Merivirta VAT Switcher On the Shopify App Store VAT Switcher privacy policy
Last updated: 9 November 2026
This privacy policy explains what information the Shopify app Merivirta VAT Switcher (“the app”) collects, how it is used, where it is stored and how it is deleted. The app is provided by Merivirta Digital Oy (“Merivirta”, “we”, “us”).
1. Who we are
| Company | Merivirta Digital Oy |
| Country | Finland |
| Privacy contact | jere@merivirta.com |
| App URL | https://vat.merivirta.com |
2. What the app does
The app lets shoppers switch the prices shown in the merchant’s online store between prices including and excluding VAT. The merchant sets the VAT rules in the app. The app publishes these settings to the merchant’s store as app data (app-installation metafields), and the app’s theme extension reads them in the storefront. The app does not change products, prices, orders or theme files, and it does not change what Shopify charges at checkout. Nothing is published to the store until the merchant selects Activate on the app’s dashboard.
3. Information we collect and store
The app stores only what it needs to work for the merchant’s store. It does not collect, request or store information about the store’s customers, and it does not read orders or customers. The app does not use Shopify’s protected customer data.
| Information | Source | Why we need it |
|---|---|---|
| Store’s myshopify domain, installation and uninstall times, the time the merchant activated the app, the time and result of the last publish, and the number of products with their own VAT rate | Shopify, when the app is installed and opened; created by the app | To identify the store, route requests, record the merchant’s consent to publish, and show the status on the dashboard |
| Shopify access token and refresh token for the store (offline access) | Shopify OAuth / token exchange | To call the Shopify Admin API on the store’s behalf, including automatic updates after product or market changes |
| App settings: VAT display options, VAT rate overrides, price labels and their translations, customer tags that should see prices excl. VAT (for example “wholesale”), country rules, visitor popup texts, CSS selectors | Entered by the merchant | To build the storefront configuration |
| Multi-VAT rules: which collections, tags, vendors, product types, product categories or products use which VAT category or rate | Entered by the merchant | To show the correct VAT rate for each product |
| Background jobs that republish the storefront configuration (store domain, job status and times); finished jobs are deleted after 7 days | Created by the app | To publish changes after Shopify sends product, collection, market or shop updates |
| Current app plan (cached for 5 minutes) | Shopify Partner API (activeSubscription) | To apply the features of the merchant’s plan |
The app reads, but does not store, the following store data each time it runs: the store’s name, country, currency, the setting “include sales tax in product price”, countries the store ships to, published languages, Markets and how each market shows taxes, the published theme’s name and whether the app embed is turned on, and the handles of products covered by Multi-VAT rules. The product handles and their VAT rates are written into the store’s app data so the storefront can use them.
In the storefront (the shopper’s browser): the app’s theme extension reads the published settings from the store. For a logged-in customer, the theme passes the customer’s tags, whether they are a Shopify B2B customer and their company location’s country to the app’s script on that page only, so it can choose the right price view. This happens in the shopper’s browser; it is never sent to our servers. The shopper’s choice (incl. or excl. VAT, and whether the visitor popup has been answered) is stored in the shopper’s own browser (local storage or session storage) so the choice is remembered between pages. The storefront script makes no requests to our servers; it only reads the cart from the store itself (/cart.js) to calculate cart totals.
Information we do not collect: customer names, emails, addresses or orders; payment card details (Shopify handles all billing); staff account details (the app uses offline access only, so no staff names or emails are stored); cookies for tracking or advertising. The app has no analytics, advertising or tracking scripts in the storefront or in the admin. Page-performance metrics of the app’s admin pages (Web Vitals: metric name, value and page path, with the store domain) are sent to our own server and written to the server log only.
Ask Virta (optional AI assistant). The Help page has a chat with Virta, Merivirta’s AI assistant, labelled as AI. Nothing is sent unless the merchant writes a question. When they do, the question, Virta’s replies, the store’s myshopify domain, the app’s plan and the browser language go to Merivirta’s Support Hub. The replies are generated by Anthropic’s Claude (Anthropic PBC, United States), which receives the conversation to write the reply and does not use data sent through its API to train its models. If the merchant selects Ask a person and ticks the consent box, the email address they confirm (pre-filled with the store’s email) is stored with the conversation so a person from Merivirta can reply by email. Store settings, products, customers and orders are never sent to the assistant. Apart from this chat, the app does not send store data to any AI or machine-learning service.
