Privacy Policy

1. Introduction

This Privacy Policy describes how Stacknet Sp. z o.o. ("we," "us," "our," or "Veymo") collects, uses, processes, and protects your personal information when you use Veymo, our Shopify application that generates product videos using artificial intelligence (the "Service" or "App").

By installing, accessing, or using Veymo, you agree to the collection and use of information in accordance with this Privacy Policy. If you do not agree with our policies and practices, please do not use our Service.

Company Information

Data Controller:

• Company Name: Stacknet Sp. z o.o.
• Registered Address: Pocztowa 10/12, 41-103 Siemianowice Śląskie, Poland
• Tax Identification Number: PL6431779221
• Contact Email: contact@veymo.ai

2. Information We Collect

We collect several types of information to provide, maintain, and improve our Service. The information we collect depends on how you interact with our App and can be categorized as follows:

2.1 Shopify Store Data

When you install and use Veymo through your Shopify store, we collect:

Store Information:

• Your Shopify store domain
• Store configuration and settings
• Store status and operational data

Product Information:

• Product identifiers (IDs, handles)
• Product titles and descriptions
• Product status (active, draft, archived)
• Product images and media files
• Product metadata and classifications

Access Credentials:

• Shopify OAuth access tokens
• API authentication tokens
• Refresh tokens and expiration dates
• Shopify API scopes and permissions

2.2 User Account Data

When you authenticate with our Service, we collect:

Session Information:

• User ID and unique identifiers
• First name and last name
• Email address
• Account owner status
• Collaborator status and permissions
• Email verification status
• Locale and language preferences
• Session state and authentication tokens

2.3 App Usage Data

To provide video generation services and manage your account, we collect:

Video Generation Data:

• Video generation job requests and configurations
• Source product images and URLs
• Generated video files and metadata
• Video generation settings (duration, quality, product type, custom instructions)
• Job status, progress, and completion information
• Error logs and failure information
• Video post-processing settings (compression level, quality settings)

Subscription and Billing Data:

• Subscription plan details (starter, growth, pro)
• Subscription status (active, cancelled, frozen, expired)
• Billing period (monthly, yearly)
• Shopify subscription IDs and line item IDs
• Credit balance and transaction history
• Credit purchases and usage records
• Billing period start and end dates
• Subscription cancellation information

App Configuration:

• App settings and preferences (stored as JSON)
• Default video generation settings
• Auto-publish preferences
• Review banner dismissal status
• Review credit redemption status

2.4 Technical Data

When you interact with our Service, we automatically collect:

Connection and Usage Data:

• IP addresses
• Browser type and version
• Device information
• Operating system information
• API request logs and response data
• Error logs and debugging information
• Timestamp and duration of requests
• Rate limiting and security logs

Authentication Data:

• Session tokens and identifiers
• Authentication state information
• Token expiration data

3. How We Use Your Information

We use the collected information for the following purposes:

3.1 Service Delivery

• Video Generation: Process your product images through our AI video generation service to create product videos
• Product Integration: Upload generated videos to your Shopify store's Files and product media galleries
• Feature Functionality: Enable and maintain all features of the App, including product management, video generation, and media management

3.2 Account and Subscription Management

• Account Administration: Create and manage your account, authenticate users, and manage access permissions
• Billing and Payments: Process subscriptions, manage credit purchases, track credit usage, and handle billing through Shopify's billing API
• Subscription Management: Track subscription status, handle upgrades, downgrades, and cancellations

3.3 Communication and Support

• Customer Support: Respond to your inquiries, provide technical support, and resolve issues
• Service Updates: Send important notifications about the Service, including changes to features, terms, or this Privacy Policy
• Feedback and Reviews: Process review requests and credit redemption programs

3.4 Legal and Security

• Legal Compliance: Comply with applicable laws, regulations, legal processes, and governmental requests
• Security and Fraud Prevention: Detect, prevent, and address security issues, fraudulent activities, and violations of our terms of service
• Dispute Resolution: Resolve disputes and enforce our agreements

