1. Who we are
Nevarion Technologies Ltd is the controller of the personal data described in this policy. We are a company registered in England and Wales under company number 16935174, with our registered office at Suite 10349, 5 Brayford Square, London, E1 0SG, United Kingdom.
For anything to do with this policy or your data, email info@nevariontechnologies.com.
2. What this policy covers
- this website, nevariontechnologies.com;
- nevarionlabs.com, including the AssetGuard product pages and the free AssetGuard checker at nevarionlabs.com/assetguard/checker;
- the AssetGuard app for Shopify, available on the Shopify App Store;
- emails you send us.
Shopify runs its own platform, App Store and billing, and handles the data involved under its own privacy policy. Links to other websites lead to sites with their own privacy terms.
3. This website
nevariontechnologies.com has no forms, sets no cookies, stores nothing in your browser and runs no analytics. Fonts are served from our own host, so your browser doesn’t contact a font service.
The site is hosted by Vercel. To deliver pages and protect its platform, Vercel processes your IP address and the details of each request (such as the page requested, the time and your browser’s user agent), and keeps logs under its own retention rules.
4. nevarionlabs.com and cookieless measurement
nevarionlabs.com sets no cookies and stores nothing in your browser for measurement. It is also hosted by Vercel, which processes request data as described above.
To understand, in aggregate, how the site is used, it uses Vercel Web Analytics. For each page view this can record the time, the page path, the referring site, an approximate location (country, region, city), the operating system, the browser and the device type. We remove query strings and fragments from page addresses before they are sent. Vercel tells visits apart with a hash computed from the request; Vercel says this hash is discarded after 24 hours, IP addresses are not stored and visits are not linked across websites. We see aggregated figures only.
The site also counts four things in the same way: the kind of source a visit came from (search engine, direct or another website, worked out in your browser), that a checker scan was started, the kind of result the checker showed, and that a link to AssetGuard on the Shopify App Store was clicked. None of these includes a store address, a query string or a full referring address.
5. The free AssetGuard checker
When you enter a store address, it is sent to our server, which uses it to fetch that store’s public pages and check the links and images on them. Your browser doesn’t visit those pages; our server does, identifying itself as AssetGuardChecker/1.0 and following the store’s robots.txt.
- The address you enter and the results are not saved to a database or a file. The results are shown once, in your browser.
- The store’s hostname is kept in server memory for 2 minutes, so the same store can’t be scanned again straight away.
- To limit abuse, the server counts scans per visitor (up to 3 every 10 minutes and 10 a day). It doesn’t keep your IP address for this. It keeps a keyed hash of it, made with a random key that exists only in that server instance’s memory. These counters live in memory only and are gone when the instance shuts down, and after 24 hours at the latest.
6. The AssetGuard Shopify app
AssetGuard is used by businesses that run Shopify stores. The app asks Shopify for permission to read and write products and online store content (pages, blogs and articles) and to manage metaobjects. It does not ask for access to customers, orders or payments.
What the app stores
- Access details. Your store’s Shopify domain, the access token Shopify issues to the app, the permissions granted and the token’s expiry. The app uses offline access, which belongs to the store rather than to a member of staff.
- Store record. Your store’s domain, your AssetGuard plan, the Shopify subscription ID and status, and whether a scan is running and how far it has got.
- Scan history. When each scan ran, how many products, collections, articles and links or images it checked, and whether it was cut short. The app uses this to count scans against your plan.
- Scan results. For each problem found: the item’s Shopify ID and title, its type, the broken address and the HTTP status code returned.
What the app reads but doesn’t keep
During a scan the app reads your products’ titles, descriptions and images, your collections’ titles, descriptions and images, and your blog articles’ titles, text and images. It then requests each link and image address it finds to see whether it still works, so the servers behind those addresses see a request from our host. This content is processed in memory; only the problems found are saved.
When you use Fix
When you replace a broken link or image, the app sends the change to Shopify, which updates your store. The replacement address you enter is written into your store, not kept separately by us.
Billing
Subscriptions are handled by Shopify. We never see your card or bank details. We receive the plan you chose and the subscription’s status.
