Last updated: October 2026 · Effective date: October 6, 2026 · Operator: Verdikx LLC
This page explains the choices you have about your personal information at Verdikx, including under the California Consumer Privacy Act as amended by the CPRA, and lists every cookie our website and app set. For the full detail, read the Privacy Policy and our California privacy notice.
We do not sell your personal information; advertising cookies run only with your consent
Verdikx does not sell personal information, and we do not share data with data brokers. The Verdikx app and workspace have no advertising cookies, no third-party analytics and no tracking pixels. Our public website offers advertising and analytics cookies, described below, that run only after you accept them; sending visit and sign-up events to those providers may count as “sharing” for cross-context behavioral advertising under California law, so rejecting or withdrawing that consent is your opt-out, and it takes effect immediately.
On our public website only (never inside the Verdikx app, the workspace or Shopify admin), and only if you accept them in our cookie banner, we use advertising and analytics tags from Meta (Meta Pixel and Conversions API). They tell us which pages, searches and ads bring merchants to Verdikx, measure whether an ad led to a sign-up, and let those providers show Verdikx ads to people who visited this site. Until you choose, and if you choose Reject all, none of them loads and nothing is sent to them. A browser that sends a Global Privacy Control or Do Not Track signal is treated as rejecting, without being asked.
You can change or withdraw your choice at any time with (also in the footer of every page), or by clearing this site’s data in your browser.
We also do not use sensitive personal information to infer characteristics about you. The Verdikx Network, which merchants can choose to join, shares fraud outcomes between participating stores only as one-way keyed hashes, only for fraud and abuse prevention, and nothing in it is sold (see Verdikx Network).
Global Privacy Control
We honor Global Privacy Control (GPC). If your browser sends a GPC signal, or a Do Not Track signal, our website does not run its first-party visit counter: it does not note your landing page or referrer in your browser and does not send the anonymous landing count. We also treat a GPC or Do Not Track signal as rejecting advertising and analytics cookies: the cookie banner is not shown, no advertising tag loads, and the choice is recorded as “rejected” until you change it in Cookie settings. That is your opt-out from the sale or sharing of personal information. You do not need an account for this to work.
Make a privacy request
You can ask to know what personal information we hold about you, get a copy of it, correct it, or delete it. To opt out of the sharing of personal information for cross-context behavioral advertising, reject advertising cookies in the cookie banner or in Cookie settings in the footer: that takes effect immediately in that browser. You can also ask us by email or through the form and we will record your request. We do not sell personal information, and you can ask us to limit the use of sensitive personal information, although we do not use it in those ways.
- Online: use our privacy request form.
- By email: write to privacy@verdikx.com, from the email address on your Verdikx account if you have one.
- In the app: delete your account yourself in Settings → Delete account (outside Shopify admin), and download your cases at any time with Results → Export CSV and each evidence packet from its case. There is no self-service export of your whole account yet; ask for one through the form or by email.
- We confirm receipt of every request within 10 business days. Requests sent through our online form are confirmed on screen straight away, and by email.
- We aim to answer every request within 30 days.
- Under California law (the CCPA, as amended by the CPRA) and similar US state laws, we answer within 45 calendar days of receipt. If we reasonably need more time, we may extend this once by up to 45 more days, and we will tell you why before the first 45 days end.
- Under the GDPR and the UK GDPR, we answer within one month of receipt. For complex or numerous requests we may extend this by up to two more months, and we will tell you why before the first month ends.
- Requests to opt out of the sale or sharing of personal information, or to limit the use of sensitive personal information, are acted on as soon as feasible and within 15 business days.
We verify your identity only for requests to know or access, delete or correct personal information. Requests to opt out of sale or sharing, or to limit the use of sensitive personal information, do not need verification; we may decline one only if we have a good-faith, documented reason to believe it is fraudulent. Verified deletion requests are completed within 30 days, except records the law requires us to keep. You can use an authorized agent. We will not treat you differently for exercising your rights. The California privacy notice explains verification, agents and appeals.
If you bought from a store that uses Verdikx
Stores use Verdikx to keep evidence of their orders and screen them for fraud. For that data we are the store’s service provider, so please contact the store you bought from first. When a Shopify store receives your request, Shopify forwards it to us automatically: a data request produces an export for the store, and a deletion (redaction) request removes your details as described in Retention and deletion. If you contact us directly, we will tell you which store to contact, or pass your request to it.
