Privacy policy

Effective 6 October 2026. This policy covers Storevet for WooCommerce, the service at https://apps.nullagency.online/storevet, published by Nullagency.on, Consulting I.F.S LLC, 1209 Mountain Rd PL NE STE R, Albuquerque, NM 87110, USA.

What we store

• The address of each store you connect.
• The read-only WooCommerce API key your store creates when you approve access (consumer key and secret), encrypted with AES-256-GCM.
• Sign-in tokens issued to your assistant, stored only as SHA-256 hashes. An access token lasts one hour, a refresh token 90 days.
• The name and return addresses of the assistant application that connects (for example Claude), as that application declares them.

We do not ask for your name, e-mail address or WordPress password. You log in on your own store, and your password never reaches Storevet.

What we read during a diagnosis

• From the REST API: products and variations, store settings (settings holding e-mail addresses are skipped), shipping zones and methods, tax rates, payment methods, and the orders of the last 90 days.
• From each order we keep the status, payment method, total, currency, date and country. Customer names, e-mail addresses and postal addresses are dropped as the orders are read.
• From the storefront: the home page, a few product pages, the legal links found on the home page, and the first 2 KB of 16 common backup file addresses.
• Guest carts created through the public Store API to read shipping rates. They hold one product, no customer data, and expire on their own.

The report is kept in the server's memory for 10 minutes, then discarded. It is not written to disk.

Who else receives data

• The assistant you use (for example Claude or ChatGPT) receives the report, under its own privacy policy.
• TypeSafe (typesafe.ai) receives, for each finding, its title, its impact, the number of affected items and up to four examples (product name or ID, country or payment method, and the proof), plus your store's country, currency, product count and order count. It returns a severity level. No customer data is sent.
• Hostinger hosts the server.

We do not sell data, show ads, or use your store's data to train models.

How long we keep it

• The store address and encrypted key: until you ask us to delete them. Revoking the key in WooCommerce stops all access immediately.
• Tokens: until they expire (one hour, or 90 days for refresh tokens).
• Server logs: time, method, path, response status and the client's user agent, without IP addresses, rotated at 30 MB.

Your choices

You can revoke access at any time in WooCommerce, Settings, Advanced, REST API. To get a copy of what we store about your store, or to have it deleted, write to team@nullagency.online. We answer within 3 business days.

Security

Store keys are encrypted with a key kept outside the database. Storevet refuses to contact private or internal network addresses. The service runs in an isolated, read-only container.

Changes

We date each version of this policy at the top of the page and describe significant changes on the documentation page.