Trust & transparency · Updated 3 October 2026

Privacy Policy

What RevenueGuard does

VTX RevenueGuard monitors Shopify purchase paths, detects operational failures and preserves evidence for merchants. We process merchant account and team email addresses, store identifiers, catalog and configuration data, monitoring results, incidents, and merchant-selected alert destinations. Account data is separate from Shopify customer data.

Limited order activity

When a merchant enables Funnel Anomalies and Shopify authorizes access, RevenueGuard reads limited recent order activity to detect unusual changes in completed-order activity. Customer names, email addresses, phone numbers and addresses are not required. We do not request those fields, keep raw Shopify orders, or retain individual order IDs. We store hourly store-level order counts and currency, and aggregate baseline/anomaly metadata. These observations serve operational monitoring, not customer profiling or marketing.

Synthetic monitoring and evidence

Checks use a separate automated browser and synthetic test profiles supplied by the merchant. Failure screenshots mask form fields; checkout screenshots additionally redact the synthetic profile. Technical timelines contain step timings and classified failures. Sensitive checkout and payment interactions are excluded from trace/video capture. Retained traces contain only allowlisted interaction timings without DOM, network, URLs or input values. Confirmation-failure video is a redacted replay of purchase-control positions and enabled states, not a full storefront recording. It excludes text, images and form values. Merchants must provide synthetic testing details, never real customer information or payment credentials.

Purpose and sharing

We use data to provide monitoring, incident investigation, account access, security and merchant-requested notifications. We do not sell customer data, build customer advertising profiles, or make automated decisions with legal or similarly significant effects on customers. Service provider categories include hosting/database/storage providers, Shopify, and merchant-configured email, Slack and webhook providers. Destination providers receive incident information needed to deliver the notification. We do not send order-level or customer data to them. Contact the operator for the current service providers, processing locations and applicable transfer safeguards. Merchant-configured notification destinations are selected by the merchant.

Retention

Order activity observations expire after 90 days. Temporary network and console diagnostics expire after 7 days. Technical timeline and raw trace/video artifacts expire after 30 days; expiry does not delete the incident itself. Cleanup runs automatically in bounded batches while monitoring is paused. Monitoring configuration and incident history remain while the store is connected, until merchant-directed erasure or Shopify shop redaction. Compliance request audit records contain no customer identity and expire 90 days after processing.

Disconnect/uninstall removes Shopify token values, storefront passwords, synthetic checkout profiles and alert destination secrets and disables future work. Shopify shop/redact triggers final store-data erasure, including evidence objects. Customer-specific privacy webhooks are verified and acknowledged; normally no customer-linked records exist to disclose or delete. Backups, if retained by the operator, require a separately configured deletion/expiry policy; that infrastructure policy has not been verified here.

Security and rights

Shopify tokens, storefront passwords, checkout profiles and destination secrets use AES-256-GCM field encryption. Local evidence objects, including retained legacy screenshots, are application-encrypted. S3 evidence uses server-side encryption when configured. Public application and Shopify API connections use HTTPS. Access is checked by workspace and store; webhook HMAC is verified. Whole-disk and database-volume encryption have not been independently verified. No service can guarantee absolute security.

Merchants can request access, correction or erasure through the privacy contact below. Customers should contact the merchant that collected their data; we support Shopify privacy requests on that merchant's behalf. Contact the same address for security concerns. The operator identified below is responsible for handling privacy and security requests about RevenueGuard.

Operator and contact

RevenueGuard is operated by Yavor Iliyanov Zagorski, an independent developer based in Bulgaria.

Legal name: Явор Илиянов Загорски
Address: с. Сандрово, ул. Марица 20, България

Privacy, data protection and security contact: info@youneed.dev.