Privacy Policy &
Data Processing Agreement

1 Data Controller

The data controller responsible for the processing of your personal data is:

By using our website (verlezzalabs.com) or any of our Shopify applications, you acknowledge that your personal data will be processed in accordance with this Privacy Policy.

2 Data We Collect

We only collect data that is strictly necessary for the operation of our services.

2.1 Website visitors (verlezzalabs.com)

2.2 Shopify app merchants

3 Purpose & Legal Basis

We process your data under the following legal bases as defined by the GDPR (Article 6):

We do not use your data for advertising, profiling, or sell it to any third party.

4 Data Retention

• Contact form data: Retained for up to 12 months from the date of your inquiry, or until you request deletion.
• App session tokens: Retained while the app is installed on your Shopify store. Automatically deleted upon app uninstall.
• Merchant app data (schemas, meta tags): Retained while the app is installed. Deleted immediately upon app uninstall via the app/uninstalled webhook.
• Server logs: Retained for up to 30 days for security purposes.

When the retention period expires, or upon a valid deletion request, we permanently delete or anonymize your data.

5 Data Sharing & Third Parties

We do not sell, rent, or trade your personal data. We may share data with the following trusted processors:

All processors are contractually bound to handle data in compliance with applicable data protection laws. We do not transfer personal data outside the European Economic Area (EEA) without appropriate safeguards such as Standard Contractual Clauses (SCCs).

6 Shopify App Data

Merchant data

When you install a Verlezza Labs app from the Shopify App Store, you grant us access to specific Shopify Admin API scopes. We only request scopes that are strictly necessary for the app to function. Access tokens are stored encrypted in our database and used solely to perform the actions you initiate within the app.

Customer (shopper) data

Our apps do not access, store, or process any data belonging to the end-customers of your Shopify store. We handle only store-level SEO content (schemas, meta tags) that you create and manage.

GDPR webhooks

All our Shopify apps implement the three mandatory GDPR compliance webhooks:

• customers/data_request: We confirm that no customer PII is stored and return HTTP 200.
• customers/redact: We confirm that no customer PII is stored and return HTTP 200.
• shop/redact: All store data is permanently deleted from our databases within 48 hours.

App uninstall

When you uninstall a Verlezza Labs app, the app/uninstalled webhook triggers the immediate deletion of all your app data from our servers, including OAuth sessions, schemas, meta tag records, and settings.

7 Cookies

Website (verlezzalabs.com)

Our website uses only essential cookies required for basic site functionality and security. We do not use advertising, tracking, or analytics cookies without your explicit consent.

Shopify apps

Our embedded Shopify apps may use session cookies to maintain your authenticated state within the Shopify Admin. These are strictly necessary for the app to function and are governed by Shopify's own cookie policies.

You can control or delete cookies through your browser settings. Disabling essential cookies may affect the functionality of our services.

8 Your Rights (GDPR)

If you are located in the European Union or European Economic Area, you have the following rights under the General Data Protection Regulation (GDPR):

• Right of access (Art. 15): Request a copy of the personal data we hold about you.
• Right to rectification (Art. 16): Request correction of inaccurate or incomplete data.
• Right to erasure (Art. 17): Request deletion of your personal data ("right to be forgotten").
• Right to restrict processing (Art. 18): Request that we limit how we use your data in certain circumstances.
• Right to data portability (Art. 20): Receive your data in a structured, machine-readable format.
• Right to object (Art. 21): Object to processing based on legitimate interests.
• Right to withdraw consent: Withdraw consent at any time where processing is based on consent, without affecting the lawfulness of prior processing.

You also have the right to lodge a complaint with your local data protection supervisory authority. For EU residents, you can find your national authority at edpb.europa.eu.

9 Security

We take the security of your data seriously and implement appropriate technical and organizational measures to protect it against unauthorized access, alteration, disclosure, or destruction:

• All data in transit is encrypted using TLS 1.2 or higher (HTTPS).
• OAuth access tokens are encrypted at rest in our database.
• We apply the principle of least privilege — access to production data is restricted to essential personnel.
• Our infrastructure undergoes regular security reviews.
• Shopify sessions are invalidated immediately upon app uninstall.

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours and inform affected users without undue delay.

10 Minors

Our services are intended for use by adults (18 years of age or older) and Shopify merchants. We do not knowingly collect personal data from minors under the age of 16. If you believe we have inadvertently collected data from a minor, please contact us immediately at support@verlezzalabs.com and we will delete it promptly.

11 Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or for other operational reasons.

When we make material changes, we will update the "Last updated" date at the top of this page. For significant changes affecting your rights, we will provide additional notice (such as an in-app notification or email to known contacts where applicable).

Your continued use of our website or apps after the effective date of any changes constitutes your acceptance of the revised policy. We encourage you to review this page periodically.

12 Contact Us

For any questions, concerns, or requests related to this Privacy Policy or the processing of your personal data, please contact our Data Protection contact: