Retrics
Start free · 14 days

VETO · DATA & PRIVACY APPENDIX

What Veto
reads, and why.

The company policies below apply to everything Retrics runs. This page is the part that is specific to this product — the data it touches, and who else sees it.
All policies →About Veto →
BUILDING
VetoBUILDING
RUNS ONveto.retrics.ai
CUSTOMER GRAPHOutside the shared graph
DATA FLOW DECLAREDYes

THIS PAGE IS THE URL THIS PRODUCT’S APP LISTING SUBMITS

WHERE IT STANDS

The work is real. The door is not open yet.

THE DATA FLOW

Five questions, answered plainly.

WHAT IT READS
  • The request as it arrives — user agent, headers and IP address — to decide whether a visitor is a person or a bot
  • What the storefront sensor reports about the browser: whether it is being driven by automation
  • The ad click id on a landing, so a merchant can see which campaign the bot traffic arrived on
WHAT IT STORES
  • One row per visit: an opaque session id, a hash of the IP, a hash of the device fingerprint, the verdict, the score, and the ad click id where there is one
  • The evidence behind a verdict — the names of the checks that fired and what each was worth, never the raw request
  • Reputation labels, cached against a subnet
  • The merchant's own rules, and hourly totals
HOW IT IS PROTECTED
  • No table anywhere has a column for a visitor's IP address. What is stored is a keyed hash of it
  • That hash and the device fingerprint hash are HMACs under keys derived for that one purpose, so neither can be reversed, and nobody without the master key can recompute one to look a person up
  • If the key is missing the code stores nothing rather than the raw value — a misconfiguration cannot quietly start writing addresses
  • Reputation is looked up and cached per subnet, never per address
  • The session id is a random value the visitor's own browser creates and throws away when the tab closes
  • Shopify access tokens are encrypted with AES-256-GCM under a separate derived key
HOW LONG IT IS KEPT
  • When a merchant leaves, everything Veto recorded for that shop is deleted — the visits, the evidence behind each verdict, the rollups and the rules
  • A request to erase a customer finds nothing to erase, and that is the design rather than an omission: Veto holds no customer identity, only hashes and a session id that is already gone
  • Nothing yet expires with age. The nightly job that will drop old records is scheduled and not switched on, and this page will say so until it is
WHO ELSE SEES IT

Nobody. Nothing this product reads or stores leaves Retrics.

Stated rather than left blank on purpose — an empty list reads as unfinished, and “nothing leaves” is a claim somebody has to make.

AND THE COMPANY POLICIES IT SITS UNDER

These apply to everything Retrics runs.

They are linked rather than repeated here. Twelve copies of the same policy is twelve things that drift apart.

Privacy →Subprocessors →Data processing addendum →Data rights →Data deletion →Security →Terms of service →

THIS APPENDIX IS MAINTAINED WITH THE PRODUCT · EDITING IT CHANGES NOTHING ELSE