11. Security

• All traffic uses HTTPS.
• Shopify access tokens and credentials for connected services are encrypted at rest (AES-256-GCM). API keys are stored only as hashes.
• Database row-level security limits each account to its own records, and every Shopify, Stripe and Rutter webhook is verified by its signature before processing.
• Requests are rate limited, and account changes are protected against cross-site request forgery.
• We request the minimum Shopify permissions listed above; restricted permissions are requested only after Shopify approves them.

No system is perfectly secure. If we learn of a security incident affecting your data, we will notify you as required by law.

12. International transfers

We are based in the United States, and our providers process data in the United States and other countries. When personal data from the EU, UK or Switzerland is transferred to a country without an adequacy decision, we rely on the safeguards in our providers’ data processing terms, such as the European Commission’s Standard Contractual Clauses.

13. Children

Verdikx is a business tool. It is not directed to children, and we do not knowingly collect personal data from children under 16. If you believe a child has given us personal data, contact us and we will delete it.

14. Changes

We will update the “last updated” date when this policy changes and notify merchants of material changes in the app or by email before they take effect.

15. Job applicants and our talent community

If you join our talent community on the Careers page, we are the controller of the details you give us: your first and last name, email address, the kind of role you are interested in, your location, and, if you add them, a LinkedIn or portfolio link, a résumé (PDF) and a short note. We also keep the date you gave consent and a one-way keyed hash of the IP address you signed up from, used only to spot abuse of the form.

• Purpose and legal basis: to consider you for roles at Verdikx and contact you about them, based on the consent you give on the form. We do not use these details for marketing or share them outside the team that reviews them.
• Who processes it: details and résumés are stored in our database and private file storage (Supabase), and the team is notified by email (Resend). Résumés are never public; the team opens them through links that expire after 24 hours.
• Retention: we keep your details for up to 24 months from the day you sign up, then delete them and your résumé automatically.
• Your choices: you can withdraw consent and ask us to delete your details, or ask for a copy, at any time by emailing privacy@verdikx.com. Withdrawing consent does not affect processing before you withdrew it.

16. Contact

• Operator: Verdikx LLC
• Address: 111 Town Square Place, Suite 1201, PMB 1270, Jersey City, NJ 07310
• Country: United States (New Jersey)
• Privacy contact: privacy@verdikx.com