Cookies and similar technologies
The Verdikx app and workspace set only cookies that are strictly necessary for sign-in, security and the site to work; blocking these in your browser will stop you from signing in. On our public website a cookie banner also offers the advertising and analytics cookies listed further down, which are set only if you accept them.
| Cookie | Purpose | Lifetime |
|---|---|---|
sb-<project>-auth-token | Keeps you signed in to the Verdikx website. Large sessions are split into numbered parts (.0 to .4). Only our servers read it (HttpOnly); it is sent only over HTTPS (Secure) and not with requests from other sites (SameSite=Lax). Inside Shopify admin, Verdikx uses your Shopify login instead. | Up to 30 days; removed when you sign out or after 24 hours without activity |
sb-<project>-auth-token-code-verifier | A one-time code that completes a social sign-in handled by our authentication provider (for example Microsoft, or Google when it is not handled on verdikx.com directly). | Used once, during sign-in |
verdikx_selected_shop | Remembers which of your workspaces or connected stores is open. | Up to 1 year; removed when you sign out |
recoverly_selected_shop | The same setting under the product’s former name. We no longer set it; we only read and remove it. | Removed when you sign in or out |
shopify_oauth_state | Protects the Shopify store connection against request forgery. | 10 minutes; cleared when the connection completes |
vx_shopify_login | Protects Continue with Shopify sign-in against request forgery and remembers where to return afterwards. | 10 minutes; cleared when sign-in completes |
vx_google_oauth | Protects Sign in with Google against request forgery and replay. | 10 minutes; cleared when sign-in completes |
vx_seen | When you last used the Verdikx website, signed so it cannot be changed. Signs you out after 24 hours without activity. | Up to 30 days; removed when you sign out |
vx_console_seen | Verdikx team only: when the admin console was last used. Signs the team member out after 30 minutes without activity. | Up to 12 hours; removed when you sign out |
vx_staff | Store staff who sign in with Continue with Shopify: when their sign-in ends (after 12 hours), signed so it cannot be changed. | Up to 30 days; removed when you sign out |
vx_reauth | Remembers for a few minutes that you confirmed it's you (password or authenticator code) before a sensitive change, such as creating an API key. | 10 minutes |
vx_site_access | Lets the Verdikx team view the website while it is in private preview. Set only while the preview lock is on. | 30 days |
Sign-in, sign-up, password reset and our public forms (early access, careers and privacy requests) run Cloudflare Turnstile, a security check that tells people from automated bots. To do that, Cloudflare receives your IP address and technical details about your browser; it does not receive what you type into the form. It never runs inside Shopify admin.
Our pages also keep a few small values in your browser’s local or session storage. They are not cookies, are not sent with every request, and are never shared with third parties. You can remove them by clearing this site’s data in your browser.
| Key | Where | Purpose | Lifetime |
|---|---|---|---|
vx_consent | Local storage, public website | Your cookie choice (analytics and advertising accepted or rejected, and when), so the banner does not ask again. Written as “rejected” without asking when your browser sends Global Privacy Control or Do Not Track. Only while an advertising or analytics tag is configured. | Until you change it in Cookie settings or clear this site’s data |
vx_first_touch | Local storage, public website | The first page you visited, the referring website’s domain and any campaign tags, used to count where visitors come from (an anonymous daily count) and saved with your account or early-access request if you sign up or ask for early access from this browser. Not written when your browser sends Global Privacy Control or Do Not Track. | Used for 30 days |
verdikx_impact_banner_v1 | Local storage, public website | Remembers that you have seen or dismissed the Verdikx Impact announcement bar, so it is shown only once. Only while that announcement runs. | Until you clear this site’s data |
verdikx:remembered-emails:v1 | Local storage, sign-in page and workspace | Up to five email addresses you signed in with on this device, so you can switch accounts quickly. You can forget an address from the account menu. | Until you remove it or clear this site’s data |
verdikx:sidebar-collapsed | Local storage, workspace | Remembers whether you collapsed the workspace sidebar. | Until you clear this site’s data |
verdikx:welcome:… and verdikx:webhook-health:… | Session storage, workspace | Avoid showing the welcome message twice and repeating a background connection check during one visit. | Until you close the tab |
Advertising and analytics cookies (public website, with your consent)
| Cookie | Set by | Purpose | Lifetime |
|---|---|---|---|
vx_attr | Verdikx (first-party) | The first page you visited, the referring site's domain and the campaign tags of the link (and, when you accepted advertising cookies and Meta's pixel is in use, Meta's ad click id and browser id), so that installing or signing up can be credited to the page or ad that brought you. Read only by our own servers; deleted when you withdraw consent | 30 days |
_fbp | Meta | Tells Meta's pixel which browser this is, to measure visits and ad results | 90 days |
_fbc | Meta | Keeps the click id from a Meta ad you arrived from, to attribute the visit | 90 days |
Inside Shopify admin, Shopify’s own cookies apply under Shopify’s policies. The Verdikx web pixel runs only in a merchant’s storefront, never on our website, and only when the shopper’s analytics consent allows (see Fraud screening data).
Questions
Email privacy@verdikx.com or use the privacy request form.