How we handle data.

VeryQuery is operated by Very Machine, Inc., a Delaware corporation. When this policy says “we,” “us,” or “VeryQuery,” it means Very Machine, Inc. When it says “you,” it generally means the merchant who has an account with us.

For any privacy question, data-subject request, or to reach our privacy team, write to privacy@veryquery.com. For legal matters, legal@veryquery.com.

VeryQuery handles two distinct categories of personal information, and our role differs for each.

Merchant data (we are the controller)

For information about you as our customer (your account, billing, support correspondence), we are the controller: we decide how and why it's processed.

Shopper data (we are the processor)

For information your shoppers generate through your storefront that you then send to us (search queries, pseudonymous session and user identifiers, merchant-controlled metadata), we are a processor. You are the controller of that data. We process it only on your instructions and for the purpose of providing the service to you.

If you need a Data Processing Addendum (DPA) to cover shopper-data processing, one is available on request to privacy@veryquery.com.

All shopper-facing traffic reaches the service through your backend. We do not interact with your shoppers directly and we do not set cookies or trackers on your storefront.

The categories of data that may flow to us from your integration include:

When you send us a userId or sessionId, it must be pseudonymous. Do not send us email addresses, names, phone numbers, government identifiers, or any other raw personally identifiable information through these fields or through the optional metadata blob. This boundary is a condition of using the service and is restated in our documentation and API specification.

We rely on this commitment when designing our data handling. If raw PII reaches us through these fields despite this rule, you remain the controller of that data and you remain responsible for compliance with applicable law.

We use your data to provide, operate, secure, and improve the service. Specifically:

We may produce aggregated or de-identified information derived from platform-wide usage (for example, aggregate demand patterns). Aggregated or de-identified outputs do not identify you, your shoppers, or your catalog, and may be used to improve or describe the service generally.

To deliver the service we work with a small set of established providers. We use them in the following categories:

Every provider is bound by written data-protection terms consistent with this policy. A current list of named sub-processors is available on request to privacy@veryquery.com.

Very Machine, Inc. is based in the United States. When you use the service, your data (and shopper data you send us) may be transferred to, stored in, and processed in the United States and in other countries where we or our sub-processors operate.

For transfers of personal data subject to the EU General Data Protection Regulation (GDPR), the UK General Data Protection Regulation (UK-GDPR), or equivalent laws, we rely on appropriate safeguards, including the European Commission's Standard Contractual Clauses and the UK International Data Transfer Addendum where applicable. If you require these safeguards formalized alongside a DPA, contact privacy@veryquery.com.

Depending on where you live, you may have the right to:

California residents have specific rights under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA), including the right to know what personal information is collected, the right to deletion, the right to correction, and the right to opt out of the sale or sharing of personal information. We do not sell or share personal information under the CCPA's definitions.

To exercise any of these rights, write to privacy@veryquery.com. We will respond within the timeframe required by applicable law.

If you are a shopper whose pseudonymous data reached us through a merchant's use of the service, your request is generally best directed to that merchant (the controller). We will support the merchant's response and, where required by law, respond to you directly.

While your account is active, we retain your data for as long as needed to provide the service and meet our legal obligations.

After your account terminates, we retain your data for 30 days and then permanently delete it from our active systems. Residual copies in routine backups are purged on the normal backup lifecycle.

We may retain a limited subset of account and transaction records beyond this window where required by tax, accounting, fraud-prevention, or other legal obligations, or for the establishment or defense of legal claims.

Our merchant dashboard (merchant.veryquery.com) uses a first-party session cookie required for authentication. Without it, signed-in sessions cannot be maintained.

We do not set advertising cookies, third-party tracking cookies, or analytics cookies on our marketing site or dashboard. We do not participate in cross-site tracking.

We apply administrative, technical, and physical safeguards that are reasonable and appropriate to the nature of the data we handle and the risks involved. These include encryption in transit for all API and dashboard traffic, principle-of-least-privilege access controls for internal staff, and isolation of customer data along account boundaries.

No method of transmission or storage is perfectly secure. If we become aware of a security incident that meaningfully affects your data, we will notify you without undue delay and in accordance with applicable breach-notification laws.

The service is designed for businesses and is not directed at children. We do not knowingly collect personal information from children under 13 (or under 16 where the GDPR applies) as part of our controller-side processing.

As our merchant, you agree not to use the service to process personal information about children in a way that would require parental consent under applicable law unless you have independently obtained that consent and put appropriate protections in place.

We may update this policy. If we make material changes, we will notify registered account holders by email at least 30 days before the change takes effect. The “Last updated” date at the top of this page always reflects the current version.

Past versions are available on request.