Privacy Policy

Last updated: 2 September 2026 · version 2026-09-02

This policy explains what VerityIQ does with personal data. The email you give us if you join the waitlist, the data we hold about merchants who install the app, and the Shopify order data we process on a merchant’s behalf. It sets out where that data lives, how long we keep it, and the rights you have under the EU/UK GDPR, Japan’s Act on the Protection of Personal Information (APPI), and California law.

Part one: Who we are

1. Who we are

VerityIQ is a product operated by ARCsoft Kabushiki Kaisha (株式会社 ARCsoft) (“we”, “us”, “our”), a company incorporated in Japan and based in Tokyo. You can reach us about anything in this policy at hello@verityiq.io. Our full registered address is available on request.

2. The two roles we play

This is the most important thing to understand about how VerityIQ handles data, because your rights depend on it. For some data we decide what happens to it. We are the controller. For a merchant’s Shopify order data we act only on that merchant’s instructions. We are their processor, and the merchant is the controller.

Where we act as a processor we handle the data only to produce that merchant’s report, on their instructions, and never for our own purposes. With the single exception of aggregated, de-identified data described in section 9, which our Terms permit and which stops being personal data once de-identified.

Part two: What we collect

3. Website visitors and the waitlist

The VerityIQ marketing site collects nothing from you unless you submit the waitlist form to request access. If you do, we collect and store:

• Your email address: the only piece of information you actively enter.
• Submission timestamp: the date and time you signed up.
• The page path you submitted from (for example /).
• Your browser’s user-agent string: basic technical information about the browser or device that made the request.
• Country: derived from your IP address by our infrastructure provider at the moment of the request. We do not store your IP address itself.

We use it for one purpose: to contact you about private access to VerityIQ. We also run a hidden honeypot field to catch spam submissions, which we discard. We do not use your email for unrelated marketing, and we do not sell, rent or share it with advertisers or data brokers.

We do not ask for, or intentionally collect, any special-category data (such as health, ethnicity or political opinions). Please don’t include such information in the email field.

4. Merchant accounts and onboarding

When you install the VerityIQ app on your Shopify store, we record the state of your installation against your store’s domain. That record holds:

• Your store domain and your progress through onboarding.
• A Shopify access token, so we can read your store’s data. It exists in exactly one place, so that uninstalling revokes our access everywhere at once.
• A consent record: the date and time you accepted our Terms and this policy, which version you accepted, your IP address, your country, and your browser’s user-agent string (truncated).

The IP address in that consent record is personal data and we keep it deliberately: a record of consent that nobody can attribute to anyone is not evidence that consent was given. It has no automatic expiry for the same reason, and is deleted when your store’s data is erased (section 14). We record the policy version because consent to one version of our terms is not consent to a later one. When we change them materially, we ask again.

We also hold the email address you use to correspond with us about the service.

5. Your Shopify store data

With your permission, we read the following from Shopify’s Admin API, read-only: VerityIQ can never write anything to your store: order totals, dates, line-item titles and quantities, discounts, returns, checkout and store analytics, and, for orders that carry one, the customer-journey summary Shopify computes (traffic source, referring site, landing page and UTM tags).

Your Shopify consent screen may list broader permissions than that. We read only what is listed above.

What we do not take. We do not read or store your customers’ names, email addresses, postal addresses, phone numbers or payment details. Your published report contains no customer identifiers at all. Not even pseudonymous ones.

How customer identifiers are handled. Before anything is written to storage, the Shopify customer identifier on an order is replaced with a one-way pseudonym: a BLAKE2s hash of that identifier combined with a secret salt unique to your store. The raw identifier does not reach our storage. The pseudonym lets us tell a repeat buyer from a first-time one, which is all any part of the report needs; it does not let us identify anyone.

The salt is per-store rather than shared for a specific reason. Destroying one store’s salt renders every hashed row belonging to it permanently unlinkable to any person. Including copies on backups that we cannot selectively delete from. It turns an otherwise impossible erasure into a possible one, and section 14 explains how we use it.

6. Advertising platform data

If you connect an advertising account, we read performance data from it. Spend, impressions, clicks, and the revenue the platform claims to have driven. At campaign, ad set and creative level. Access is read-only.

This is aggregate performance data and does not identify individuals. We do not read audience lists, customer-match lists, or any personal data held in your advertising accounts.

7. Report access and sign-in records

Hosted reports at reports.verityiq.io are protected by a name and password. We store the password only as a PBKDF2 hash: never in plain text, and never in a form we can reverse.

We log every sign-in attempt: which report was tried, the name entered, whether it succeeded, the IP address, the country and the browser’s user-agent string. We never log the password. We do not log page views and we do not track behaviour inside a report: this is an access record, not analytics.

These records are personal data: an IP address can identify a person. We keep them because we have a legitimate interest in the security of processing. Detecting unauthorised access to a client’s financial report. They expire automatically after 90 days.

