Privacy and Cookie Policy

Last updated: July 30, 2026

Who this policy covers

This policy explains how VAT Engine handles personal data across the public website, account dashboard, API, support and billing workflows, and connected integrations. VAT Engine determines the purposes and means of processing for its account, website, security, and service-administration data.

When a merchant connects Shopify, the merchant remains responsible for its customer relationship and instructs VAT Engine to process limited store and order information for VAT and compliance-support purposes. VAT Engine generally acts as a processor or service provider for that merchant-directed data and separately handles the connection, security, and legal records needed to operate the service. Roles can differ where applicable law requires.

The service is in active alpha development. Data flows can change as features mature, and this page will be updated before materially different processing begins.

Personal data VAT Engine handles

Account and contact information: Name, email address, organization details, account preferences, subscription state, and information you provide when you create or manage an account or contact support.
Security and authentication data: Password hashes, sign-in events, email-verification state, multi-factor authentication configuration, encrypted backup codes, session state, IP address, device or browser details, and security audit records.
VAT and compliance information: Calculation inputs, transaction and supply records, countries, currencies, amounts, tax classes, VAT rates, reporting periods, source identifiers, evidence, corrections, and exports submitted directly or through an integration.
Service and diagnostic information: Request metadata, rate-limit events, application errors, performance measurements, cookie choices, and activity logs needed to operate, secure, troubleshoot, and improve the service.
Billing and communications: Subscription and payment status supplied by our payment provider, plus transactional email and support-delivery records. VAT Engine does not store complete payment-card details.

Why we use it

Provide the public website, dashboard, API, integrations, VAT calculations, reporting, exports, and account features.
Authenticate users, prevent abuse and fraud, investigate incidents, enforce limits, and maintain service security.
Import and normalize connected-store evidence needed for VAT classification, reconciliation, and filing-support workflows.
Send account, security, billing, support, and legally required communications.
Measure public-site use and performance through optional analytics after consent.
Meet tax-record, accounting, legal, dispute-resolution, and regulatory obligations.

Legal bases

Basis	Typical use
Contract	Providing the account, API, connected integrations, requested calculations, reports, and support.
Legitimate interests	Securing the platform, preventing abuse, maintaining reliable operations, and improving non-optional service functionality, subject to applicable balancing requirements.
Legal obligation	Keeping records or responding to lawful requests where accounting, tax, fraud-prevention, privacy, or other laws require it.
Consent	Standard Google Analytics and, through a separate choice, Google Signals, user-provided-data matching, advertising storage, and ads personalization. Either choice can be refused or withdrawn without losing core service access.

Google Analytics, Signals, user-provided data, and first-party diagnostics

Google Analytics is disabled until you choose Analytics. Google Signals, user-provided-data matching, advertising storage, and ads personalization require the separate Google enhanced measurement choice. These tools are used only on approved public pages on the production hostname. VAT Engine excludes sign-in, sign-up, password recovery, email verification, the authenticated dashboard, Shopify App Home, and API traffic from the Google tag.

With Analytics consent, the browser can send Google the public page path and title, referrer or traffic source, session activity, browser language, interaction information, and a pseudonymous client ID stored in the _ga cookie. Granular location and device collection is enabled for the regions configured in the Analytics property. It can include city and city-level coordinates, browser user-agent and minor version, device brand/model/name, operating-system and platform minor versions, and screen resolution. Google derives location from the connection IP address and discards the IP before Analytics logging. VAT Engine additionally sends limited Core Web Vitals values with a broad page template, device class, coarse connection class, and release version.

Google Signals is enabled for all 307 regions in the Analytics property. If you permit enhanced measurement, Analytics can associate website activity with information from a Google account whose signed-in user has enabled Ads Personalization. This can provide cross-device measurement and aggregated demographics or interests. The same choice grants Consent Mode advertising storage, advertising user data, and ads personalization, so pseudonymous event data and advertising identifiers can be used in linked Google advertising products for conversion measurement, audience matching, remarketing, or personalized advertising.

