Privacy Policy

1.Who we are

Zevron runs Zevron, a chargeback recovery service for subscription businesses. This policy covers our website, the Zevron app, the Shopify app and our Stripe Connect integration.

For data about merchants (the people who sign up), we are the controller. For data about your customers (the shoppers in your disputes), the merchant is the controller and we process it on their instructions under our Data Processing Addendum. If you are a shopper, please contact the store you bought from first.

2.What we collect

From merchants

• Account details: store domain, work email, name, brand name, and the setup answers you give at sign-up.
• Billing records: disputes won, amounts recovered and fees charged.
• Product usage events sent through our usage API or recorded in the app, such as sign-ins and actions on cases.

From your store and connected apps (read-only)

• Dispute records from Shopify Payments or Stripe: amount, reason code, deadline, status.
• Order and customer data for disputed orders: customer name, email, shipping and billing address, items, IP and device details recorded at checkout, AVS/CVV results.
• Subscription history from Recharge, Skio or Loop: sign-up consent, renewals, reminders, cancellation attempts and portal logins.
• Delivery tracking from your fulfillments and EasyPost; email and support history from Klaviyo and Gorgias.

From you directly

• Documents you upload as evidence, and notes or edits you make on a draft.

We do not collect full card numbers. We do not use advertising trackers on the app.

3.Why we use it

• To fight disputes: assemble evidence, draft a response, have a person review it, and file it with the processor.
• To report: show your results and explain why disputes happen and how to prevent them.
• To bill: calculate the success fee and charge it through Shopify or by invoice.
• To run and secure the service: sign-in, alerts, support, abuse prevention and debugging.

4.AI drafting

We send the details needed for each draft to Anthropic’s API. Under its commercial terms, that data is not used to train models. Every AI draft is reviewed by a person before it is filed, unless you turn on auto-file for clean, low-value cases, and no decision with legal effect on a shopper is made by AI alone.

5.Repeat-disputer signals

When a chargeback is opened, we store a one-way keyed hash (HMAC-SHA256) of the shopper’s normalised email address (and, where available, phone number or card fingerprint), never the address, number or card itself. Other stores using Zevron can learn only whether a shopper has disputed elsewhere, as counts: other stores, disputes, outcomes and dispute categories. An answer is given only when at least two other stores and two disputes stand behind it, so no single store or shopper can be identified, and store names are never shared. A signal is deleted with its dispute, and at once when Shopify sends a customers/redact request for that shopper.

6.Who we share it with

We never sell personal data or share it for advertising. We share it only:

• with the payment processor and card network handling the dispute, as evidence;
• with the subprocessors listed below, who run parts of the service for us;
• when the law requires it, or to protect against fraud or harm.

7.Subprocessors

Shopify, Stripe and your connected apps are services you choose and contract with directly; we read from them on your behalf. We will update this list and notify merchants by email at least 30 days before adding a subprocessor.

8.How long we keep it

• Dispute records, evidence, drafts and uploads: while your account is active, so you can see past results and defend reversals.
• Shopify stores: everything for the store, including our activity log about it, is deleted 48 hours after you uninstall the app, when Shopify sends the shop/redact webhook.
• Closing your account from your page: everything, including our activity log about your store, is erased after a 7-day grace period you can cancel.
• After an erasure we keep only a record that it happened (the shop domain and counts), and any unpaid invoice.
• Billing records: kept as long as tax and accounting law requires, usually up to 7 years.
• Hosting logs: kept by our hosting provider for a short, limited period.

9.Shopify privacy webhooks

We handle Shopify’s mandatory privacy webhooks automatically:

• customers/data_request: when a shopper asks a store for their data, we email the store owner a report of what Zevron holds about that shopper, so the store can answer.
• customers/redact: we strip the shopper’s name, email, evidence, uploads and draft text from every case, and delete usage events tied to their email.
• shop/redact: 48 hours after a store uninstalls, we delete the store and everything under it.

10.Security

• Shopify and app access tokens are encrypted at rest with AES-256-GCM.
• All traffic uses TLS. Our database provider encrypts stored data at rest.
• Access to production data is limited to the staff who need it to review disputes or support you.
• Store access is read-only, apart from submitting dispute evidence.

11.Your rights

Depending on where you live, you can ask us to access, correct, delete or export your personal data, or object to or restrict how we use it. California residents have the right to know and delete, and we do not sell or share personal information as those terms are defined in the CCPA.

Email [email protected]. We reply within 30 days. Shoppers’ requests are passed to the relevant merchant, who decides as controller. You can also complain to your local data protection authority.

12.International transfers

We and our subprocessors store data in the United States. For personal data from the EEA, UK or Switzerland, we rely on the Standard Contractual Clauses, as set out in our DPA.

13.Changes and contact

We will email merchants about material changes to this policy before they take effect. The date at the top shows the latest version.

Privacy questions: [email protected]. Zevron.