Trust and security
Your payout data stays yours
Sellers trust us with how their business earns. Here is exactly what happens to your reports, what we keep and for how long, who helps us run Veritally, and what we do if something goes wrong.
Six promises
Your file stays on your device
Reports are opened in your browser. Buyer names, addresses, phone numbers and UPI IDs are dropped before anything is sent. Only order numbers, dates and amounts reach our server.
No passwords, ever
We never ask for your marketplace, bank or email password. Sign-in is with Google or, where offered, a one-time email code, so there is no Veritally password to leak.
We can't touch your money
Veritally can't change listings, move money or raise tickets on its own. Even recovery done for you works only through access you give and can remove, such as a sub-user login, never your password.
Your account is yours alone
Database rules let each account read only its own checks and claims. Automated tests try to read, watch or recover another seller's data on every change, and must fail.
Payments by Razorpay
Card, UPI and net banking details go straight to Razorpay, a licensed payment aggregator. We never see your card number, CVV or UPI PIN.
Delete everything, any time
One tap in your account deletes your checks, claims and account. Payment records are kept only as long as tax law requires.
How your data moves
From the report you download to the result you see, in four steps.
On your phone or laptop
Your report opens in your browser. Buyer names, addresses, phone numbers and UPI IDs are dropped here.
Sent encrypted
Only order numbers, product codes, dates and amounts travel, over HTTPS. The file itself never does.
Checked on our server
Our server runs the same rules for every seller and keeps the results in your account, stored in Mumbai, India.
Seen only by you
Database rules let only your account read your checks and claims. You can delete them all at any time.
Never leaves your device
- The original file
- Buyer names and addresses
- Buyer phone numbers
- UPI IDs and bank details
- Any password
Security practices
- Encrypted
- HTTPS for everything in transit; data at rest is encrypted by our database provider.
- Stored in India
- Your account, checks and claims are stored in Mumbai.
- Rules on the server
- Every check runs on our server with the same rules for every seller. A build check stops checking code ever reaching the browser.
- AI never sees your numbers
- When AI help is used, it gets column names and plain descriptions, never amounts, order numbers or buyer details.
- Limits against misuse
- Limits on checks, sign-in emails, reminders and recovery requests keep bots and misuse out.
- Staff access is logged
- Admin access needs Google sign-in, an approved list and fresh two-step verification. Every view of a seller's data is logged and the log is kept for one year.
- Backups
- We keep backups; deleted data leaves them within 35 days as they roll over.
- Every email can be stopped
- Reminders and follow-ups carry a one-click stop link. Marketing emails go only to people who opted in.
Service providers
These companies help us run Veritally. Each works on our instructions under contract and must keep data secure. The same list, with full detail, is in our Privacy Notice. We never share data with Meesho, Amazon, Flipkart or any marketplace.
| Provider | What it does | Data it handles | Where |
|---|---|---|---|
| Supabase | Database, sign-in and the server that runs every check | Account data, check results, claims, logs | Mumbai, India (AWS ap-south-1) |
| Cloudflare | Website hosting, content delivery, security and bot checks | Technical data, IP address, website traffic | Global network |
| Razorpay | Payments (UPI, cards, net banking) | Payment details, name, email, phone if given | India |
| Resend | Emails: sign-in codes, invoices, notices and reminders | Email address, name, email content | May be outside India (including USA) |
| Sign-in with Google; analytics only if you allow it | Name and email from Google sign-in; page visits without report data | May be outside India | |
| Odoo | Accounting and invoice records | Invoice records | As per Odoo's hosting |
| Anthropic | Optional AI help: layouts, explanations, claim wording | Column names, descriptions without amounts or order numbers, your questions | USA |
The Shopify app
- Read-only access to orders. It never asks Shopify for customer names, emails, phone numbers or addresses.
- Access tokens are stored encrypted and deleted the moment the app is uninstalled.
- When Shopify asks us to erase a store's data after uninstall, the store's record, watches and recovery cases are deleted.
- It sends nothing back to Shopify and never changes your store.
If something goes wrong
- We tell affected sellers without delay, in plain language: what happened, what data was involved, and what to do.
- We report it to the Data Protection Board of India, with a detailed report within 72 hours.
- Where required, we report it to CERT-In within 6 hours of noticing it.
- We keep security logs for one year, so we can find out exactly what happened.
Report a security issue
Found a weakness in Veritally? Email us with "Security" in the subject and the steps to see it. Please don't access other sellers' data or disrupt the service while testing. We read every report and reply to you.
Questions
Do you sell my data?
No. We don't sell or rent data, and we don't use advertising cookies or social media pixels.
Who can see my reports?
Only you. Your original file never leaves your device. The check results in your account can be read only by your account; our team sees a seller's claims only if that seller asks us to recover the money and we accept the case.
Where is my data stored?
In Mumbai, India, on Supabase (AWS ap-south-1). A few providers, such as the email sender, may process your email address outside India.
Can Veritally move my money or change my listings?
No. Veritally never connects to your marketplace or bank account. The Shopify app has read-only access to orders and never sees customer names, emails, phone numbers or addresses.
What happens if there is a data breach?
We tell affected sellers without delay, in plain language, report it to the Data Protection Board of India and, where required, to CERT-In within 6 hours of noticing it.
More detail: Privacy Notice · Terms · Grievance Officer · Cookies