Privacy Policy

Nexmail, Inc. ("Nexmail," "we," "us," or "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard information in connection with Veya, our app for custom signup forms and popups on Shopify stores, the Veya forms that appear on merchants' storefronts, and the veyapopups.com website (collectively, the "Services").

Veya is designed for businesses. It is available only as a Shopify app installed from the Shopify App Store. In this policy, "merchant" or "you" means the Shopify store that installs Veya and its staff; "shopper" means a visitor to a merchant's storefront who sees or submits a Veya form.

We play two roles. For merchant account information and for visitors to veyapopups.com, Nexmail decides how information is used and is the controller (or "business"). For information that shoppers submit through a merchant's Veya forms, the merchant is the controller and Nexmail acts as the merchant's processor (or "service provider"), handling that information only to provide the Services to the merchant. Section 4 explains this in more detail.

1. Information We Collect From Merchants

1.1 Information from Shopify

Veya is installed and opened from your Shopify admin. You sign in through Shopify; Veya does not issue its own passwords. When you install or open Veya, we receive and store:

• Store identity: your store's myshopify.com domain, Shopify shop ID, store name, primary storefront domain, and the shop owner email address on your Shopify account
• Access token: an offline access token issued by Shopify, which we store encrypted and use only to read your store's identity and write the app settings that let your theme load Veya forms
• Subscription status: your Veya plan, trial and billing-cycle status, which we read from Shopify

Veya requests no Shopify Admin API access scopes. We do not read your Shopify customer, order, product or inventory records.

1.2 Billing Information

Veya is billed through Shopify App Pricing. Shopify collects payment and bills you on your Shopify invoice. We never receive or store your card or bank details.

1.3 Content You Provide

• Form briefs and settings: the design brief you write and the settings for each form, such as headline, offer, consent wording, quiz questions, images you link to, colors, triggers, page and device targeting, frequency, and A/B test settings
• Designs: the HTML and CSS designs our AI builder generates for you, their revisions, private preview links, and which version you approved and published
• Integration settings: if you connect Klaviyo, the account connection and list you choose for signups

1.4 Analytics About Your Forms

We record form impressions, dismissals, signups and visitor counts for your store and show them to you as totals and hourly or daily charts. Sections 2 and 3 describe the shopper-side details.

1.5 Automatically Collected Information

Like most online services, our servers receive the IP address, browser user agent and request details of each request made to the Veya app and API. These appear in our server logs, which we use to operate, secure and troubleshoot the Services.

2. Information Collected on Merchants' Storefronts

When a merchant publishes a Veya form, a script on the merchant's storefront shows the form and sends the following to Veya on the merchant's behalf:

• Contact details the shopper submits: an email address, a phone number, or both, depending on the form
• Consent records: the exact consent wording shown to the shopper, whether the shopper agreed to email marketing, whether the shopper separately agreed to SMS marketing and the SMS consent wording shown, and the time of signup. Email consent never grants SMS consent
• Quiz answers: answers to any preference questions in the form
• Technical identifiers: the store and form, a random request identifier used to prevent duplicate signups, and a random session identifier
• Form events: when a form was shown or dismissed, and a once-per-session visit record used for conversion rates

2.1 Shopify Customer Privacy Choices

Veya follows the choices a shopper makes through the store's Shopify cookie and privacy banner (Shopify's Customer Privacy API):

• Form impressions, dismissals and session visit records are sent only if the shopper allowed analytics
• The random session identifier is kept in the browser's session storage only if the shopper allowed analytics. Otherwise a new random value is used for each request and nothing is stored
• Browser local storage is used only if the shopper allowed preferences. It holds when a form was last shown (so it is not repeated too often), whether the shopper already signed up on that store, and a random identifier that keeps the shopper on the same version of a form during an A/B test

Veya does not set cookies on storefronts and does not use storefront data for advertising.

3. Visitor Metering for Billing

Each Veya plan includes a monthly allowance of storefront visitors. To count unique visitors without cookies, Veya computes a one-way hash (SHA-256) of a random secret value (a "salt"), the store, the visitor's IP address and browser user agent when the storefront loads its Veya forms. Each billing period has its own random salt.