3.5 Service Improvement

• Analytics: Analyze usage patterns to improve our Service, develop new features, and optimize performance
• Debugging: Identify and fix technical issues, errors, and bugs

4. Third-Party Services and Data Sharing

To provide our Service, we work with third-party service providers who process data on our behalf:

4.1 Google Cloud Platform

Purpose: AI video generation

• Data Shared:
  • Product images for video generation
  • Video generation prompts and instructions
  • Generation parameters (duration, aspect ratio, quality settings)
• Processing Location: Google Cloud Platform (United States)
• Data Processing Agreement: We have a data processing agreement in place with Google Cloud Platform that governs how they handle your data
• Google's Privacy Policy: Data sent to Google's services is also subject to Google's Privacy Policy and Google Cloud Platform's Data Processing Terms
• Retention: Google processes your images only for the duration necessary to generate videos. We do not store your images in Google's systems beyond the generation process.

4.2 Shopify Platform

Purpose: Store integration, product data access, media storage, and billing

• Services Used:
  • Shopify GraphQL Admin API for product data
  • Shopify Files API for video storage
  • Shopify Billing API for subscriptions and payments
  • Shopify Webhooks for app lifecycle events
• Data Shared:
  • Your store's product information (as provided by you in Shopify)
  • Generated videos uploaded to your Shopify Files
  • Subscription and billing information for payment processing
• Shopify's Privacy Policy: Your use of Shopify is subject to Shopify's Privacy Policy and Shopify's Partner Program Agreement
• Data Ownership: Videos uploaded to your Shopify account become part of your Shopify data and are subject to Shopify's terms and privacy policy

4.3 Database Hosting Providers

Purpose: Data storage and management

• Infrastructure: PostgreSQL database hosted on cloud infrastructure providers (may include Neon, Supabase, Railway, DigitalOcean, Amazon Aurora, or similar providers)
• Data Stored: All data categories listed in Section 2 above
• Security: Database providers implement industry-standard security measures, encryption, and access controls
• Location: Database may be hosted in various geographic locations depending on the provider selected

4.4 Video Processing Services

Purpose: Video post-processing and optimization

• Local Processing: We use FFmpeg software for local video processing, including black bar removal and compression, which occurs on our servers
• No Third-Party Sharing: Video post-processing does not involve sharing your videos with additional third-party services

4.5 Legal Requirements

We may share your information if required by law or in response to:

• Valid legal requests, court orders, or government regulations
• Protection of our rights, property, or safety, or that of our users or others
• Enforcement of our Terms of Service or other agreements
• Prevention of fraud or other illegal activities

4.6 Business Transfers

In the event of a merger, acquisition, reorganization, bankruptcy, or sale of assets, your information may be transferred as part of that transaction. We will notify you of any such change in ownership or control of your personal information.

5. Data Storage and Security

5.1 Security Measures

We implement appropriate technical and organizational measures to protect your personal information:

• Encryption: Data is encrypted in transit using TLS/SSL protocols and may be encrypted at rest depending on the storage system
• Authentication: Secure authentication mechanisms using OAuth 2.0 and secure token management
• Access Controls: Limited access to personal information on a need-to-know basis for authorized personnel only
• Regular Updates: Regular security updates and patches to our systems
• Monitoring: Continuous monitoring for security threats and unauthorized access attempts

5.2 Data Location

Your data may be stored and processed in:

• Poland (our company's primary location)
• United States (Google Cloud Platform, Shopify infrastructure)
• Other countries where our service providers operate

We ensure appropriate safeguards are in place for international data transfers as described in Section 10 below.

