Privacy policy — SiteVerdict: Store Health & Compliance

Draft — last updated 11 October 2026. To be reviewed before publication.

SiteVerdict: Store Health & Compliance is provided by BharatFare Travel and Technologies Ltd (Plymouth, United Kingdom), the data controller for merchant data described here. Contact: aman.thakran@bharatfare.com.

What we collect

• Store details from Shopify: shop domain, store name, primary domain, store contact email (to prefill the optional digest address).
• Shopify access tokens (sessions) so the app can work, stored securely and deleted when you uninstall.
• Your settings: weekly re-scan, digest on/off, digest email address, extra pages to scan.
• Scan results about your public storefront: scores, issues found and the page URLs scanned.
• With the read_themes and read_products permissions: your published theme’s name and layout/theme.liquid (read only, to detect tracking code; not stored beyond the issue description), and product titles/IDs whose images lack alt text (stored as examples in the scan result).

What we don’t collect

We don’t access, collect or store personal data about your customers (shoppers). We don’t read orders or customer records.

How we use it and our lawful basis (UK GDPR)

To provide the service you installed (contract), to send the weekly digest only if you switch it on (consent; unsubscribe any time), and to keep the service secure (legitimate interests).

Processors

Hosting provider (to be named), the SiteVerdict scanning API operated by us, and an email delivery provider for digests (to be named). Shopify processes billing.

Retention and deletion

On uninstall we delete access tokens immediately and stop all scans and emails. When Shopify sends the shop/redact request (about 48 hours after uninstall) we delete your store record and scan history. Scan history while installed is kept for your plan’s history period.

Your rights

You can ask for access, correction or deletion by emailing aman.thakran@bharatfare.com. You can also complain to the UK Information Commissioner’s Office (ico.org.uk).

International transfers

If data is processed outside the UK, we use appropriate safeguards (UK adequacy regulations or the UK IDTA/Addendum).