• Raw IP addresses and user agents are not stored for metering; only the hash is kept
• Because the salt changes every billing period, the same visitor cannot be linked from one period to the next
• Salts and hashes are deleted about 70 days after a period begins, which covers the 30-day billing cycle and the period shown on your billing screen
• Known bots, crawlers and automated tools are excluded
• Metering is used only to count visitors against your plan's allowance. It is not used to identify, profile or track shoppers, and it is not shared with anyone

4. Our Role for Shopper Data

The merchant decides which forms to show, what to ask, what consent wording to use, and what to do with signups. For shopper information, the merchant is the controller and Nexmail is the merchant's processor and service provider. We:

• Process shopper information only to provide the Services to that merchant, following the merchant's settings and instructions
• Keep each store's data separate and do not combine shopper information across stores
• Do not sell or share shopper information, use it to market to shoppers, or use it to train AI models
• Deliver signups to the merchant's connected Klaviyo account and list when the merchant connects Klaviyo, as described in Section 6
• Help merchants respond to shopper requests, including through Shopify's privacy webhooks described in Section 13

If you are a shopper, the merchant's own privacy policy describes how it uses your information. Please send requests about your data to the merchant. If you contact us, we will refer your request to the merchant where we can identify it.

5. How We Use Information

We use the information we collect for the following purposes:

• Provide the Services: to generate and revise your form designs, show private previews, publish forms to your storefront, collect signups with consent records, and report analytics
• Billing: to check your Shopify subscription, enforce plan access and measure visitor usage against your allowance
• Account management: to identify your store, keep you signed in through Shopify and communicate with you about your account and the Services
• Platform development: to troubleshoot, develop new features and improve the Services
• Security and compliance: to detect and prevent abuse and fraud, maintain platform security, and comply with legal obligations

6. How We Share Information

We do not sell personal information, and we do not share it with data brokers, advertisers, or information resellers. We share information only in the following limited circumstances.

6.1 Service Providers and Sub-processors

We use the following service providers to operate Veya:

Klaviyo is a service you choose and contract with directly; once signups reach your Klaviyo account, Klaviyo's terms and your agreement with Klaviyo apply.

6.2 AI Processing

When you ask Veya to build or revise a form, your brief, the form's settings and, for a revision, the current design are sent to Anthropic's Claude, running as a coding agent in a short-lived, isolated container. The agent has no access to our database or to shopper data. Each generated design is checked automatically and then shown to you; nothing is published until you approve it. Anthropic processes this content only to return the result to us. We use Anthropic under settings that do not allow this content to be used to train Anthropic's models.

6.3 Business Transfers

If Nexmail is involved in a merger, acquisition, sale of assets, or bankruptcy, your information may be transferred as part of that transaction.

6.4 Legal Requirements

We may disclose your information if required to do so by law or in response to valid requests by public authorities.

6.5 With Your Consent

We may share your information with other third parties when you have given us explicit consent to do so.

7. This Website (veyapopups.com)

• Optional website analytics: when configured, this website loads Google Analytics only after you allow optional analytics. We send a page path and a small set of interaction labels, with personal details removed from page addresses; we do not include email addresses, form contents or account identifiers in these events. You can change your choice at any time using Analytics preferences in the footer
• Preferences: the site stores your analytics choice in your browser
• Demonstrations: interactive examples on this website simulate a signup and do not submit email addresses to Veya or any provider. Please do not enter sensitive information into demonstration fields
• Links: following a link to Shopify, a booking page or another service takes you to that service, and its own privacy practices apply

8. Data Retention

We retain information for as long as necessary to provide the Services and fulfill the purposes described in this Privacy Policy:

• While Veya is installed: we keep your store account, forms, designs, analytics and the signups and consent records collected by your forms for as long as Veya is installed, unless they are deleted earlier as described below
• When you uninstall: we immediately pause your forms, tests and builds and delete your Shopify access token, sessions and preview links
• 48 hours after uninstall: Shopify sends us a shop/redact request, and we delete all of your store's data, including forms, designs, signups, consent records, events, analytics and metering data. If you reinstall before then, your workspace is kept with every form paused
• Shopper deletion requests: when Shopify sends us a customers/redact request, we delete that shopper's signups, events and visit records from your store
• Metering data: salts and visitor hashes are deleted about 70 days after each billing period begins
• Server logs: kept for 30 days
• Backups: deleted data may remain in encrypted database backups for up to 7 days, until those backups expire
• Website analytics: kept by Google Analytics for 2 months

Shopper data that has already been delivered to your Klaviyo account is held by Klaviyo under your agreement with Klaviyo and is not deleted by Veya.

