Privacy Policy
Last updated: 19 September 2026
This policy describes what data the VeloBridge app collects and stores when it is installed on a Shopify store, and how that data is handled.
What VeloBridge does
VeloBridge connects a merchant's Shopify store to their B2B suppliers that use the Veloconnect protocol, and imports catalog data from those suppliers into Shopify products. The app does not interact with the store's end customers or its storefront in any way — it never sees or stores end-customer data (names, emails, addresses, order contents or payment details of people who buy from the merchant's store).
Data we store
All of the data below is associated with the store that installed the app.
| Data | What it contains |
|---|---|
| Store | Shopify domain and install/uninstall dates. |
| Session | Shopify OAuth session token, and the name/email/language of the app installer provided by Shopify (the merchant's team member who authorised the app — not an end customer). |
| Supplier connection | Supplier endpoint and credentials (password encrypted at rest, AES-256-GCM) and markup configuration. |
| Imported products | The mapping between a supplier catalog item and the Shopify product/variant it was imported into. |
| Import failures | A log of failed import attempts, for support. |
| Plan | The store's current VeloBridge subscription tier, as reported by Shopify, and a running count of products imported through the app — used only to enforce the limits of the active plan. Billing itself is handled entirely by Shopify: the app never receives or stores card or payment details. |
None of the above is end-customer personal data — which is why the customers/data_request and customers/redact webhooks have no action to take (see next section).
Mandatory compliance webhooks (GDPR)
customers/data_request
Fired when a merchant requests, on behalf of one of their customers, the data an app holds about that customer. Because VeloBridge stores no end-customer data, there is nothing to return — the request is logged for audit and answered successfully.
customers/redact
Fired ~48h after a customer asks Shopify to delete their data. For the same reason as above, there is nothing to delete.
shop/redact
Fired ~48h after the merchant uninstalls the app. Unlike the previous two, this one triggers a real deletion: all data the app holds for that store is permanently removed (supplier connections, imported products, import failures, session and the store record).
How to request removal of your data
Uninstalling the app from your Shopify store starts the removal process above. If you need your data deleted sooner, or have any question about this handling, contact us — details on the support page.
Data controller: Dev4200. Contact: dev4200.support@proton.me