Privacy Policy

1. Who we are

QAIMOS LTD is a UK registered limited company. Contact: info@qaimos.co.uk · qaimos.co.uk.

2. What CertVault does

CertVault helps Shopify merchants collect, review, and store US resale and tax-exemption certificates for B2B Company Locations, and may update Shopify tax-exempt settings when a certificate is approved or expires.

3. Data we process

Depending on how the merchant uses the app, we may process:

• Shop identifiers and OAuth tokens needed to run the app
• B2B company and location identifiers and names from Shopify
• Certificate files and metadata (type, states, permit number, dates, status)
• Purchaser name and email provided on certificate uploads
• Billing plan status from Shopify Billing (we do not store card numbers)
• App usage logs needed for security and support

We do not use this data for marketing or sell it to third parties.

4. Purposes and legal bases

We process data to provide the app to the merchant (contract), secure the service (legitimate interests), and meet legal obligations such as responding to Shopify GDPR webhooks.

5. Sharing

Data stays with the merchant’s shop context. Infrastructure providers (for example hosting) process data only to run CertVault. Shopify processes Billing and Admin API requests under Shopify’s terms.

6. Retention and deletion

We keep data while the app is installed and certificates remain. We honor Shopify customers/data_request, customers/redact, and shop/redact webhooks, and clear access tokens on uninstall.

7. Security

Traffic uses HTTPS/TLS. App data is stored on secured hosting with access limited to operating the service.

8. International transfers

Hosting or subprocessors may process data outside the UK/EEA with appropriate safeguards where required.

9. Your rights

Merchants and individuals may contact us at info@qaimos.co.uk to exercise privacy rights. Buyers should also contact the merchant who collected their certificate.

10. Changes

We may update this policy and will revise the date above when we do.