9. Data Security

We implement industry-standard security measures to protect your information, including:

• Encryption in transit using HTTPS/TLS
• Encryption at rest for our database and storage, with Shopify access tokens and privacy exports additionally encrypted by the application
• Sign-in through signed Shopify session tokens, with every request checked for the correct store
• Signature verification of every Shopify webhook
• Separation of each store's data, and an AI builder that runs in isolated containers without database credentials
• Secure cloud hosting infrastructure, restricted internal data access, and logging and monitoring

While we strive to protect your information, no method of transmission over the internet or electronic storage is 100% secure.

10. Your Rights and Choices

Depending on your location and applicable law, you may have certain rights regarding your personal information:

• Access and portability: you have the right to request access to the personal information we hold about you and to receive a copy in a portable format
• Correction and update: your store name and email come from Shopify; update them in Shopify and Veya will pick up the change the next time you open the app
• Deletion: you have the right to request deletion of your personal information. Uninstalling Veya deletes your store's data as described in Section 8
• Disconnect integrations: you can disconnect Klaviyo at any time
• Do not sell: we do not sell personal information

Shoppers should direct requests to the merchant that operates the store. Merchants can respond through Shopify, which forwards requests to Veya as described in Section 13.

11. California Privacy Rights (CCPA/CPRA)

If you are a California resident, you have additional rights under the CCPA and CPRA:

• Right to know: request information about the personal information we have collected about you
• Right to delete: request deletion of your personal information
• Right to correct: request correction of inaccurate personal information
• Right to opt-out: we do not sell or share personal information for cross-context behavioral advertising. If that changes, you will have the right to opt out
• Right to non-discrimination: you have the right to not be discriminated against for exercising your privacy rights

For shopper information, we act as the merchant's service provider, and requests should go to the merchant. To exercise your rights regarding information we hold as a business, contact us at accounts@nexmail.ai.

12. European Privacy Rights (GDPR)

If you are located in the EEA, United Kingdom, or Switzerland, you have additional rights under the GDPR: the Right of Access, Right to Rectification, Right to Erasure, Right to Restriction, Right to Data Portability, Right to Object, and Right to Lodge a Complaint with your supervisory authority.

We process merchant personal data on the following legal bases: performance of our contract with you, compliance with legal obligations, our legitimate business interests (including counting storefront visitors for billing in the privacy-protective way described in Section 3, and securing the Services), and your consent where required, such as for optional analytics on veyapopups.com.

For shopper data, the merchant is the controller and is responsible for the legal basis for collecting it, including the consent shown in its forms. We process that data only on the merchant's instructions.

13. Shopify Privacy Requests

Veya responds to Shopify's mandatory privacy webhooks:

• customers/data_request: when a shopper asks a merchant for their data, we prepare an encrypted export of that shopper's Veya records (signups, consent records and quiz answers) and make it available to the merchant in the Veya app
• customers/redact: when a merchant or Shopify asks us to erase a shopper's data, we delete that shopper's signups, consent records, events and visit records for that store, and clear any earlier export
• shop/redact: 48 hours after a merchant uninstalls Veya, we delete all of that store's data

We do not retain the contents of these webhook requests beyond what is needed to process them.

14. International Data Transfers

Nexmail is based in California, United States, and Veya is hosted by Amazon Web Services in the United States (US West, Oregon region). If you or your shoppers are outside the United States, information will be transferred to, stored, and processed in the United States and other countries where our service providers operate. Where we transfer personal data from the European Economic Area, the United Kingdom or Switzerland, we rely on the European Commission's Standard Contractual Clauses (with the UK Addendum and Swiss amendments where applicable) or another lawful transfer mechanism.

15. Children's Privacy

Our Services are intended for businesses and individuals who are at least 18 years old. We do not knowingly collect personal information from children under 18. Merchants must not use Veya forms to knowingly collect personal information from children.

16. Third-Party Links and Integrations

Our Services may contain links to third-party websites or integrate with third-party platforms, including Shopify and Klaviyo. We are not responsible for the privacy practices of these third parties.

17. Email and SMS Marketing Compliance

Veya records the consent wording shown to each shopper and keeps email and SMS consent separate. Merchants are responsible for ensuring that their forms, consent wording and email and SMS marketing comply with all applicable laws, including CAN-SPAM, the TCPA, CASL and the GDPR. See our Terms of Service.

18. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. When we make changes, we will update the "Last Updated" date at the top of this Privacy Policy. If we make material changes, we will notify you by email or through a prominent notice in the Veya app.

19. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy, please contact us at:

Nexmail, Inc.
Email: accounts@nexmail.ai

We will respond to your inquiries in a timely manner and work to address your concerns.