VGC Order Sync — Privacy Policy

Effective 21 October 2026

VGC Order Sync is a Shopify app that connects a merchant's Shopify store to the merchant's own VGC account at viewmoney.us. It is provided by Apex Meridian Group LLC, which operates VGC (see Company & Legal Notice). This policy explains what the app accesses, what it keeps, and for how long. It applies in addition to the general VGC Privacy Policy.

What the app does

• Shows the store's orders in the merchant's VGC dashboard as they are placed and updated.
• Lets the merchant add a tracking number to an order from VGC; the tracking is written to the order in Shopify and Shopify sends its own shipping notification to the customer.
• Counts storefront visits, add-to-carts and checkouts so the merchant can see today's traffic.
• If the merchant connects a Google account, shows the spend and the running campaigns of the merchant's own Google Ads account (read only).

Information the app accesses

• Orders (Shopify Admin API, read only): order number, date, status, items, totals, fulfilment and tracking, and the customer details that are part of an order (name, email, phone, shipping and billing address). Used only to display the order to the merchant and to add tracking.
• Fulfilment orders: to attach a tracking number when the merchant asks.
• Storefront events (Shopify web pixel), only for visitors whose consent covers analytics: the event type (page viewed, product viewed, product added to cart, checkout started, checkout completed), the page path without its query string (pages whose path identifies one shopper — checkout, order status, account, cart links — are stored under a generic name such as /checkout), the time, Shopify's anonymous browser identifier, the visitor's country (looked up on VGC's server from the address the event arrives from, using DB-IP's IP-to-country database; the address itself is not stored), the browser family (for example "Chrome / Windows" — never the full user agent), and on the first page of a visit the host name of the referring site and the landing URL's utm_source, utm_medium and utm_campaign and which advertising click identifier it carried (the identifier's value is not collected). For a product viewed: its SKU, title and price (the store's own catalogue data). For a completed checkout: the order total and the order's id, so the merchant can see which traffic source an order came from. The pixel never collects names, email addresses, postal addresses, payment details or cart contents, and nothing it collects is sent to an advertising platform.
• Google Ads conversion reporting — discontinued. Until 21 October 2026 VGC could report a store's purchases, add-to-carts and checkouts to the merchant's own Google Ads account. For that, the pixel also sent the Google click id (gclid, gbraid or wbraid) of the landing page while the visitor's consent covered marketing and the sale or sharing of their data, Shopify's checkout token and whether the order was the buyer's first; and, when the merchant had chosen enhanced conversions, the order's email address, phone number, name, postcode and country were sent to Google hashed (SHA-256). That reporting has been removed: none of this is collected or sent any more. What was kept for it is deleted on its original schedule — checkout tokens after 30 days, hashed customer details 35 days after the conversion, and the conversion records themselves after 180 days — and earlier if Shopify asks for the customer's or the shop's data to be erased.

Google account data (Google Ads)

A merchant may connect a Google account to VGC so that VGC can show the spend and the running campaigns of the merchant's own Google Ads account. VGC asks Google only for the Google Ads permission (https://www.googleapis.com/auth/adwords), and for the account's email address so the merchant can see which account is connected. VGC does not ask for access to Merchant Center or to any other Google product, and writes nothing to Google Ads.

• What is used. The refresh token Google issues is stored encrypted and used solely to read the Google Ads API on the merchant's behalf: to list the accounts the login can see, so the merchant picks the store's account, and to read that account's running campaigns and ads with their budget, status, spend, clicks and conversion metrics. Nothing read from Google is sold, used for advertising by VGC, or shared with other merchants.
• The VGC Ads Viewer browser extension. A person may instead sign in to VGC's read-only Ads Viewer extension with a Google account. For that sign-in VGC asks only for the Google Ads permission and the email address, stores the refresh token encrypted, and uses it for one thing: to read that account's running campaigns and ads and show them in the browser that signed in. Nothing is written to Google with it. "Disconnect" in the extension deletes the stored token, and a sign-in left unused for 60 days is deleted automatically.
• Who can see it. Only the merchant's own VGC account (and the people they invited to it) sees the figures; in the Ads Viewer extension, only the browser that signed in with that Google account. VGC staff access the data only to fix a fault the merchant reported.
• How to disconnect. Connecting another Google account replaces the stored token; revoking VGC at myaccount.google.com/permissions ends access immediately, and the stored token stops working. Deleting the store in VGC deletes the token.
• Limited Use. VGC's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Google user data is never used to build advertising profiles, never transferred to data brokers or advertising platforms, and never read by humans except with the merchant's consent to fix a problem, for security, or as required by law.

What is stored, and for how long

• Orders are read from Shopify when the merchant views them; they are not copied into VGC's database. To spare Shopify repeated requests, an answer may be held in a server-side cache for up to 15 seconds; cached answers are deleted within an hour.
• When an order is placed or paid, VGC keeps a short notification record (order number, status, total and the customer's name) so the merchant is notified once. The customer's name is removed from it after 90 days.
• Storefront events are stored with the anonymous identifier replaced by a one-way hash (salted per store, so a visitor cannot be followed across stores), and are deleted after 90 days.
• When a tracking or order email is sent through VGC (by the merchant, or automatically once the merchant has set up a mailbox for the store in VGC), the recipient's address and the message are kept as a delivery record for the merchant, until the merchant deletes it or the customer's data is redacted (below).
• The store's Shopify access token is stored encrypted and deleted as soon as the app is uninstalled.

Sharing

Data is used only to provide these features to the merchant who installed the app. It is not sold, not used for advertising, and not shared with third parties other than the hosting provider that runs VGC.

Customer and shop data requests

• Access requests sent by Shopify are recorded and the merchant is given what VGC holds about that customer within 30 days.
• Deletion requests sent by Shopify remove the customer's email address and message text from the merchant's delivery records and their name from order notifications.
• Shop deletion: 48 hours after the app is uninstalled, Shopify asks for the shop's data to be erased; VGC removes the shop's customer addresses, storefront events, tokens and installation record.

Security

All traffic uses TLS. Access tokens and app secrets are encrypted at rest, and so are the customer details VGC keeps: the address and text of emails sent for an order, the customer's name in an order notification and cached order lists are stored encrypted (AES-256) and decrypted only when shown to the merchant, so database backups hold them only in encrypted form. Access to VGC requires an account, with optional two-factor authentication; each account sees only its own stores; and sensitive actions are written to an audit log. Suspected incidents are handled under VGC's Security Policy: contained, investigated, and reported to the affected merchants and to Shopify without undue delay.

Contact

Questions or requests about this policy: App@imc-marketing.com. See also Support.