Privacy Policy

B. Product Research and Usage Information

When you use the Service, we may collect information about how you interact with ValidDs, including:

• •Products you search, save, analyze, compare, or validate
• •Keywords, niches, categories, filters, and search inputs
• •Products added to a watchlist or similar feature
• •Validation results and research history
• •Supplier searches and outbound supplier-link activity
• •Creative-angle and marketing-analysis activity
• •Features you use and actions you take within the Service
• •Support requests and communications with us

This information allows us to provide the Service, maintain your research history, improve the user experience, and understand how ValidDs is being used.

C. Payment and Subscription Information

Paid ValidDs subscriptions are billed through Shopify's app billing system.

Shopify processes subscription charges and provides ValidDs with limited subscription and transaction information needed to administer your account, such as:

• •Subscription status
• •Plan
• •Billing status
• •Transaction confirmations
• •Cancellation or renewal status

ValidDs does not receive or store your full payment card number.

Your payment and billing relationship with Shopify is also subject to Shopify's applicable terms and privacy practices.

D. Technical Information

When you use the Service, we may automatically collect certain technical information, including:

• •IP address
• •Browser type
• •Device type
• •Operating system
• •Pages or screens viewed
• •Referring URLs
• •Login and access information
• •Cookies and similar technologies
• •Application logs
• •Diagnostic, performance, and security information

We use Google Analytics 4, provided by Google, for optional website usage analytics. When enabled, it collects information about website visits and interactions, such as pages viewed, browser and device information, referring sources and analytics identifiers. We use this information to understand website usage and improve the Service. Where applicable law requires prior consent, we enable these analytics only after you accept. In regions where an opt-out approach is permitted, analytics may be enabled by default. You can turn off optional analytics through our Privacy choices page. We keep these analytics disabled when your browser sends a Global Privacy Control signal.

We use Sentry for application error monitoring and diagnostics in the browser and in server and edge components. Diagnostic events may include technical context, application activity surrounding an error, and other information needed to investigate faults. We configure diagnostic collection to limit personal information and filter sensitive content, but do not represent that all diagnostic data is anonymous.

We do not use session replay or session-recording tools.

We do not use third-party advertising pixels or cross-context behavioral advertising technologies. If those practices materially change, we will update this Privacy Policy and provide applicable privacy choices as required by law.

E. Connected Store Orders and Fulfillment

Where enabled and authorized by a merchant, we receive information from Shopify about orders assigned to the ValidDs integration. This information may include:

• •Store, order and fulfillment-order identifiers and related workflow timestamps
• •Product titles, variant identifiers, SKUs and quantities
• •Recipient first and last names, company names and delivery address details, including address lines, city, state or province, postal code and country
• •Merchant-entered tracking numbers, carriers and supplier order references
• •Fulfillment status and related operational records

We use these details to display and manage assigned orders, support merchant-managed sourcing and delivery, submit supported tracking updates to Shopify, secure the workflow, and handle applicable privacy requests. We do not purchase or physically ship goods on behalf of merchants.

The fulfillment workflow does not retain shopper email addresses or telephone numbers that may be present in incoming Shopify data. It does not store shoppers' payment-card or billing details. Merchant account contact information is separate and is described above. Access depends on Shopify permissions and approvals; incomplete order information does not mean a complete delivery address has been received.

When Shopify or a merchant sends a privacy request, we may also process the identifiers and request details necessary to locate relevant records, carry out the request and document our response. Those records are subject to the retention explanation in Section 8.

A. Service Providers

We may use third-party companies to provide infrastructure, cloud hosting, authentication, email, security, data processing, technical services, artificial-intelligence functionality, customer support, and other services necessary to operate ValidDs. These providers receive information only as reasonably necessary to perform services for us and are subject to applicable contractual and legal restrictions.

Our order-service infrastructure uses Render for application hosting and MongoDB Atlas for database storage. We use Sentry for the diagnostics described in Section 1. These providers have different functions and do not necessarily receive the same data. We do not provide shoppers' delivery details to generative-AI services for product research or marketing outputs. Information about providers that process merchant customer data on our behalf, their functions and processing locations is available by contacting privacy@validds.com.

We use Resend for service email. In addition to notifications, our deletion-recovery process sends limited recovery records through Resend to a company-controlled Google Workspace recovery group. These records may include store, order, request and internal account identifiers, deletion scope, closure and completion timestamps, and recovery-copy delivery status, but not shopper names, shipping addresses or copies of deleted purchase details. Identifiers may still be linkable to individuals or transactions; we do not treat these records as anonymous merely because names and addresses are omitted. Retention of our recovery records and managed copies is described in Section 8.

