← Evidkit

Privacy

Last updated: August 11, 2026 · Operated by Velun Labs

This policy covers both the Evidkit app for Shopify (a chargeback evidence tool for stores using Shopify Payments) and this website. It explains what personal data we process, why, where it lives, and how to have it removed.

The Evidkit app

What we process

When a payment dispute (chargeback) is opened against an order on your store, Evidkit reads the following through Shopify's API, only for the orders involved in a dispute:

• Dispute details — amount, reason code, deadlines, status.
• Order details — items, totals, timestamps, fulfillment and tracking information.
• Customer details for that order — name, email address, and shipping/billing address.

We process the minimum data needed to draft dispute evidence. We do not read customers who have no dispute, and we never collect payment card numbers (Shopify does not expose them to apps).

What we use it for

One purpose: assembling evidence for the merchant to review, approve, and submit in response to a dispute — plus deadline reminder emails to the merchant and an audit log of who did what. Evidence drafts are generated with an AI model; nothing is ever sent to the card network by Evidkit itself, and no draft leaves the app without the merchant's explicit approval. We do not use this data for advertising, we do not sell or rent it, and we do not use it to make automated decisions about customers — every output is reviewed by the merchant.

Where it lives and who processes it

• Supabase (PostgreSQL, AWS us-east-1) — application database. Encrypted at rest and in transit; backups are encrypted.
• Vercel — application hosting.
• Anthropic — AI drafting. Relevant order and dispute context is sent to the Claude API to generate evidence text. Anthropic does not use API data to train its models.
• Resend — transactional email to the merchant's notification address (never to your customers).

These providers process data on our behalf under their data processing terms and cannot use it for their own purposes. Access on our side is restricted to Velun Labs, protected by unique credentials, and access to production data is logged.

Retention and deletion

• Dispute and order data is kept while the app is installed, so your evidence history and audit trail stay available.
• When you uninstall Evidkit, Shopify sends us a mandatory redaction request and all of your store's data is permanently deleted from our database.
• When Shopify forwards a customer data deletion request (GDPR/CCPA), that customer's personal data is scrubbed from our records.

This website

• Your email address — only if you type it into the signup form, used solely to email you about Evidkit. Every email includes an unsubscribe link.
• Anonymous visit statistics — page views and referrers via Vercel Analytics, which does not use cookies and does not identify individual visitors.

No cookies, no tracking pixels, no ad networks, no fingerprinting.

Deletion and questions

Merchants: uninstalling the app triggers full deletion automatically. For anything else — removing a signup address, a copy of what we hold, or any privacy question — email velun.labs@gmail.com and it will be handled within 7 days.