4. How we use the information
We use the information only to provide the app’s features to the merchant:
- publish the VAT settings, rates and Multi-VAT rules to the merchant’s store;
- keep them up to date when products, collections, markets or shop settings change;
- apply the features of the merchant’s plan;
- show the store’s tax setup and the app’s status on the dashboard;
- provide support when the merchant contacts us;
- keep the app secure and fix errors.
We do not sell, rent or share the information for marketing, and we do not use one store’s data for another store.
Legal basis (GDPR). Most of the information is business data about the store and its products and is not personal data. Where personal data is processed (for example the store’s domain when it identifies a sole trader, or the name and email of a merchant who contacts support), the legal basis is the performance of our contract with the merchant (Art. 6(1)(b)) and our legitimate interest in running and securing the service (Art. 6(1)(f)). Merivirta acts as controller for support communication and as processor for data processed on the merchant’s instructions.
5. Where the information is stored and who processes it
All app data is stored in a PostgreSQL database and processed by the app’s web server and background worker hosted by Render in the Frankfurt (EU) region.
| Service provider | Purpose | Location |
|---|---|---|
| Render Services, Inc. | Hosting of the app’s web server, background worker and database | Frankfurt, Germany (EU). Any transfer to Render’s US company is covered by Render’s data processing agreement and Standard Contractual Clauses. |
| Merivirta Support Hub (our own service, on Render in Frankfurt) | Virta chat conversations and “Ask a person” requests | Frankfurt, Germany (EU) |
| Anthropic PBC | Generates Virta’s replies when the merchant uses the chat | United States. The transfer is based on the European Commission’s Standard Contractual Clauses. |
| Shopify | The platform the app runs on: authentication, Admin API, app data (metafields), the theme extension, webhooks, billing (Shopify App Pricing) and the Partner API | See Shopify’s privacy policy |
We do not use any other subprocessors.
6. Security
- All traffic uses HTTPS.
- App settings, Multi-VAT rules and the plan cache are stored encrypted with AES-256-GCM, with a separate key for this app.
- Shopify webhooks are verified with HMAC signatures.
- Access tokens and settings are never written to logs.
- Each store’s data is kept separate and is only used for that store.
- Nothing is published to the store until the merchant activates the app.
7. How long we keep the information
| Situation | What happens |
|---|---|
| While the app is installed | Data is kept so the storefront stays up to date. Finished background jobs are deleted after 7 days. |
| The merchant uninstalls the app | The store’s access tokens are deleted immediately, queued jobs are stopped, and the consent to publish is cleared. Shopify removes the app’s theme extension (app embed and blocks) from the storefront, so the published settings are no longer used. They are app data tied to the app’s installation and contain no personal data. |
48 hours after uninstall (Shopify shop/redact) | All data stored for the store is deleted: settings, Multi-VAT rules, plan cache, status and queue entries. |
| Moving between Merivirta VAT Switcher apps | If the store still has another version of Merivirta VAT Switcher installed (for example it moved from a custom app made for it to the public App Store app), the store’s settings are kept for that installation and only the uninstalled app’s access tokens are deleted. |
| Virta chat | Conversations are deleted automatically after 90 days and “Ask a person” requests after 365 days, unless they lead to an ongoing support case. |
| Database backups | Backups made by our hosting provider are deleted on their normal rotation. |
| Server logs | Logs contain technical details (for example the store domain, request path and status, job IDs) but no tokens, settings or customer data. |
8. Shopify privacy requests
customers/data_requestandcustomers/redact: the app does not store any customer data, so there is nothing to export or delete. These requests are acknowledged.shop/redact: all of the store’s data is deleted as described above.
9. Your rights
Merchants, and any person whose personal data we process, can ask us to access, correct, delete or export their data, or object to or restrict its processing. Contact us at jere@merivirta.com. A merchant can also delete all data by uninstalling the app. Shoppers can clear their incl./excl. VAT choice by clearing their browser’s site data.
You have the right to lodge a complaint with a data protection authority. In Finland this is the Office of the Data Protection Ombudsman (Tietosuojavaltuutetun toimisto), https://tietosuoja.fi.
10. Changes to this policy
We will update this page when the app’s data handling changes and change the “Last updated” date above. Material changes will also be announced in the app.
11. Contact
Merivirta Digital Oy, Finland
Email: jere@merivirta.com