We use Vercel to host and deliver our website. Providing these services involves processing website requests and associated technical information, such as IP addresses, browser information and requested URLs.

We use Google Analytics 4 for the optional usage analytics described in Sections 1 and 6.

We use Denser AI to provide website chat assistance. When you open chat, your browser connects to Denser and transmits technical information needed to establish and operate the chat. When you send a message, Denser processes the message and associated conversation information to provide a response.

B. Shopify

We may disclose or receive information from Shopify as necessary to install the ValidDs application, authenticate stores, administer subscriptions, process billing, manage application access, receive and display assigned fulfillment orders, submit merchant-entered tracking updates, and handle applicable privacy requests. Shopify processes information under its own applicable terms and privacy practices.

C. EcomBos

Information associated with an EcomBos referral may be disclosed as described in Section 3.

D. Legal and Safety Disclosures

We may disclose information if we reasonably believe disclosure is necessary to:

• •Comply with law, regulation, subpoena, court order, or legal process
• •Respond to lawful government requests
• •Enforce our agreements
• •Investigate fraud or security issues
• •Protect the rights, property, or safety of ValidDs, our users, or others

E. Business Transactions

Information may be disclosed in connection with an actual or proposed merger, acquisition, financing, reorganization, sale of assets, or similar corporate transaction, subject to applicable law.

F. Merchants, Suppliers and Customer Requests

The merchant and its authorized users can access the order information we process for that merchant. Merchants are responsible for selecting suppliers, placing supplier orders and sharing the delivery information needed to fulfill those orders. A supplier-search link is not itself a transfer of the shopper's address by ValidDs. Suppliers and carriers independently engaged by the merchant operate under their own terms and privacy practices.

For an applicable customer access request, we provide the merchant with a package of the responsive information held by ValidDs. The merchant is responsible for verifying the requester and sharing the package securely. The package is not a complete Shopify export. We may use contact and request information to notify the merchant that a package is available without including the package contents in the notification.

A. Customer Delivery Information

The following rules apply to customer delivery information held in the active order system:

• •For orders marked completed, cancelled or unable to be filled, delivery information is scheduled for removal 30 days after that status is recorded.
• •For orders with destinations outside the United States, delivery information is scheduled for removal 30 days after the order is received by ValidDs.
• •For orders that remain unresolved, delivery information is scheduled for removal 90 days after the order is received by ValidDs.
• •An applicable earlier customer-deletion request removes the specified operational orders, including their delivery information. Store disconnection, app removal, Shopify store deletion and ValidDs account closure remove all operational orders for the affected store, without waiting for ordinary retention periods.

Where more than one rule applies, the earliest applicable deadline governs. Routine updates, retries or reimports do not restart the receipt-based retention clock.

Scheduled deletion is performed through periodic processing and is not a promise of deletion at an exact second. Deleting information from ValidDs does not itself cancel, close or fulfill an order in Shopify. Merchants must maintain the records they independently need to fulfill their own obligations.

B. Remaining Order, Request and Operational Records

When delivery information expires under the ordinary schedule, the remaining order record is scheduled for deletion 365 days after the order is completed, cancelled or marked unable to be fulfilled. If an order has not reached one of those statuses, that period runs from the record's last update. Periodic cleanup deletes the record once its delivery information has been removed and the applicable period has elapsed.

That remaining record includes store and account references, Shopify order and fulfillment identifiers, products and quantities, order status, carrier name and workflow timestamps. It does not retain the removed recipient name, shipping address, tracking number or supplier order number.

An applicable customer-deletion request deletes the specified operational orders, including those remaining fields. Store disconnection, app removal, Shopify store deletion and ValidDs account closure delete all operational orders for the affected store. These requests do not wait for the ordinary order-retention period. Separate deletion-recovery records are described below.

Generated customer access packages expire 30 days after creation. A customer-deletion request removes an existing package immediately; if the related access request remains on file, a replacement is generated without the deleted name or address and expires 30 days after its creation. App removal, Shopify store deletion and account closure remove existing packages without generating replacements. Copies already downloaded by a merchant are subject to that merchant's own responsibilities.

