Privacy Policy

Effective Date: November 8, 2025 · Last Updated: May 13, 2026

Credenza Labs, Inc. ("Credenza," "we," "our," or "us") provides this Privacy Policy to explain how we collect, use, and protect information when you visit usecredenza.com or use our related services (collectively, the "Platform").

1. Information We Collect

We may collect:

  • Account and contact information you provide—such as your name, company name, email address, and phone number—when you request a demo, create an account, or contact us.
  • Business and compliance information you upload or enter into the Platform, including resale certificates, tax IDs, or professional credentials.
  • Usage data automatically gathered through cookies, analytics tools, and log files (for example: IP address, browser type, and pages visited).

2. How We Use Information

We use your information to:

  • Provide, operate, and improve the Credenza Platform.
  • Verify business and professional information you submit.
  • Communicate with you about your account, compliance requirements, and product updates.
  • Analyze Platform performance and user engagement.
  • Comply with applicable laws and protect our rights.

3. Cookies and Analytics

We use cookies and similar technologies to recognize your browser, analyze traffic, and enhance your experience. We do not share any cookie analytics with third parties. You can adjust cookie settings in your browser, but some parts of the Platform may not function properly without them.

4. Browser Extension

The Credenza browser extension lets signed-in designers save vendors to their firms' trade accounts while browsing. It is scoped to this single purpose. The extension does not collect browsing history, track you across unrelated sites, read content on non-vendor pages, or share any data with advertisers.

When you use the extension, we access:

  • The URL and domain of the page you are viewing, used only to match that page against your firm's existing trade accounts and Credenza's vendor directory.
  • Your Credenza session, read from usecredenza.com, so the extension can authenticate on your behalf. Your session information is only transmitted back to Credenza's own servers.
  • Limited local browser storage, used to remember your trade account list and preferences between sessions.

When you add or enrich a vendor bookmark, the page's domain and publicly available vendor information may be sent to our AI service provider to extract basic details such as the vendor's name and category. This uses the same provider and safeguards described elsewhere in this policy.

5. Shopify Integration

When a vendor installs the Credenza app on their Shopify store, Credenza accesses and processes data from that store solely to verify trade customers, automate tax-exempt onboarding, and maintain the audit chain linking tax-exempt orders to the resale certificates that justify them.

We access:

  • Customer personal data (name, email, phone, shipping address) to match Shopify customers to verified Credenza designer profiles.
  • Customer tags and tax-exemption fields, which we write to mark verified trade buyers and to enable tax-exempt checkout in the appropriate jurisdictions.
  • Order data (order number, line items, shipping address, tax status) used to link tax-exempt trade orders to the resale certificate that justifies the exemption.
  • Company records (for Shopify B2B merchants), used to mirror verification status and tax-exemption metafields onto the company entity.
  • Store configuration to detect Shopify Plus and B2B capabilities so the app behaves correctly for each store type.

We send transactional emails related to verification, approvals, certificate management, and orders linked to verified accounts.

We do not sell or rent Shopify customer data. We do not use Shopify customer data for advertising, profiling, or any purpose outside the verification and tax-compliance use cases described above.

In compliance with Shopify's Protected Customer Data requirements, Credenza responds to the three mandatory data-protection webhooks:

  • customers/data_request—When a customer asks the merchant for their data, we collect every record we hold for that customer and make it available to the merchant for fulfillment within 30 days.
  • customers/redact—When a customer asks the merchant to delete their data, we anonymize the corresponding Credenza records (the audit trail of verification events is preserved with the customer identifier removed, as required for tax-compliance recordkeeping).
  • shop/redact—48 hours after a merchant uninstalls the Credenza app, we erase all Shopify-sourced data for that store.

All webhook deliveries are authenticated using Shopify's HMAC-SHA256 signature. The merchant remains the data controller for their Shopify customer data; Credenza acts as a data processor on the merchant's behalf.

6. Sharing of Information

We do not sell or rent personal data. We may share information only with:

  • Service providers who help us host, process, or analyze data under confidentiality agreements.
  • Vendors or partners you choose to connect with through the Platform, to facilitate trade-program verification.
  • Legal authorities if required to comply with law or protect against misuse of the Platform.

7. Data Retention

We retain information as long as your account is active or as needed to provide our services, comply with legal obligations, or resolve disputes. You may request deletion of your data by contacting us. We may retain your data for certain permissible reasons, including:

  • To complete a transaction or service requested by you.
  • To detect security breaches.
  • To repair errors or bugs.
  • To comply with applicable laws or legal obligations.
  • For internal, lawful use compatible with the context in which you provided the information.

8. Security

We employ reasonable technical and administrative safeguards to protect your data. However, no online system is completely secure, and we cannot guarantee absolute protection.

9. Your Rights

You may request access, correction, or deletion of your personal data by contacting us. Depending on your location, you may also have additional rights under local privacy laws.

10. Updates to This Policy

We may revise this Privacy Policy periodically. The most current version will always be posted on this page with the updated date.

11. Contact Us

If you have questions about this Privacy Policy or our data practices, please contact:

Credenza Labs, Inc.
Email: info@usecredenza.com
Website: usecredenza.com