Part three: How and why we use it

8. Purposes and legal bases

Where we rely on legitimate interests, we have weighed them against your rights and freedoms. In both cases the processing is narrow, expected, and limited to what the purpose needs: an access log that records attempts rather than browsing, and a consent record kept as evidence rather than used for anything else. You can object to either. See section 15.

You can withdraw consent to the waitlist at any time. Withdrawing it does not affect anything we did lawfully before you withdrew.

9. Aggregated and de-identified data

We may create aggregated, de-identified data from the data we process, and use it to operate, evaluate and improve VerityIQ and to produce statistical benchmarks. That is subject to all of the following, without exception:

• it will not identify you, your store or your customers, and will not be reasonably capable of doing so;
• we will not disclose merchant-level figures to anyone;
• we will not publish any statistic derived from a single store, or from so few stores that yours could be inferred from it;
• we will not attempt, or permit anyone else to attempt, to re-identify it.

Once data is aggregated and de-identified in this way it is no longer personal data, and the rights in Part six no longer attach to it. That is precisely why the four limits above are absolute rather than best-efforts.

Part four: Where it lives

10. Where data is stored, and who else processes it

Personal data connected with VerityIQ lives in three places, all under our control:

• Cloudflare: hosts verityiq.io and reports.verityiq.io, runs our serverless functions, and provides the key-value storage that holds the waitlist, merchant onboarding and consent records, Shopify access tokens, report credentials and sign-in records, and the queue of Shopify compliance requests. Cloudflare processes this data under its data processing terms; see cloudflare.com/privacypolicy.
• Operator workstations in Japan: the weekly report pipeline runs on access-controlled machines that we operate. The Shopify and advertising data described in sections 5 and 6 is held there.
• A private backup server in Japan: an additive backup reachable only from our own machines over a private, encrypted network. Since 28 August 2026 the per-order files described in section 5 are excluded from it; it holds report artifacts, which carry no customer identifiers, and advertising history.

Cloudflare is our only third-party sub-processor. We do not use third-party analytics, advertising, mailing-list or marketing platforms, and we do not sell or rent personal data to anyone. Credentials for the platforms we read are kept in a secret vault we host ourselves; the only credential held on an operator machine is that machine’s own identity for the vault.

We may disclose data if required to by law, regulation, or a valid legal request.

11. International transfers

Personal data is stored in Japan and on Cloudflare’s globally distributed network, which may process it on servers outside your country, including outside the European Economic Area (EEA) or the UK.

The European Commission has recognised Japan as providing an adequate level of protection for personal data (adequacy decision of 23 January 2019), and the UK maintains equivalent recognition. Transfers of personal data from the EEA or the UK to us in Japan therefore rest on that adequacy. Where Cloudflare processes personal data internationally, it does so under its Data Processing Addendum and the European Commission’s Standard Contractual Clauses.

12. Security

• Read-only by design. Every platform connection is read-only. VerityIQ cannot write to your store or your ad accounts.
• Pseudonymisation at the boundary. Customer identifiers are hashed with a per-store secret before they reach storage (section 5).
• Passwords are never stored. Report credentials are held as PBKDF2 hashes.
• Encrypted transport. Everything travels over HTTPS; backups travel over a private WireGuard-encrypted network rather than the open internet.
• No plaintext credentials. Platform credentials live in a self-hosted vault, not in files on disk.
• Single revocation point. Your Shopify access token exists in one place only, so uninstalling revokes our access everywhere at once.
• Limited access. Access to operator machines and the backup server is restricted to the people who need it.

No method of storage or transmission is perfectly secure, but we take reasonable and proportionate measures. If a breach affects personal data we will notify the relevant supervisory authority within 72 hours where we are required to, and affected merchants or individuals without undue delay.

Part five: Retention and deletion

13. How long we keep it

14. Uninstall, erasure and the Shopify compliance requests

You can end everything by uninstalling the app from your Shopify admin. Shopify notifies us immediately and your access token is destroyed at once. Forty-eight hours later Shopify sends us a formal erasure request for your store, and we act on it within the 30 days Shopify allows.

What erasure involves. We destroy your store’s secret salt first. Because every stored identifier is a hash of that salt, destroying it makes every remaining row permanently unlinkable to any person. Including copies on our additive backup, which by design is never deleted from. We then delete your store’s per-order files, retire your report and its published address, and delete your report credentials, your sign-in records, and your onboarding and consent record.

A single customer’s data. If you ask us to erase one customer, we locate their rows by pseudonym, remove them, re-derive the aggregates that were computed from them, and rebuild your report so it no longer counts them.

A request to see what we hold. If you ask what we hold about one customer, we extract their rows and return them to you, with an explanation of what each column means. We return them to the merchant and never directly to the customer, because you are the controller and we cannot verify a customer’s identity. See section 18.

