Privacy Policy

1. Who We Are

Vonch is operated by LYALIN CO. LTD. We provide cryptographically verified review attestations for e-commerce via our Shopify app. Questions about this policy can be directed to [email protected].

2. Data We Collect

We collect the minimum data necessary to operate the verified review flow:

• Buyer email address — sourced from Shopify order data, used to send a review invitation and to derive a deterministic wallet identity.
• Wallet address — a pseudonymous cryptographic identifier derived via Particle Network authentication. This address is used to sign and anchor the on-chain attestation.
• Order metadata — order ID and product reference, used to link the review to a verified purchase.

We do not collect payment information, shipping addresses, or any data beyond what is listed above.

3. Why We Collect It

The purpose of collection is to establish a verified, fraud-resistant link between a buyer's real purchase and their on-chain review attestation — without exposing personal information publicly. Email and order data remain in our database; only the pseudonymous wallet address is published to the blockchain.

4. Where Data Is Stored

Personal data (email address, order metadata) is stored in Supabase (PostgreSQL), encrypted at rest and in transit using TLS 1.2+. Supabase infrastructure is hosted in certified data centers with SOC 2 Type II compliance.

5. What Goes On the Blockchain

Only the pseudonymous wallet address and a cryptographic hash of the review content are written to the blockchain. No email address, name, or other personally identifiable information is ever published on-chain. In accordance with GDPR Recital 26, a pseudonymous wallet address that cannot be reasonably linked back to an individual without disproportionate effort does not constitute personal data.

6. Data Retention

We retain personal data for as long as the associated merchant account is active on Vonch. Buyers and merchants may request deletion at any time — see Section 7 for details.

7. Your Rights (GDPR)

If you are located in the European Economic Area or United Kingdom, you have the following rights:

• Right of access — request a copy of the data we hold about you.
• Right to rectification — request correction of inaccurate data.
• Right to erasure — request deletion of your personal data. Upon a valid request, we will null your email and name fields in Supabase and rotate your DID key in our decentralized identity layer within 30 days.
• Right to object — object to processing in certain circumstances.

To exercise any of these rights, email [email protected] with subject "Data Request — [your right]".

8. Third-Party Services

We use the following sub-processors: Supabase Inc. (database), Particle Network (wallet authentication), and Shopify Inc. (order data source). Each operates under their own privacy policies and data processing agreements.

9. Changes to This Policy

We may update this policy from time to time. Material changes will be communicated to merchants via the Shopify admin panel or by email. Continued use of Vonch after a policy update constitutes acceptance of the revised terms.

10. Contact

LYALIN CO. LTD
[email protected]