AppVerix Mobile: Privacy Policy

Last updated: 20 October 2026

AppVerix Mobile (“the app”) is published by AppVerix (“we”, “us”). This policy explains what the app collects when a merchant installs it, why, where it is kept, and how to have it deleted.

The app does not store personal data of a store’s customers. Device records hold an Expo push token only. For any customer data that stays on the commerce platform, the merchant is the controller.

1. What we collect and why

Data	Why	Do we store it?
Shop domain, shop name, country, currency, primary locale	To open the app in the admin and pick a default language	Shop domain, yes. Other profile fields are read when needed
An access token	So the app stays installed and can read products and collections you pick	Yes, in the login session, until you uninstall
Product and collection identifiers in the config	To render the home screen you designed	Yes, as part of the app config
Customer names, emails, addresses, payment details	The app does not need this	No

What the app saves in its database:

App configs: branding, tabs, home blocks, version and draft or published status.
Asset keys for logos and banners stored in object storage.
A storefront access token, encrypted at rest.
Device records: Expo push token, platform, locale, last open time. No customer identity.
Push campaign titles, bodies, links, and send counts.
Shop settings: language override and plan state.
A compliance log of privacy webhook topics, without customer personal data.

2. Who processes data for us

Cloudflare — hosting, D1, R2.
The commerce platform — authentication, billing, catalog and checkout.
Expo — push delivery when you send a campaign.

3. How long we keep it

Configs, assets, devices and settings: while the app is installed.
When you uninstall: we delete the login session and queued jobs immediately. The platform then sends shop/redact (usually within 48 hours), and we delete the rest.
customers/data_request and customers/redact: we do not hold customer personal data. We log that the request arrived.
Server logs: up to 7 days.

4. Your rights

Email support@appverix.com for a copy of merchant data or to ask for deletion. We answer within 30 days. Customers of a store should contact the store first.

5. Security

HTTPS (TLS) on all traffic.
D1 encrypts data at rest. Storefront tokens are encrypted again before storage.
Webhooks are verified with HMAC. Unsigned requests are rejected.
Admin routes check a session token. Public config URLs are signed.

6. Contact

AppVerix. Email: support@appverix.com