Privacy

Updated 17 October 2026. Responsible operator: NGUYỄN VĂN HÙNG, Viera. Contact support@vievot.com. Our merchant service and data protection terms describe our processing arrangement and responsibilities.

Information and purpose

Viera Consignment Control processes shop and installation identifiers, merchant-entered consignor names and optional statement emails, product assignments, commission rules, necessary order/line/refund/return/agreement/transaction identifiers, dates and amounts, financial entries, payout records and necessary access/request records. We use this information to reconcile consignment sales, provide statements, authenticate access and give necessary support, security and privacy assistance. Shopify session credentials authorize access to your store.

Raw webhook payloads are not retained. Shopper names, addresses, phone numbers and emails are excluded from the stored order projection. Orders and transactions are still protected customer data. Keep imported notes and payment references free of unnecessary personal information.

We do not sell or rent merchant or shopper data, use it for advertising or cross-merchant marketing, send it to AI services, or use it to train, fine-tune, evaluate or benchmark AI/ML models. The app does not transfer funds.

Access and service providers

Data is separated by the verified Shopify store. Only its verified owner can approve merchant changes. Consignor statement links are limited to one consignor and period; anyone holding a valid link can view that statement. Links expire after 24 hours and deny access immediately on revocation. Authenticated viewing and export remain available without active billing.

Cloudflare Workers and D1 provide application processing and storage. D1 encrypts hosted data at rest and connections use TLS. Workers may process requests globally; APAC database placement does not promise exclusive regional processing. Shopify supplies commerce records and handles checkout and app billing under its own policies.

Retention and ending use

Financial history, source-idempotency records and consignor configuration support your active recordkeeping service, subject to verified erasure instructions. Uninstall revokes app access and clears sessions. Shopify’s later verified shop-erasure instruction invokes deletion of live store financial/configuration records and related access, request and audit records after installation checks. Minimal installation and deletion markers remain to prevent erased data or obsolete access from returning. We do not apply a blanket accounting-retention exception or claim a universal seven-year period.

Maintenance removes expired/revoked link rows and expired sessions. Explicitly fulfilled privacy-request rows are removed after 30 days; pending work retains its original response deadline. Raw webhook delivery receipt identifiers expire after 90 days. Financial source identifiers follow the underlying financial records; privacy-action audits remain until shop erasure.

Requests and recovery copies

Contact us for access, correction, erasure or processing objections. We verify requester authority, store and scope before disclosure or removal. Verified complete customer-redaction scopes are automatically scheduled against their exact held order records. Invalid, incomplete or mismatched scope requires operator review. Preparing or downloading a response is separate from delivery and confirmed fulfillment. Requests retain a 30-day response deadline; unresolved work may require intervention.

Removing source links alone can leave linkable financial amounts and does not anonymize history. Full live-scope erasure and disposition of retained copies are separate steps. An unresolved scope or copy is not completed erasure. Deleted financial history may require reconciliation before further payouts.

Our current Cloudflare Paid D1 plan retains provider-managed recovery history for 30 days; configured Workers Logs have a 7-day retention window. Live deletion does not immediately remove provider history. Copy handling retains the original request deadline and shows overdue work; it does not assume an exception to that deadline. Unknown copies and logging destinations require evidence. Authorized operator copies require a recorded purpose, protection and finite expiry or verified end condition. The bounded retention process can record an elapsed provider policy window; this is not physical-purge attestation. Minimal deletion restrictions deny stale restored records. The operator is required to review their continued purpose and necessity every 90 days while resurrection remains possible; an automatic or completed review is not asserted. Closure metadata is reduced after 90 days. CSV/PDF files you independently download are controlled by you, separately from application-controlled copies.

Merchant terms · Help and contact · Viera Consignment Control