Privacy Policy

The data controller responsible for personal information processed under this policy is:

Label House Technologies LLP
PURI 81 HIGH STREET, SECTOR 81
Faridabad, Haryana 121004
India
Contact: dev@getvakaru.com

When a Shopify merchant installs Vakaru and connects their store, the merchant is the data controllerfor their shoppers' personal information, and Vakaru acts as their data processor. We process shopper data only under the merchant's instructions and as described in this policy.

This policy applies to two groups of people:

• Merchants — store owners and team members who sign up for Vakaru and use the dashboard.
• Shoppers — end customers of Vakaru merchants whose interactions on the merchant's storefront are processed by Vakaru on the merchant's behalf.

It does not cover websites, services, or apps operated by third parties (including merchants' storefronts), even when linked from Vakaru. Those have their own privacy policies.

We use personal information for the following purposes, with the GDPR Article 6 lawful basis noted in brackets:

• Provide and operate the Service — account creation, store connection, sending recovery emails, dashboard analytics. (Performance of contract)
• Analyse cart abandonment — apply AI to event sequences to predict abandonment reasons and generate personalised email content. (Performance of contract / merchant's legitimate interest)
• Service improvement — measure feature usage, evaluate model quality, fix bugs. We use aggregated and de-identified data wherever possible. (Legitimate interest)
• Security, fraud prevention, abuse handling — detect bots, rate-limiting, incident response. (Legitimate interest)
• Compliance — respond to legal requests, enforce our Terms, comply with tax and accounting obligations. (Legal obligation)
• Communications with merchants — service announcements, security notices, and (with consent) product news. (Consent / legitimate interest)

We do not use personal information for automated decision-making that produces legal or similarly significant effects on shoppers. The AI we use generates email content; merchants always control whether and when emails are sent.

We share personal information with vetted service providers (“sub-processors”) who help us deliver the Service. They process data only on our instructions and under written agreements with confidentiality and security obligations.

We will update this list as our suppliers change. An up-to-date version is always published at this URL. Material changes are notified to merchants under Section 13.

We do not sell personal information. We may disclose personal information if required by law, court order, or valid governmental request, or to enforce our Terms or protect our rights.

Vakaru is operated from India and uses sub-processors located in the United States, European Union, and other countries listed in Section 5. When personal information is transferred outside the country of origin, we rely on appropriate safeguards:

• For transfers from the EU/UK to countries without an adequacy decision, we use the European Commission's Standard Contractual Clauses (2021) and the UK International Data Transfer Addendum.
• For transfers under India's DPDP Act, we transfer to permitted jurisdictions and apply contractual safeguards equivalent to those required under the Act.
• For transfers under CCPA, we contractually restrict secondary use of personal information in line with the “service provider” framework.

A copy of the safeguards in place can be requested at dev@getvakaru.com.

We retain personal information only as long as necessary for the purposes set out in this policy:

• Merchant account data — for the lifetime of the account, and for 30 days after account closure to allow recovery, then deleted or anonymised.
• Shopper event data and abandonment analyses — rolling 12-month window, after which records are deleted or aggregated.
• Email campaign logs — 24 months for performance reporting and deliverability disputes.
• Backups — encrypted backups are retained for up to 30 days and then permanently deleted.
• Aggregated or anonymised data — may be retained indefinitely as it no longer identifies anyone.
• Legal holds — longer where required by applicable law (tax, accounting, dispute records).

When a merchant uninstalls Vakaru, we mark the store inactive immediately and process Shopify's shop/redactwebhook (delivered 48 hours after uninstall) by deleting the merchant's shop-scoped data.

Vakaru implements the three mandatory Shopify GDPR compliance webhooks:

• customers/data_request — when a merchant asks us for a shopper's data, we provide it within 30 days.
• customers/redact — we delete a shopper's personal information within 30 days of receiving the request.
• shop/redact — when a merchant uninstalls Vakaru, we delete shop-scoped data within 30 days of receiving the redaction request (Shopify delivers it 48 hours after uninstall).

Each webhook request is verified using HMAC-SHA256 signed with our app's secret to ensure authenticity.

We apply industry-standard administrative, technical, and physical safeguards, including:

• TLS 1.2+ encryption for all data in transit.
• Encryption at rest for sensitive fields (e.g. third-party API keys, access tokens).
• Role-based access controls and the principle of least privilege for engineering access.
• Centralised secret management; no credentials in source code.
• Regular dependency updates and security reviews.
• Logging and alerting for suspicious activity.

No system is perfectly secure. If we discover a personal-data breach that is likely to result in a risk to your rights, we will notify affected merchants and regulators within 72 hours of becoming aware, as required by GDPR and equivalent laws.

The Vakaru dashboard uses a small number of first-party cookies and storage entries:

• Strictly necessary — authentication, session, and CSRF protection. These are always on.
• Functional — UI preferences (theme, layout), remembered for your convenience.

The Vakaru dashboard does not use third-party advertising or cross-site tracking cookies.

The Vakaru pixel is installed by merchants on their own storefront via Shopify's Web Pixels framework. It is governed by the merchant's cookie banner and consent settings; merchants are responsible for obtaining the necessary shopper consent before the pixel fires.

Vakaru is a business-to-business service intended for adults. We do not knowingly collect personal information from children under 16 (or under 18, where applicable under the DPDP Act for “child” processing without verifiable parental consent). If you believe a child has provided us with personal information, please contact dev@getvakaru.com and we will delete it.

We may update this Privacy Policy from time to time. Material changes will be notified to merchants by email at least 30 days before they take effect. Non-material changes (clarifications, formatting, sub-processor list updates) will be reflected on this page with an updated “Effective” date.

For privacy questions, requests to exercise your rights, or grievances under the DPDP Act, please contact our Grievance Officer:

Grievance Officer
Label House Technologies LLP
PURI 81 HIGH STREET, SECTOR 81
Faridabad, Haryana 121004
India
Email: dev@getvakaru.com

We will acknowledge requests within 7 days and respond substantively within 30 days where possible. If you are not satisfied with our response, you may lodge a complaint with your local data protection authority.