Privacy Policy

Last updated: 2026-08-19

Data we process

To deliver Vellona's GPSR (Regulation EU 2023/988) compliance tooling, we process:

• Product data — titles, handles, categories and safety attributes you manage in Shopify, used to generate safety information pages and to write batch metafields.
• Company Profile — manufacturer, importer and EU responsible-person details you enter in the app, used to populate the public safety page.
• Shop metadata — shop domain and plan context, used for installation, licensing and routing.
• Subscription status — current plan and billing state, used to gate features and manage charges.

What we do not collect

• We do not collect buyers' personal information (PII).
• We do not read or store payment card data — all charges are handled by Shopify Billing.

Storage & security

Application data is stored in JSON files on our server. Access tokens are encrypted at rest and secrets are never written to logs.

GDPR & your privacy rights

You may request export, correction or deletion of your data. Vellona responds to the Shopify mandatory webhooks customers/data_request, customers/redact and shop/redact, and deletes the shop's data when received. Uninstalling the app also triggers deletion of your shop's data.

Third parties

We rely on Shopify for OAuth authentication, billing, App Bridge embedding, product images and the Admin API. Data is shared with Shopify only as required to operate these functions.

Contact

Questions about this policy: support@joycraft.dev.