Privacy Policy

Last updated: June 19, 2026

1. Who We Are

Vamao Labs is an independent software business operated by an individual based in Virginia, United States. When we say "we," "us," or "our," we mean Vamao Labs. When we say "you," we mean you as a user of our website or customer of our products.

Contact: For privacy-related inquiries, please use our contact form.

2. Information We Collect

Information you provide:

  • Account data: Name, email address, and password when you create an account.
  • Purchase data: Billing information processed securely through Stripe. We do not store credit card numbers.
  • Support data: Information you provide when submitting support tickets or contacting us.
  • Shopify app data: If you install Vamao Inventory OS from Shopify, we store your shop domain, Shopify OAuth scopes, encrypted access token, synced product, variant, vendor, location, inventory, order, fulfillment, and customer records needed to provide inventory planning, purchase-order, receiving, cycle-count, audit, and reporting features.
  • Idea submissions: Name, email, and content you submit through our Ideas page.
  • Contact form: Name, email, subject, and message content.

Information collected automatically:

  • Log data: IP address, browser type, operating system, referring URLs, pages visited, and timestamps.
  • Cookies: Essential cookies for site functionality and session management. See our Cookie Policy for details.
  • License verification: Site URLs where our products are activated, for license validation purposes.

3. How We Use Your Information

  • To provide and maintain our products and services.
  • To process payments and deliver license keys.
  • To respond to support requests and inquiries.
  • To send important product updates (security patches, critical updates).
  • To verify license activations and prevent abuse.
  • To sync Shopify store data for Vamao Inventory OS inventory forecasting, reorder recommendations, purchase orders, receiving, cycle counts, and audit logs.
  • To improve our website and products.
  • To comply with legal obligations.

We do not sell, rent, or share your personal data with third parties for marketing purposes.

4. Third-Party Services

We use the following third-party services that may process your data:

  • Stripe — Payment processing. Stripe Privacy Policy
  • Shopify — Shopify App Store installation, OAuth permissions, and Shopify Billing for merchants who install Vamao Inventory OS through Shopify. Shopify Privacy Policy
  • Cloudflare — CDN, DDoS protection, and DNS. Cloudflare Privacy Policy
  • Bunny Fonts — Font delivery (privacy-friendly alternative to Google Fonts).

5. Data Retention

We retain your personal data only as long as necessary to fulfill the purposes outlined in this policy:

  • Account data: Until you request deletion of your account.
  • Purchase records: Retained for tax and legal compliance (minimum 7 years per IRS requirements).
  • Support tickets: Retained for 3 years after resolution.
  • Shopify app data: Retained while your Vamao Inventory OS workspace is active, then deleted or anonymized when required by Shopify mandatory compliance webhooks or a verified deletion request.
  • Server logs: Automatically deleted after 90 days.

6. Your Rights

For All Users:

  • Access, correct, or delete your personal data.
  • Request a copy of your data in a portable format.
  • Withdraw consent for optional data processing at any time.

For Virginia Residents (VCDPA):

Under the Virginia Consumer Data Protection Act, you have the right to:

  • Confirm whether we are processing your personal data.
  • Access your personal data.
  • Correct inaccuracies in your personal data.
  • Delete your personal data.
  • Obtain a copy of your data in a portable format.
  • Opt out of the sale of personal data (we do not sell your data).
  • Opt out of targeted advertising (we do not engage in targeted advertising).
  • Opt out of profiling (we do not profile users).

For European Economic Area (EEA) Residents (GDPR):

If you are located in the EEA, you have additional rights under the General Data Protection Regulation:

  • Right to access, rectify, erase, or restrict processing of your data.
  • Right to data portability.
  • Right to object to processing based on legitimate interests.
  • Right to withdraw consent at any time.
  • Right to lodge a complaint with your local data protection authority.

Our legal bases for processing your data include: contract performance (purchases, account management), legitimate interests (site security, fraud prevention), consent (cookies, optional communications), and legal obligations (tax records).

For California Residents (CCPA):

  • Right to know what personal information is collected and how it's used.
  • Right to delete personal information.
  • Right to opt out of the sale of personal information (we do not sell your data).
  • Right to non-discrimination for exercising your privacy rights.

To exercise any of these rights, please contact us through our contact form. We will respond within 30 days (45 days for VCDPA/CCPA requests).

7. Data Security

We implement appropriate technical and organizational measures to protect your personal data, including:

  • SSL/TLS encryption for all data in transit.
  • Secure password hashing (bcrypt).
  • Regular security updates and monitoring.
  • Limited access to personal data on a need-to-know basis.

8. International Data Transfers

Our servers are located in the United States. If you are accessing our services from outside the US (including the EEA), your data will be transferred to and processed in the United States. By using our services, you consent to this transfer. We take appropriate safeguards to ensure your data is protected in accordance with this policy.

9. Children's Privacy

Our services are not directed to individuals under the age of 16. We do not knowingly collect personal data from children. If we become aware that a child has provided us with personal data, we will take steps to delete it.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify registered users of significant changes via email. The "Last updated" date at the top of this page indicates when the policy was last revised.

11. Contact Us

If you have questions about this Privacy Policy or want to exercise your data rights, please reach out via our contact form.

Vamao Labs
Virginia, United States