These steps are carried out by a person rather than automatically. Every request is recorded the moment it arrives, and our systems are built to reject a request we could not record rather than acknowledge one we might then lose.

Part six: Your rights

15. Rights under the GDPR and UK GDPR

If you are in the EEA or the UK, you have the right to:

• Access: get a copy of the personal data we hold about you.
• Rectification: have inaccurate data corrected.
• Erasure (“right to be forgotten”). Have your data deleted.
• Restriction: ask us to limit how we use your data.
• Portability: receive your data in a structured, machine-readable format.
• Object: object to processing based on legitimate interests.
• Withdraw consent: at any time, without affecting prior lawful processing.
• Complain: lodge a complaint with your local data protection authority (in the EEA) or the Information Commissioner’s Office (in the UK).

VerityIQ does not make automated decisions about individuals and does not profile people. It analyses a merchant’s aggregate commercial performance; a person reads the result and decides what to do with it.

16. Rights under Japan’s APPI

As a Japanese company, ARCsoft Kabushiki Kaisha is subject to the Act on the Protection of Personal Information. If you are in Japan, you may ask us to disclose the retained personal data we hold about you, to correct, add to or delete it, or to cease using it or providing it to a third party. Use the same contact address in section 19.

We do not provide personal data to third parties without your consent, except as the APPI permits. Our use of Cloudflare (section 10) is an entrustment of processing rather than a provision to a third party.

17. Rights under California law

We do not sell or share personal information, and have not done so in the preceding twelve months. We do not use or disclose sensitive personal information for any purpose other than those permitted without a right to limit.

The categories we collect are described in sections 3 to 7: identifiers (email address, IP address), internet or network activity (user-agent string, page path, sign-in attempts) and commercial information (order-level data we process for a merchant). The purposes and sources are set out in those sections and in section 8, and retention in section 13.

If you are a California resident you have the right to know, delete and correct your personal information, to opt out of its sale or sharing (we do neither), to limit the use of sensitive personal information (we hold none for that purpose), and not to be discriminated against for exercising any of these rights.

Where we process order data on a merchant’s behalf we act as a service provider, and we will not retain, use or disclose that data for any purpose other than performing the service.

18. If you bought from a merchant who uses VerityIQ

Your order was handled by that merchant, not by us. They decide what happens to your personal data; we act only on their instructions.

What we hold about you is a pseudonym plus order-level facts: what was bought, when, for how much, and how the visit that led to it was sourced. We do not hold your name, email address, postal address, phone number or payment details.

To exercise any right, please contact the merchant you bought from. They can ask us and we will act on their request. If you contact us directly we will refer you to them. Not to deflect, but because we cannot verify your identity against a pseudonym. We deliberately built it so that we cannot.

19. How to exercise your rights

Email hello@verityiq.io. If your request concerns the waitlist, send it from the address you signed up with. We will respond within one month, as the GDPR requires. To delete your email or withdraw consent, just ask. No reason needed, and no charge for a reasonable request.

Part seven: Processor terms and general

20. When we act as your processor

Where we process personal data on a merchant’s behalf (section 2), we commit to:

• process it only on your documented instructions: our Terms, your client configuration, and anything else you tell us in writing. Unless the law requires otherwise, in which case we will tell you before processing unless that law forbids it;
• ensure that everyone we authorise to process it is bound by an obligation of confidentiality;
• apply the technical and organisational measures set out in section 12;
• engage only the sub-processors listed in section 10, and give you notice before adding another, with a fair opportunity to object;
• assist you, taking into account the nature of the processing, in responding to requests from your customers and in meeting your obligations on security, breach notification and data protection impact assessments;
• notify you without undue delay on becoming aware of a personal data breach affecting your data;
• delete your data at the end of our relationship as described in section 14;
• make available the information reasonably necessary to demonstrate that we have met these commitments.

21. Cookies and tracking

We do not use advertising or analytics cookies, we do not run third-party analytics, and we do not track you across other sites. The marketing site sets no cookies at all; the waitlist form sends only what you type plus the technical details listed in section 3.

Signing in to a hosted report sets one strictly-necessary cookie containing a signed session token, so you don’t have to re-enter your password on every page. It is not used for tracking, and it is cleared when you sign out or when the session expires.

22. Children

VerityIQ is a business tool intended for adults and is not directed at children. We don’t knowingly collect data from anyone under 16. If you believe a child has given us their data, contact us and we’ll delete it.

23. Changes to this policy

We may update this policy. The version and “last updated” date at the top show which one is current.

Because we record which version each merchant accepted, a materially changed policy means we ask again rather than assume your earlier acceptance carries over. We will notify merchants by email or in the product, and take reasonable steps to let waitlist sign-ups know of material changes affecting them.

24. Contact

ARCsoft Kabushiki Kaisha (株式会社 ARCsoft), Tokyo, Japan. Full street address available on request. Questions about this policy or your data? Email hello@verityiq.io and we’ll help. See also our Terms of Service.