5.3 Data Breach Procedures

In the event of a data breach that affects your personal information, we will:

• Investigate the breach immediately
• Notify affected users and relevant authorities as required by applicable law (typically within 72 hours under GDPR)
• Take immediate steps to contain and remediate the breach
• Provide information about the nature of the breach and steps taken

6. Data Retention

6.1 Retention Periods

We retain your personal information for different periods depending on the type of data:

• Active Accounts: We retain all account and usage data for as long as your account is active and for a reasonable period thereafter
• Shop Records: Shop records and credit balances are retained even after app uninstallation to allow you to reinstall the app and retain your credits. You may request deletion of this data at any time
• Sessions: User sessions are deleted when you uninstall the app or when sessions expire
• Generated Videos: Videos uploaded to your Shopify Files remain in your Shopify account according to Shopify's retention policies. We maintain references to these videos in our database for service functionality
• Transaction Records: Billing and transaction records are retained for a minimum of 7 years as required by accounting and tax regulations
• Legal Compliance: We may retain certain data longer if required by law, legal obligations, or to resolve disputes

6.2 Deletion Requests

Upon your request or when required by law, we will delete your personal information, except where:

• We are required to retain it for legal or regulatory compliance
• It is necessary for ongoing legal proceedings or disputes
• It is required for legitimate business purposes (e.g., preventing fraud)

7. Your Rights and Choices

Depending on your location, you have certain rights regarding your personal information:

7.1 GDPR Rights (European Economic Area)

If you are located in the European Economic Area (EEA), you have the following rights:

• Right to Access: Request access to your personal information and receive a copy of the data we hold about you
• Right to Rectification: Request correction of inaccurate or incomplete personal information
• Right to Erasure ("Right to be Forgotten"): Request deletion of your personal information under certain circumstances
• Right to Restrict Processing: Request that we limit how we process your personal information in certain situations
• Right to Data Portability: Receive your personal information in a structured, commonly used, and machine-readable format and transmit it to another service
• Right to Object: Object to processing of your personal information based on legitimate interests or for direct marketing purposes
• Right to Withdraw Consent: Withdraw consent at any time where processing is based on consent

7.2 CCPA Rights (California Residents)

If you are a California resident, you have the following rights under the California Consumer Privacy Act (CCPA):

• Right to Know: Request information about the categories and specific pieces of personal information we collect, use, disclose, and sell
• Right to Delete: Request deletion of your personal information (subject to certain exceptions)
• Right to Opt-Out: Opt out of the sale of personal information (we do not sell your personal information)
• Right to Non-Discrimination: Exercise your CCPA rights without discrimination

7.3 How to Exercise Your Rights

To exercise any of these rights, please contact us at:

• Email: contact@veymo.ai
• Subject Line: "Privacy Rights Request - [Your Request Type]"

We will respond to your request within 30 days (or as required by applicable law). To process your request, we may need to verify your identity to ensure we are providing information to the correct person and to protect your privacy.

7.4 Complaints

If you believe we have not addressed your privacy concerns adequately, you have the right to file a complaint with:

• EU Data Protection Authority: Your local data protection authority in the EU member state where you reside or work
• Poland (Our Primary Location): Urząd Ochrony Danych Osobowych (UODO) (Personal Data Protection Office)
• California: California Attorney General's Office

8. Cookies and Tracking Technologies

8.1 Cookies We Use

Our Service uses the following types of cookies and similar technologies:

• Authentication Cookies: Essential cookies for user authentication and session management provided by Shopify
• Session Tokens: Temporary tokens for secure API access and authentication
• Functional Cookies: Cookies necessary for the Service to function properly

8.2 Third-Party Cookies and Tracking

We use third-party analytics and advertising services to help us understand how our Service is used and to deliver relevant advertisements:

• Google Analytics: We use Google Analytics to collect information about how visitors use our website. This includes data such as pages visited, time spent on pages, and traffic sources. Google Analytics uses cookies to collect this information. You can learn more about how Google uses data at Google's Privacy Policy.
• Google Ads: We use Google Ads conversion tracking to measure the effectiveness of our advertising campaigns. This may involve cookies that track your interactions with our ads. You can opt out of personalized advertising by visiting Google Ads Settings.
• Facebook Pixel (Meta): We use Meta Pixel to measure, optimize, and build audiences for our advertising campaigns. This technology allows us to understand actions you take on our website after viewing or clicking on our ads. You can learn more about how Meta uses your data at Meta's Privacy Policy and manage your ad preferences at Facebook Ad Preferences.

