How merchant information is handled

Operator and contact

Viera Credential Gate is operated by NGUYỄN VĂN HÙNG. For privacy questions or requests, contact suport@vievot.com.

Information we process

The app processes Shopify shop and customer identifiers, customer names used to match buyer records, authorized reviewer identifiers, product and collection identifiers and titles, and subscription status needed to provide the service. Merchants and their buyers provide credential types, dates, review notes, evidence sources, decisions, and supporting documents. We retain activity records identifying the reviewer, time, and change, and receive Shopify customer access and erasure requests.

Authenticated Shopify sessions and purpose-specific submission tokens protect access. The app does not provide advertising tracking or behavioral profiling. Payment details are handled by Shopify; the app verifies subscription information.

How information is used

Information is used to provide credential review, product eligibility, document submission, expiry reminders, support, and privacy-request handling for the merchant that supplied it. We use customer data only to provide and improve this service for that same customer. We never sell or trade customer data, use it for advertising or AI training, or use it for another purpose. We do not combine or analyze data across merchants to improve the service. Human review requests and responses are used only to handle that customer’s review and related support. Merchants should collect and upload only the evidence needed for their purchasing requirements.

Human review and consent choices

If you want your credential information and purchase-eligibility decision to be processed manually, open the store’s documents portal, choose the credential, and select Request human review. Explain that you are requesting manual processing rather than relying only on the automated eligibility result. You can also contact the store, or contact us so we can coordinate with the merchant. The merchant reviews the supporting source and recorded decision, records a written response, and makes any approval, rejection, revocation, or correction as a separate recorded decision. Requesting manual processing does not itself grant purchase rights or waive the store’s lawful document requirements.

Where processing depends on your consent, you can ask the store to withdraw that consent or restrict the relevant processing. We verify the request with the merchant and follow its valid instructions through the existing privacy-request, correction, restriction, or erasure process. The merchant identifies which processing must stop and any data it must lawfully retain. Installing the app or uploading a document is not treated as blanket consent, and this service does not use customer data for optional advertising or AI processing.

Service providers and storage

The current hosting configuration uses Cloudflare Workers and Cloudflare D1 for application processing and storage. Shopify provides installation, authentication, customer/product data, billing, app-proxy delivery, and checkout infrastructure. Compact product requirements and customer eligibility metadata are stored in app-owned Shopify metafields when checkout validation is configured. Supporting document contents are not included in those projections.

Document bytes and Shopify sessions are stored encrypted. Access to merchant records is scoped to the authenticated store, and document downloads and subject exports require authorized owner access. Files are served as private downloads. Processing locations depend on the hosting and Shopify infrastructure; no exclusive country of storage is represented. Contact us for questions about the service providers or processing arrangements.

Retention

The default credential retention period is 90 days. Merchants can configure a period from 1 to 3,650 days. Scheduled cleanup applies this period to eligible rejected, revoked, or expired credential records and their supporting files after the applicable decision or expiry point. Credentials with an open human reconsideration request are held from scheduled deletion until the merchant records a response; privacy erasure still applies. After resolution, the usual credential retention policy applies from the relevant recorded change or expiry point. Active and pending records are retained for the ongoing review workflow and are not deleted solely because their upload is 90 days old.

Expiry eligibility uses a conservative time-zone allowance before retention age starts. Deletion occurs during a scheduled cleanup run after the record becomes eligible. Activity history follows the related record’s retention or erasure process. Access and erasure requests are handled separately from scheduled retention. Security access logs record authorized dashboard, portal, document, and export access using hashed actor and subject identifiers, without document contents or raw identifiers. These logs become eligible for deletion after 30 days and are subject to erasure handling. Scheduled cleanup runs every six hours and deletes at most 1,000 expired access events per run; deletion can lag while a backlog is processed. A recorded authorization does not establish successful delivery.

Access, correction, and deletion requests

Depending on applicable law, individuals may request access, correction, erasure, or restriction of processing. Buyers can contact their store, or email suport@vievot.com so we can coordinate with the relevant merchant. We may require identity and store verification before releasing information or making changes.

Customer data requests received from Shopify enter the authenticated owner’s privacy queue. A subject export includes credential records, related review and human reconsideration history, and document metadata. Supporting files require separate authorized access. The merchant delivers requested information through its verified privacy process. Prepared request payloads and their fulfillment receipts become eligible for deletion 30 days after the recorded preparation time, in batches of up to 100 per scheduled run. Pending requests are retained for resolution; a prepared export is not proof of delivery.

Customer erasure removes the subject’s app records and exclusively associated documents. A file still referenced by another surviving credential is retained for that separate purpose. Where authenticated Shopify access is available, configured checkout protection is fenced while related native eligibility data is cleared. Uninstall invalidates app access and sessions; full shop erasure is a separate Shopify privacy lifecycle. Local deletion alone does not establish that Shopify-managed copies or external backups have been removed. Any remaining platform cleanup or backup handling must be reconciled through the applicable privacy process.

Recovery copies and operational evidence

Cloudflare D1 maintains automatic recovery history on its cloud infrastructure. The current database has a seven-day Time Travel window. This recovery history is separate from live application records and does not require the operator’s computer to remain online. It can roll back the whole database, not an individual customer; deleted information in recovery history must not be returned to service.

Supplementary encrypted recovery archives, when created for an identified administrative purpose, have a 14-day retention policy. They are not required for normal service or cloud background jobs. Expiry removes only identified, unchanged copies when recovery remains safe. Legal holds, disputed records, uncertain ownership, and the last usable recovery copy require exception review rather than automatic destruction. Existing archives are separately inventoried and protected while their purpose and obligations are resolved.

Minimal operational receipts have a 30-day retention period when they contain no customer content and have no hold. Other evidence requires purpose and retention review; a review date alone does not authorize deletion. Recovery keeps application access and background processing paused outside the database being restored until current erasure and installation restrictions are reconciled. Recovery must not restore access to information already validly erased.

Merchant responsibilities and policy changes

Merchants determine why they collect buyer information and whether evidence meets their purchasing requirements. A recorded approval does not establish a credential’s legal or regulatory validity. This policy describes the service’s data practices and does not certify compliance with every jurisdiction’s laws.

We update this policy when the service’s data practices change and identify the current effective date above. Questions about this policy can be sent to suport@vievot.com.