Privacy Policy
Last updated: 2026-10-19
Velto is a Shopify app published by ScaleX (Julien Roques EI). This policy explains what data Velto processes when a merchant installs it and when shoppers visit a store that uses it. For shoppers' data, the merchant is the controller and ScaleX (Julien Roques EI) acts as a processor on the merchant's behalf.
Data about merchants
- Store details provided by Shopify when you install Velto: shop domain, store name, currency, plan type, and the access token Velto needs to work.
- Your Velto settings: which applications are on, designs, texts and preferences.
- Usage numbers of each application (views, clicks, add to carts, orders and sales attributed to Velto), stored as daily totals.
- API keys you connect for email tools (Klaviyo, Mailchimp, Omnisend), stored encrypted (AES-256-GCM).
Data about shoppers, depending on the applications you turn on
- Product reviews: name, optional email, rating, text, photos, and a one-way hash of the IP address used to limit abuse.
- Pop-ups and spin wheel: email (and phone if you ask for it), marketing consent and its date, the discount code given, and a one-way IP hash.
- Back in stock alerts: email, the product requested, the customer account ID if the shopper is logged in, and marketing consent.
- EU withdrawal requests: order number, email, optional name, items, optional reason, and the checks made on the order.
- Wishlist: products saved, linked to the customer account ID when the shopper is logged in (otherwise kept only in the shopper's browser).
- Behavior analytics: only aggregated daily numbers per page (views, time, scroll depth, clicked buttons and links). No recordings, no identifiers, nothing a person could be recognized from. Collected only when the shopper accepts analytics cookies.
What Velto never does
- Velto does not sell data, show ads, or use data to train AI models.
- Velto does not record sessions or replay what shoppers do.
- Velto does not send marketing emails itself: emails are sent by Shopify Email through Shopify Flow, from the merchant's address, and only to customers who agreed to marketing.
Sharing
Data is shared only with the service providers below, and with the tools the merchant connects:
- Vercel Inc. — hosting of the Velto app.
- Supabase Inc. — database, hosted in the European Union (Ireland).
- Shopify — the platform Velto runs on.
- At the merchant's request only: Meta (pixel events, when shoppers accept marketing cookies), Klaviyo, Mailchimp or Omnisend (emails of shoppers who accepted marketing).
Retention and deletion
- When a shopper asks Shopify to erase their data, Velto erases or anonymizes their reviews, wishlist, contact entry, back in stock requests and withdrawal requests.
- When a merchant uninstalls Velto, Shopify asks for the store's data to be deleted 48 hours later, and Velto deletes all of it.
- Behavior analytics are kept as aggregated numbers only.
Security
Data is encrypted in transit (HTTPS) and at rest. Every request from Shopify is verified (signed requests), access to the database is restricted to the Velto server, and API keys are encrypted. Access to merchant data by our team is logged.
Your rights
Shoppers can exercise their rights (access, correction, deletion) with the store they bought from; the merchant can reach us to help. Merchants can contact us at any time to access or delete their data.
Contact: ScaleX (Julien Roques EI), 69 A chemin de Fray Join, 82700 Finhan, France (SIREN 920 374 493) — julien.roques22@gmail.com.