User-provided data collection is enabled in the Analytics property, including its automatic-detection option. Collection occurs only after the associated Google tag capability is configured and the visitor permits enhanced measurement. The Google tag can then inspect approved public pages for configured email, name, and mailing-address patterns. Google normalizes and SHA-256-hashes eligible identifiers such as email, first/last name, and street address, and can use supporting city, region, postcode, and country fields to match with other Google data. Automatic telephone-number detection is disabled. VAT Engine does not manually send account profile data, Shopify customer data, VAT transaction inputs, or API data through this feature.

VAT Engine's explicit Analytics page-view event omits query parameters. Google tag consent and advertising requests can still process the current URL, referrer, IP address, browser, and device information as described by Google. Do not place personal data in public-page URLs.

If first-party frontend diagnostics are enabled, the same Analytics choice can also permit VAT Engine to receive redacted public-page error details, pathname, file and line context, timestamp, IP address, and user agent. These records are rate-limited, bounded, and filtered for common tokens, secrets, contact details, and identifiers.

Google receives this data under its applicable Analytics and advertising data-protection terms and may process it internationally. Its role can differ between Analytics processing and linked advertising uses. Google explains its collection in Google Analytics data collection and explains how it uses partner-site information in How Google uses information from sites or apps, explains Google Signals, and documents user-provided data collection.

Shopify connected-store processing

Shopify processing begins only when an authorized merchant installs or connects the VAT Engine app. The currently approved connector purpose is to import and reconcile minimized VAT evidence, classify supplies, track corrections and refunds, and support reporting or filing preparation.

Store and connection: Shop ID, canonical myshopify.com domain, store display label, installation and scope state, encrypted access credentials, source-profile mappings, synchronization cursors, and connection health.
Order and VAT evidence: Order, line, product, variant, refund, transaction, adjustment, shipping, duty, fee, fulfillment, and channel identifiers; dates and statuses; currencies, quantities, prices, discounts, taxes, duties, fees, and refund amounts.
Classification context: Product names, SKU, tags, categories, app-owned tax mapping metafields, gift-card and taxable flags, the merchant-owned vat_engine.customer_type value, marketplace/channel context, shipping method, and fulfillment-location name and country.
Country-only protected address data: Only billing and shipping country codes are requested from Shopify addresses. They are used for VAT place-of-supply and filing support.
Operational and privacy requests: Webhook topic and delivery metadata, payload digest, order/customer/shop IDs supplied for a Shopify privacy request, request status, due date, and an audit trail of fulfillment or lawful retention decisions.

Data intentionally excluded

Customer names, email addresses, telephone numbers, and customer account profiles.
Street address lines, city, province, postcode, latitude, longitude, and precise geolocation.
Payment-card or bank-account details.
The content of Shopify order notes or refund notes. VAT Engine may process whether a refund note exists, but does not retain its text in canonical VAT evidence.

The connector requests only the Shopify scopes needed for current order, product, and fulfillment-routing workflows. Access to older order history through read_all_orders is optional and used only when Shopify has granted it and the merchant starts a historical import.

Shopify may include customer email or telephone information in a mandatory privacy webhook. VAT Engine validates the signed request, extracts only the shop, request, customer, and order identifiers needed to fulfill it, and does not retain the raw privacy-webhook body. The connector supports customers/data_request, customers/redact, and shop/redact. Requests are handled within Shopify's required window unless specific records must remain under a legal tax-record obligation.

Shopify's official documentation describes protected customer data and its mandatory privacy webhooks.

Cookies and local storage

Essential storage is used without optional consent because it is needed for security, authentication, requested Shopify connection flows, and remembering your consent decision. Analytics cookies remain off unless you choose Analytics. Advertising storage and Google's enhanced matching remain off unless you separately choose Google enhanced measurement.

