Privacy policy
Vouch Reviews (“Vouch”, “we”) is a Shopify app that helps stores collect and show product reviews, photos and questions from their customers. This policy explains what personal data Vouch handles, why, and how long we keep it. For shoppers, the store you bought from is the controller of your data and Vouch processes it on the store’s behalf.
Data we collect
From the store, through Shopify
- Store details: the store’s domain, name, plan and the settings the merchant chooses in Vouch.
- Order details needed to ask for a review: order number, the products bought, the customer’s first and last name, email address, and the city and country of the shipping or billing address.
From shoppers, when they use Vouch on a store
- Reviews, ratings, questions, answers and “helpful” votes they send, and the name they choose to show.
- Photos and videos attached to a review. These are stored in the store’s own Shopify Files.
- Email preferences, such as unsubscribing from review requests.
- A one-way salted hash of the sender’s IP address, used only to stop spam bursts. We never store the IP itself.
We do not collect phone numbers, street addresses, payment details or browsing history.
How we use it
- To send review request and reminder emails the merchant has turned on, and to stop sending when a shopper unsubscribes.
- To show reviews on the store, with the reviewer’s chosen name and, if the merchant allows it, their city and country.
- To mark reviews from real buyers as verified.
- To let the merchant moderate, reply to and export their reviews, and to show them statistics.
- To give support when a merchant contacts us.
We do not sell personal data, use it for advertising, or combine it across stores.
Who we share it with
We only share data with service providers that run Vouch, under their own data protection terms:
- Shopify, the platform the app runs on.
- Fly.io, which hosts the app servers.
- Neon, which hosts the database.
- Resend, which delivers emails.
- Anthropic, only for suggested replies and review translations, and only the review text is sent.
- Klaviyo or Google, only if the merchant connects them in Vouch, and only the review data that connection needs.
How long we keep it
- Names and emails on review requests that never led to a review are cleared after the period the merchant picks in Settings (3, 6, 12 or 24 months, 12 by default).
- Reviews, questions and answers stay until the merchant deletes them or uninstalls Vouch.
- When a merchant uninstalls Vouch, all of that store’s data is deleted 48 hours later.
- When Shopify sends us a customer’s erasure request, we delete or anonymize that customer’s data.
How we protect it
Data is encrypted in transit (HTTPS) and at rest, including backups. Third-party keys merchants give us are encrypted again inside our database. Only the people who run Vouch can reach production systems, using accounts with strong passwords and two-factor sign-in, and access to store data is logged. Test data is kept apart from production data.
Your rights
Shoppers can unsubscribe from review emails with the link in any email, and can ask the store they bought from to see, correct or delete their data. Stores can request this through Shopify, and we act on it. You can also write to us at hello@exactwhy.com.
Changes
If we change how Vouch uses personal data, we will update this page and the date at the top.
Contact
EXACTWHY SOLUTIONS PRIVATE LIMITED, India. Email hello@exactwhy.com.