Your store data stays your store data.
1. Who we are
This privacy notice explains how Veltara ("we", "us") handles personal data and store data when you use the Veltara service and Shopify-integrated app.
For account and usage data the data controller is Veltara. Contact: support@veltara.app.
For the store data we process on your behalf when providing the service, you remain the controller of your store and your customers' data, and we act as your processor/service provider. For your account and usage data we act as the controller.
2. The data we collect
Account data. Your email address and a hashed password, plus basic account metadata such as sign-in timestamps.
Shopify store data (read-only). With your authorisation we read your shop domain and ID, products, variants and SKUs, and order records including dates, totals, discounts, refunds and shipping amounts. We request only read access and we do not ask Shopify for your customers' names, email addresses or street addresses.
Cost data you provide. Product costs, shipping, fulfilment, payment-fee and other variable-cost figures you type in or import by CSV, including their effective dates.
Usage data. Page-view and feature counters (for example, that an analysis ran or a plan changed). These counters do not include advertising identifiers, raw IP addresses, customer details or financial values.
Technical data. Security and error logs. IP addresses are processed transiently for security and rate limiting using keyed hashes rather than stored raw addresses.
3. What we never collect or do
We do not collect your customers' personal data, we do not sell or share data for advertising, we do not load third-party advertising or tracking scripts, and we do not send your financial or store data to an AI model or AI provider. Analysis is performed by our own deterministic calculation engine.
4. How we use data and our lawful bases
Under UK GDPR we rely on: contract — to provide the service you signed up for, including syncing your store, running analyses and billing; legitimate interests — to secure the service, prevent abuse, and improve the product using aggregate or de-identified information; and legal obligation — for accounting, tax and compliance records.
Shopify store data is used solely to provide and improve the Veltara service to you, in line with Shopify's API Terms and data-protection requirements. It is never used for unrelated purposes or shared with other merchants.
5. Who processes data for us
We use a small number of service providers acting under contract: our hosting provider (Render), a transactional email provider for account notifications, and an encrypted backup provider. Shopify provides the commerce, app-installation and app-billing integrations. We do not otherwise share personal data except where required by law, to enforce our terms, or as part of a business transfer described below.
6. International transfers
Data is hosted on infrastructure operated by Render. Where data is transferred outside the UK or EEA we use appropriate safeguards such as the UK International Data Transfer Agreement or standard contractual clauses.
7. Retention and deletion
We keep your account, store data, cost data and saved calculation snapshots while your account is active so you can review past analyses. If you uninstall the app or delete your account, we revoke local access to Shopify credentials and delete or de-identify store data within 30 days, except records we must keep for legal, accounting or fraud-prevention purposes.
We honour Shopify's mandatory data-protection webhooks — customer data requests, customer data erasure and shop data erasure — and process them within the required timeframes.
8. Security
Access tokens are encrypted at rest, connections use TLS, and access to production systems is limited to authorised personnel on a least-privilege basis. No method of transmission or storage is completely secure, but we maintain organisational and technical measures appropriate to the data we hold.
9. Your rights
You can ask to access, correct, export or delete your personal data, to restrict or object to processing, and to withdraw consent where we rely on it — contact us at support@veltara.app and we will respond within one month. You can also complain to the UK Information Commissioner's Office (ico.org.uk) if you are unhappy with how we handle your data.
10. Cookies
We use only strictly necessary cookies — session and security cookies that keep you signed in and protect forms. We do not use analytics or advertising cookies, so no cookie consent banner is required.
11. Business transfers
If Veltara is involved in a merger, acquisition or sale, data may transfer to the new operator under the same protections described here, and we will notify you before a different privacy notice applies.
12. Changes and contact
We may update this notice as the service evolves. Material changes will be announced in the app or by email before they take effect, and the "last updated" date will change. Questions: support@veltara.app. Last updated: 22 September 2026.