Name	Provider / category	Purpose	Duration
session	VAT Engine Essential	Keeps an authenticated account session secure.	Up to 1 day
admin_session	VAT Engine Essential	Secures authorized access to the restricted service-administration area.	Up to 8 hours
csrf_token	VAT Engine Essential	Protects account forms and state-changing requests against cross-site request forgery.	Up to 30 minutes
shopify_link_flow_<random-id>	VAT Engine Essential	Binds a merchant-authorized Shopify installation or reconnection to the initiating browser.	Up to 20 minutes
__Secure-vat_engine_shopify_document	VAT Engine Essential	Validates the current Shopify App Home document and applies the correct embedded frame protections.	Up to 8 hours
sidebar_state	VAT Engine Essential functionality	Remembers the dashboard sidebar state selected by the signed-in user.	Up to 7 days
cookie_consent	VAT Engine Essential	Stores the categories you accepted or refused and the policy version.	Up to 1 year
_ga and _ga_<measurement-id>	Google Analytics Analytics	Uses a pseudonymous client identifier to distinguish visitors and sessions and preserve session state.	Up to 2 years; only after analytics consent
_gcl_, _gac_, and Google advertising identifiers	Google Enhanced measurement / advertising	Supports Google Signals, campaign and conversion measurement, audience matching, and ads personalization where the visitor separately permits enhanced measurement.	First-party advertising cookies are generally up to 90 days; Google-controlled cookies vary

The browser also stores the same consent categories, timestamp, and policy version in local storage so the interface can reliably respect your choice.

Retention and deletion

Account and profile data is generally kept while the account remains active.
Security, verification, session, diagnostic, and support records are kept for bounded operational or fraud-prevention periods appropriate to the record.
VAT transaction and connected-store evidence can be retained for applicable tax, accounting, audit, dispute, and filing obligations even after an account, customer, or store deletion request.
Shopify operational webhook payloads are minimized on receipt and normally expire after 72 hours; deployment configuration cannot extend raw-payload retention beyond 7 days. Raw Shopify privacy-webhook bodies are not stored.
Customer and order identifiers used to fulfill a completed Shopify privacy request are minimized immediately where possible or after a 30-day fulfillment/export window. Shop credentials and non-required metadata are removed or anonymized after a valid shop-redaction request.
Google Analytics user-level and event-level retention is limited by the configured GA4 retention controls to no more than 14 months for the standard property. Google Signals signed-in data follows that shorter configured period even though Google permits a maximum of 26 months. Aggregated reports may remain available longer. Analytics cookies can remain for up to 2 years; first-party advertising measurement cookies are generally up to 90 days unless withdrawn or deleted sooner.

When deletion is requested, we remove or anonymize data where possible and identify any narrower record set that must remain under a legal obligation.

Sharing and international transfers

VAT Engine does not sell personal data.

Google receives standard public-site measurement data only after Analytics consent. Google Signals, user-provided-data matching, advertising identifiers, and personalization require the separate enhanced-measurement choice.
Shopify exchanges merchant-authorized store data, API responses, installation credentials, webhooks, and privacy requests with VAT Engine.
Hosting, database, storage, email-delivery, monitoring, and security providers process only the data needed to operate their service.
Payment processors receive checkout and billing data; complete card details remain with the payment provider.
Professional advisers, auditors, courts, regulators, or authorities receive data only where legally required or necessary to establish, exercise, or defend rights.

Providers can process data outside your country. Where required, we rely on appropriate contracts, transfer mechanisms, and technical or organizational safeguards.

Your choices and privacy rights

Ask whether we process your personal data and request a copy.
Correct inaccurate or incomplete personal data.
Request deletion, restriction, or objection where applicable, subject to lawful tax-record and other retention duties.
Request portability of data you provided where applicable.
Withdraw optional analytics consent at any time.
Complain to the data-protection authority responsible for your location.

Use the Cookie settings control above or in the footer to change either Google choice. Withdrawing Analytics stops future optional collection and removes VAT Engine's first-party Google Analytics cookies. Withdrawing enhanced measurement sends denied advertising-consent signals and removes accessible first-party Google campaign cookies; it does not invalidate processing completed before withdrawal or remove Google-controlled cookies that VAT Engine cannot access.

Shopify customers should normally begin an access or deletion request with the merchant from whom they purchased. Shopify then sends the applicable mandatory privacy request to installed apps. Merchants and VAT Engine account holders can also contact us directly.

Contact

For privacy questions, access or deletion requests, objections, complaints, or details about a particular retention or transfer safeguard, contact contact@vat-engine.app.

This policy is intended to provide clear product transparency. It does not replace advice from a qualified privacy professional about your own obligations.