Logs
When Shopify sends the app a notification (for example that the app was uninstalled), the app records the store domain and the type of notification in its server logs. If a scan or fix fails, the error message is logged too. These logs are kept by Vercel under its retention rules.
7. Emails to us
If you email us, we receive your email address, your name if you include it, and whatever you write. We use it to reply and to deal with your request. Our mailbox is hosted by Hostinger.
8. Why we use data and our legal basis
| Purpose | Legal basis (UK GDPR and EU GDPR) |
|---|---|
| Providing the AssetGuard app to a store that installed it, including plan limits | Contract with the merchant |
| Hosting the websites, keeping logs and protecting the services | Legitimate interests in running secure, available services |
| Running the free checker and limiting abuse of it | Legitimate interests in offering the checker and preventing its use against other sites |
| Aggregated, cookieless measurement on nevarionlabs.com | Legitimate interests in understanding, in aggregate, how the site is used |
| Answering emails and support requests | Legitimate interests, or steps towards or under a contract when you are a customer |
9. How long we keep data
- Checker. Nothing is saved. Hostnames stay in memory for 2 minutes and abuse counters for 24 hours at most.
- Measurement on nevarionlabs.com. Vercel provides at least one month of reporting on our current plan and says it may keep the data longer. Retention follows Vercel’s terms.
- Hosting logs. Kept by Vercel under its retention rules.
- AssetGuard while installed. Scan results are replaced each time you run a new scan, and a result is removed once you fix it. The store record and scan history are kept while the app is installed.
- AssetGuard after you uninstall. When Shopify tells the app it has been uninstalled, the app deletes the stored access details for your store straight away and resets your plan to Free. The store record, scan history and scan results are kept until Shopify asks us to erase the store’s data, so nothing is lost if you reinstall in the meantime. Shopify sends that request about 48 hours after you uninstall; the exact timing is up to Shopify. When it arrives, the app deletes all of them.
- Your customers’ data. AssetGuard doesn’t store any data about your store’s customers. When Shopify passes on a customer’s request to see or erase their data, the app has nothing to return or delete, so it only acknowledges the request.
- Deletion on request. If you want your store’s data deleted sooner, email info@nevariontechnologies.com from an address linked to the store, and we will delete it.
- Emails. Kept in our mailbox. We have not set a fixed deletion period. You can ask us to delete your correspondence at any time.
10. Service providers and international transfers
We use these providers to run our services. They process data on our behalf, under our instructions.
| Provider | What for |
|---|---|
| Vercel Inc. (United States) | Hosting both websites and the AssetGuard app, server logs, and Web Analytics on nevarionlabs.com |
| Prisma Data, Inc. (Prisma Postgres) | The database that holds the AssetGuard data listed above |
| Hostinger | Email hosting for info@nevariontechnologies.com |
Shopify is not our processor: it runs its own platform and acts as a separate controller for the data on it.
Some of these providers process data outside the United Kingdom and the European Economic Area, including in the United States. Where that happens, the transfer relies on the safeguards in the provider’s data processing terms, such as the UK International Data Transfer Addendum and the EU Standard Contractual Clauses. You can ask us for details.
We don’t sell personal data and don’t use it for advertising.
11. Your rights
Under the UK GDPR, and the EU GDPR where it applies to you, you can ask us to:
- tell you whether we hold data about you and give you a copy;
- correct data that is wrong;
- delete your data;
- restrict how we use it;
- give you data you provided in a portable format, where the processing is based on a contract.
You can also object to any use based on our legitimate interests. To make a request, email info@nevariontechnologies.com. We reply within one month. We may need to confirm who you are first. Aggregated measurement data can’t usually be linked back to one person, so we may not be able to find data about you in it.
We don’t make decisions about you based solely on automated processing.
12. Complaints
Please contact us first so we can try to put things right. You also have the right to complain to a supervisory authority:
- in the United Kingdom, the UK data protection authority;
- in the European Union, the data protection authority of the country where you live or work, or where the issue arose. The European Data Protection Board lists them at edpb.europa.eu.
13. Children
Our websites and the AssetGuard app are meant for businesses and are not directed at children. We don’t knowingly collect personal data from children.
14. Changes to this policy
When our services or the way we use data change, we update this policy and the date at the top of the page. If a change matters to how we use your data, we will say so at the top of this page.