Address-access audit logs are retained for 400 days. Internal records of retention-cleanup runs are retained for 180 days. These ordinary periods do not create an exception to an applicable earlier deletion obligation.

C. Deletion and Recovery Evidence

We keep limited deletion-recovery records to document completed deletions and prevent deleted information from returning through imports, retries or backup restoration. We retain only the identifiers, deletion scope, completion information and recovery-copy delivery status needed for those purposes. These records do not contain shopper names, shipping addresses or copies of deleted purchase details.

Deletion-recovery records are scheduled for deletion 13 calendar months after the underlying deletion is completed. The same deadline applies to corresponding recovery emails in our company-controlled recovery group and managed copies. Email delivery, retries and routine updates do not restart this period.

Before disposal, we check whether a retained backup, unresolved restore or replayable import still requires the deletion instructions. Where continued retention is necessary and permitted by applicable law, we retain only the affected recovery evidence, document the specific reason and next review date, and delete it when that need ends. We do not extend all recovery records merely because an exception affects particular records.

Recovery evidence is not used for marketing or continued order fulfillment. These periods do not override applicable deletion rights or our obligations under Section 15 of our Terms of Service.

D. Closed Accounts and Limited Business Records

On account closure, we remove the person's name and real email address, password and linked sign-in credentials, saved products, saved videos, search history and store connection. Limited records are retained separately for the purposes below, rather than keeping the account profile for continued use.

Account-recovery protection. We retain the immutable internal account identifier and closure time for 13 calendar months after account closure to ensure that the same account remains closed following a backup restoration. Independent recovery copies include this information. We remove unnecessary duplicate recovery identifiers and delete the recovery marker and any residual closed-account row when their recovery purpose ends. The specific recovery exceptions described in Section 8.C also apply to these records and their recovery copies.

Terms-acceptance evidence. We retain the internal account reference, accepted Terms version, acceptance time and method, and text fingerprint while the account remains active and for four calendar years after account closure. The corresponding Terms text is archived separately. We do not retain shopper orders or recreate a deleted account profile to preserve this evidence. If a specific dispute or applicable legal obligation requires longer retention, we document the reason and next review date, restrict use to that purpose, and delete the evidence when further retention is no longer justified.

Trial-abuse prevention. We retain a protected store identifier, trial-used status and expiry for 12 calendar months after store deletion. We do not retain paid-plan information in this marker. We delete the marker at expiry, after which it no longer prevents that store from receiving another trial. A protected identifier is not necessarily anonymous.

Separate accounting records are not governed by the trial-marker period. Other account, subscription, support and business records are retained only as necessary for their specific purposes and applicable obligations. These provisions do not authorize retaining shopper order information for unrelated purposes or override Section 15 of our Terms of Service.

E. Diagnostic Information

Sentry diagnostic events are retained for 30 days. This period does not apply to all other application logs, privacy records, downloaded copies or independently held provider records.

F. Backups and Independently Held Copies

Deletion from the active system does not immediately remove every copy from an existing backup. Our database backup schedule retains hourly and daily copies for seven days and monthly copies for 12 months. Recovery emails and managed recovery copies follow the separate retention and exception rules in Sections 8.C and 8.D; they are not left without a disposal deadline merely because they are stored outside the database.

Backups are not used for ordinary operational access. Before a restored database is returned to service, our recovery procedure requires current deletion instructions to be applied so that orders covered by completed deletion requests are removed again and closed accounts remain closed. This includes requests received after the backup was taken. Expiry of delivery information under the ordinary schedule is also reapplied where required. Recovery instructions are kept separately because an older backup does not contain later deletion requests.

These rules govern information held by ValidDs. They do not delete records held independently by Shopify, merchants, suppliers or other third parties. Where law requires us to retain particular information, we limit retention to that purpose and protect it until deletion is permitted.

Customers of Connected Merchants

If your information was provided to ValidDs by a store from which you ordered, contact that merchant first so it can verify and handle your request across its systems. You may also contact privacy@validds.com; we will coordinate with the merchant where appropriate. We assist with applicable requests concerning information we hold on the merchant's behalf, but cannot supply or erase all information held independently by Shopify or other providers.

Where processing relies on consent, an applicable withdrawal must be respected. Processing necessary for order fulfillment may instead rely on another lawful basis, depending on the merchant's activities and applicable law. A merchant's agreement to ValidDs' Terms is not a substitute for any customer consent that is required. We do not require acceptance of revised Terms as a condition of exercising applicable privacy rights.