Privacy policy
Last updated: October 30, 2026
What Vruza does
Vruza helps merchants review cash-on-delivery order risk. We process merchant account information and customer order signals to provide reputation scores, recommendations and order risk assessments.
Information we process
Merchant information includes account email, business and store details, authentication records and API usage. Customer information includes phone numbers received for matching, customer and order identifiers, order amounts, payment methods, order outcomes, risk assessments and any verification status supplied to the service. We do not require customer email or full delivery addresses for Shopify risk scoring.
Customer identifiers and webhook processing
Long-term customer profiles use hashed phone numbers. Hashing is not encryption or a guarantee of anonymity: these profiles remain linked to customer activity and are treated as personal data. Necessary webhook fields are encrypted while awaiting processing. We discard queued bodies after successful processing. Order queue records expire after 30 days. Pending privacy requests are retained only as needed to complete the request. Minimal redaction records prevent late events from recreating deleted data during the 30-day queue retention period.
Shared customer reputation
Order outcomes from participating merchants contribute to a shared customer reputation profile. Other participating merchants can receive scores and behavioral summaries for a customer they check. We do not expose the identity of the merchant that contributed a particular outcome. Merchants must disclose this processing to their customers and obtain any consent required by applicable law. Contact privacy@vruza.ai with questions or objections about this processing.
How information is used
We use information to authenticate accounts, connect stores, match customer activity, calculate rule-based risk scores, write order assessments, support merchants and protect the service. The current scoring system does not train an AI or machine-learning model on Shopify customer data. Risk scores are guidance and do not guarantee that an order is fraudulent or will be delivered.
Service providers and security
We use Stytch for authentication, Cloudflare for hosting and security, and Neon for database hosting. These providers process information needed to operate the service, which may involve processing in other countries. Shopify receives order tags, risk assessments and customer risk metafields when the integration is connected. We use HTTPS, access controls and encryption of Shopify credentials and queued webhook bodies.
Retention and deletion
We retain account and order information while needed to provide the service. Shopify customer and shop deletion requests remove the relevant store contributions and recalculate shared statistics from remaining contributions. Uninstalling disables the integration and clears its stored credentials; Shopify shop-redaction requests remove remaining store data. We process privacy requests within 30 days, subject to applicable legal retention obligations. Customer export files expire after 30 days. Independent merchant accounts or data supplied by other merchants may remain where needed to provide their service.
Access, correction and export
Customers can ask the store they purchased from to submit an access or deletion request through Shopify. Merchants can find customer export requests in the Privacy requests area of their Vruza dashboard and provide the files to the requesting customer. For corrections, disputes, account deletion or assistance, contact privacy@vruza.ai. We verify authority before disclosing or changing information.
Cookies and updates
We use essential authentication and session cookies. We will update this policy when our processing changes. Privacy questions can be sent to privacy@vruza.ai; technical support is available at support@vruza.ai.