Privacy Policy

1. Overview

VendorSplit (“the App”, “we”, “us”, or “our”), operated by velsevul, provides automated order line-item splitting and vendor notification services for merchants operating on the Shopify platform. This Privacy Policy explains how information is collected, used, shared and protected when you install and use the App.

With respect to your customers' personal data, the merchant is the data controller and VendorSplit acts as a data processor on the merchant's instructions.

2. Information We Collect

When you install and configure VendorSplit, we access and process only the data strictly necessary to perform order routing:

• Shop Data: your Shopify domain (*.myshopify.com) and the access tokens required for API operations.
• Catalog Data: vendor names listed in your Shopify product catalog (via the read_products scope) to populate rule dropdowns and match products.
• Configuration Data: the vendor routing rules you create—vendor names, vendor recipient email addresses, CSV delimiter and column settings.
• Order Data: upon receiving orders/paid webhooks (read_orders scope), we process order identifiers, line item details (SKU, title, quantity, price) and—only for the CSV columns you choose to include—customer personal data (customer name, shipping address, phone number and email).
• Delivery Logs: timestamps, Shopify order IDs and order numbers, vendor names, vendor recipient email addresses, item counts and dispatch statuses (including failure error messages).

3. How We Use Information

We use the collected information exclusively for:

• Generating CSV purchase and fulfillment files filtered by the vendor rules configured by the merchant.
• Dispatching transactional emails with the attached CSV files from orders@velsevul.com to merchant-designated vendor addresses.
• Providing the merchant with an audit log of recent dispatch events within the app dashboard.
• Verifying your app subscription through Shopify Managed App Pricing. Payments are processed and billed by Shopify; we never receive your payment details.

We do not sell, rent, broker, or monetize your store data or customer personal information, and we do not use it for advertising or profiling.

4. Sharing & Third-Party Service Providers

Order data is shared only as needed to deliver the service you configure:

• Your vendors (recipients you designate): each vendor receives a CSV file containing only the order lines for its products and the columns you selected, which may include customer personal data such as name, shipping address, phone number or email. Once delivered, these files are held by your vendors under your agreements with them and are outside the control of VendorSplit.
• Resend (email delivery sub-processor): CSV attachments, including any customer personal data they contain, are transmitted through Resend to reach your vendors. Resend may retain email delivery records according to its own data retention policy.
• Railway (hosting sub-processor): cloud hosting provider running our application servers and the encrypted PostgreSQL database that stores configuration data and delivery logs.

5. Data Retention & Deletion

We honour Shopify's mandatory privacy webhooks:

Copies of CSV files already delivered to your vendors must be handled by you and your vendors directly.

6. Security

All data is transmitted over HTTPS. Webhooks from Shopify are verified with HMAC signatures, and every database query is scoped to the authenticated shop so that one store can never access another store's data.

7. Your Rights

Merchants and their customers have the right to request access to, correction of, or deletion of their personal information. Requests received directly or via Shopify's mandatory privacy webhooks are processed promptly. Customers should contact the merchant they purchased from; we will assist the merchant as their processor.

8. Contact Us

If you have questions about this Privacy Policy or wish to exercise your data rights, please contact our support team at: