Privacy Policy

Aveus AI is a B2B RegTech platform serving Shopify merchants. We collect the minimum data necessary to provide compliance auditing services (GDPR Art. 5.1.c — data minimisation). We do not collect, store, or process Personally Identifiable Information (PII) from your end customers (consumers).

With respect to your end consumers' data, Mora Boost ApS acts as a Data Processorunder GDPR Art. 28. We process GDPR webhook requests on your behalf as instructed by Shopify's mandatory webhook system. You remain the Data Controller for your customers.

With respect to your merchant data (store domain, access tokens, audit records), Mora Boost ApS acts as an independent Data Controller.

Each category below is deleted automatically once its retention period expires. Periods are upper limits, not minimums: we do not keep data beyond the purpose that justifies it (GDPR Art. 5.1.e — storage limitation).

Your data is processed by the following sub-processors:

AI classification runs on Google Cloud Vertex AI, pinned to the EU multi-region endpoint and restricted to generally available models, so that the ML processing of the content submitted for analysis takes place within the European Union. We authenticate with short-lived credentials issued through Workload Identity Federation — no long-lived Google Cloud service-account keyexists in our runtime. Processing is governed by the Google Cloud Data Processing Addendum (GDPR Art. 28). We do not send your end customers' personal data to the model: what is analysed is store code, configuration, product copy and publicly available vendor documentation.

Google Cloud EMEA Limited may rely on Google LLC (USA) and other Google affiliates as its own sub-processors for limited support, engineering access and abuse monitoring. Likewise, Supabase, Vercel and Upstash are US-incorporated companies whose EU infrastructure may be supported by personnel outside the EEA. Any such residual access is covered by the Standard Contractual Clausespursuant to GDPR Art. 46.2.c, incorporated into each provider's Data Processing Addendum. No personal data is transferred outside the EEA without these safeguards.

Under GDPR Chapter III, you have the following rights regarding your merchant data:

• Right of access (Art. 15) — Request a copy of the data we hold about your Shopify store.
• Right to rectification (Art. 16) — Request correction of inaccurate data.
• Right to erasure (Art. 17) — Request deletion of your data. A verified erasure request purges your AI inventory, compliance ledger, audit logs, sessions, detected vendors, synthetic media flags, certificates, AI cost telemetry, spend counters, scan performance telemetry, operational notifications, storefront scan history and pseudonymised error records. Uninstalling the app automatically purges your AI inventory, synthetic media flags, detected vendors and session data; the remaining categories are removed by a verified erasure request or when their retention period expires.
• Right to data portability (Art. 20) — Request your compliance data in machine-readable format.
• Right to restrict processing (Art. 18) — Request that we limit how we use your data in certain circumstances.
• Right to object (Art. 21) — Object to processing based on legitimate interests.

To exercise any of these rights, contact us at privacy@aveus.ai. We will respond within 30 days (GDPR Art. 12).

You have the right to lodge a complaint with the competent supervisory authority:

We implement technical and organisational measures to protect your data including: AES-256-GCM encryption of access tokens at rest, Row Level Security (RLS) for tenant isolation, HMAC signature verification of all Shopify webhooks, TLS 1.3 in transit, immutable audit ledger, and regular security reviews against OWASP Top 10.

We may update this Privacy Policy. We will notify you by updating the "Last updated" date at the top of this page. Continued use of the Service after changes constitutes acceptance. Material changes will be communicated via the Shopify admin notification system.