8.3 Cookie Management

Most browsers allow you to control cookies through their settings. However, disabling certain cookies may affect the functionality of our Service.

9. Children's Privacy

Our Service is not intended for individuals under the age of 18. We do not knowingly collect personal information from children under 18. If you are a parent or guardian and believe your child has provided us with personal information, please contact us immediately. If we become aware that we have collected personal information from a child under 18, we will take steps to delete that information promptly.

10. International Data Transfers

10.1 Transfer Locations

Your personal information may be transferred to and processed in countries outside of your country of residence, including:

• United States: For Google Cloud Platform services and Shopify infrastructure
• Canada: For Shopify services
• Other Countries: Where our service providers operate

These countries may have data protection laws that differ from those in your country.

10.2 Transfer Safeguards

We ensure appropriate safeguards are in place for international data transfers:

• Standard Contractual Clauses (SCCs): We use EU-approved Standard Contractual Clauses for transfers from the EEA to countries outside the EEA
• Data Processing Agreements: All third-party processors are bound by data processing agreements that include appropriate safeguards
• Adequacy Decisions: Where applicable, we rely on adequacy decisions by the European Commission
• Additional Safeguards: We implement additional technical and organizational measures to protect your data during transfer

10.3 Legal Basis for Transfers

For EEA residents, our legal basis for international data transfers includes:

• Your explicit consent to the transfer
• Necessity for the performance of a contract with you
• Necessity to comply with legal obligations
• Standard Contractual Clauses and other approved transfer mechanisms

11. Legal Basis for Processing (GDPR)

For users in the EEA, we process your personal information based on the following legal bases:

• Contractual Necessity: Processing necessary to perform our contract with you (providing the video generation service)
• Legitimate Interests: Processing necessary for our legitimate business interests, such as:
  • Improving and maintaining our Service
  • Ensuring security and preventing fraud
  • Analyzing usage patterns to enhance user experience
• Legal Obligations: Processing necessary to comply with legal requirements (e.g., tax, accounting regulations)
• Consent: Where you have provided explicit consent for specific processing activities

You have the right to object to processing based on legitimate interests. If you do so, we will assess whether our legitimate interests override your rights and interests.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or for other operational, legal, or regulatory reasons.

12.1 Notification of Changes

When we make material changes to this Privacy Policy, we will:

• Update the "Last Updated" date at the top of this policy
• Notify you through the App or via email to the address associated with your account
• Provide prominent notice on our website or within the App

12.2 Continued Use

Your continued use of the Service after the effective date of any changes constitutes acceptance of the updated Privacy Policy. If you do not agree with the changes, you should stop using the Service and may uninstall the App.

13. Data Processing Agreements

We have entered into data processing agreements with our key third-party processors:

• Google Cloud Platform: Subject to Google Cloud Platform's Data Processing Terms, which include standard contractual clauses for international data transfers
• Shopify: Subject to Shopify's Partner Program Agreement and Shopify's data processing terms
• Database Providers: All database hosting providers are bound by data processing agreements that include appropriate safeguards for personal data

These agreements ensure that our processors:

• Process your data only as instructed by us
• Implement appropriate security measures
• Comply with applicable data protection laws
• Provide appropriate safeguards for international transfers
• Assist us in responding to your data protection requests

14. Specific Information for Different User Types

14.1 Shopify Store Owners

As a Shopify store owner using our App:

• You control what product information is shared with us through your Shopify store settings
• Generated videos are uploaded to your Shopify account and become part of your Shopify data
• You can uninstall the App at any time, which will delete your sessions (but shop records may be retained as described in Section 6)
• You can request deletion of all your data by contacting us

14.2 Collaborators and Staff

If you are a collaborator or staff member of a Shopify store using our App:

• Your personal information (name, email, permissions) is processed to manage your access to the App
• Store owners control who has access to the App
• Your access can be revoked by the store owner
• You can contact us to request information about how your personal data is processed

15. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

Email: contact@veymo.ai
Subject Line: "Privacy Policy Inquiry"

We will respond to your inquiry as promptly as possible, typically within 30 days of receipt.