Privacy Policy
Effective August 2, 2026 · Last updated August 2, 2026
SUPARAIN, Inc. ("SUPARAIN", "we", "us") operates VuDrop, a service that records packing and return-inspection videos for online stores and links each video to the matching shipment. This policy explains what personal data we handle, why, and what rights you have.
1. Our two roles
Which rules apply depends on whose data is involved. We act in two distinct roles:
| Role | Whose data | What it means |
|---|---|---|
| Controller | Merchant account data | We decide how store and account information is used to provide and bill the service. |
| Processor | Order and shipment data belonging to a merchant's customers | We handle it only on the merchant's documented instructions. The merchant is the controller. |
If you are a shopper and want your data accessed, corrected, or deleted, contact the store you bought from. We will assist that store promptly.
2. What we collect
a. When a store connects VuDrop
- Store identifier and store name
- Platform API access tokens
- Contact email for the account
b. Order and shipment data
We read the minimum needed to attach a video to the right shipment. What is available differs by platform:
| Platform | Fields we read |
|---|---|
| Shopify | Tracking number, carrier name, order number and order ID only. We do not read or store the shopper's name, address, phone number, or email. |
| Other platforms | Tracking number, order number, and — where the store's workflow requires it to identify a parcel — recipient name and contact number. |
c. Videos and device data
- Packing and return-inspection video files recorded by the merchant's staff
- Video metadata: file size, duration, recording time, scanned tracking number
- Device name and operating system of the phone or tablet running the app
Videos are recorded by the merchant and may show hands, packing materials, and the shipping label. Merchants are responsible for how they record and what appears in frame (see our Terms of Service).
d. Automatically collected
- IP address, timestamps, and service usage records
- Video viewer access logs (IP address and time a share link was opened)
3. Why we use it, and our legal basis
| Purpose | Data | GDPR legal basis |
|---|---|---|
| Providing the service | Store ID, device info, videos, tracking numbers | Performance of a contract (Art. 6(1)(b)) |
| Matching videos to orders | Tracking number, order number | Processing on the merchant's instructions (Art. 28) |
| Sharing a video with a shopper | Video, share token | Legitimate interests — resolving delivery disputes (Art. 6(1)(f)) |
| Security and abuse prevention | IP address, access logs | Legitimate interests (Art. 6(1)(f)) |
| Billing | Subscription and usage records | Performance of a contract (Art. 6(1)(b)) |
We do not use personal data for advertising, profiling, or automated decisions that have legal or similarly significant effects. We do not sell personal information as defined by the CCPA/CPRA, and we have not done so in the preceding 12 months.
4. How long we keep it
| Data | Retention |
|---|---|
| Recorded videos | Deleted automatically when the plan's retention period ends — Free 14 days, Growth 21, Scale 28, Unlimited 35, Enterprise up to 365. Merchants may mark individual clips to be kept until they delete them. |
| Order matching data | Deleted with the associated video |
| Platform access tokens | Deleted immediately when the app is uninstalled |
| Access and viewer logs | 90 days |
| Store data after uninstall | Permanently deleted after a 7-day grace period |
| Billing records | As required by applicable tax and commercial law |
For Shopify stores, we also honour Shopify's mandatory data requests: we respond to
customers/data_request, delete data on customers/redact, and
erase the store's data on shop/redact, in every case within 30 days of
receiving the request.
5. Who we share it with
We do not sell or rent personal data. We share it only with service providers that help us run VuDrop, under contracts that limit them to our instructions:
| Provider | Purpose | Location |
|---|---|---|
| Cloudflare, Inc. | Application hosting, database, video storage and delivery, security | United States and global edge network |
| E-commerce platform providers | Store integration and, where applicable, billing | Varies by provider |
A video is also disclosed to a shopper when a merchant chooses to send them a share link. We disclose data to authorities only where legally required.
6. International transfers
SUPARAIN is based in the Republic of Korea, and our infrastructure providers operate globally. Personal data may therefore be transferred outside your country, including to the United States and Korea. Where data is transferred out of the European Economic Area or the United Kingdom, we rely on the European Commission's Standard Contractual Clauses or an applicable adequacy decision. Korea has held an EU adequacy decision since December 2021.
7. How we protect it
- Encryption in transit — all traffic uses TLS (HTTPS).
- Encryption at rest — platform access tokens are stored as Fernet ciphertext (AES-128-CBC with HMAC-SHA256); databases and video storage are encrypted by our infrastructure provider.
- Restricted video access — videos are reachable only through an unguessable share token, and are deleted automatically when retention ends.
- Least privilege — access to production systems is limited to staff who need it, and such access is logged.
- Data minimisation — we request the narrowest API permissions that make the product work, and omit customer identity fields from our queries where the platform allows it.
8. Your rights
Depending on where you live, you may have the right to access, correct, delete, or export your personal data; to object to or restrict processing; and to withdraw consent. Under the CCPA/CPRA, California residents may also request disclosure of the categories of personal information collected and may opt out of sale or sharing (we do neither). We will not discriminate against you for exercising these rights.
To exercise a right, email help@suparain.com. We respond within 30 days. If your data was provided to us by a store, we will forward your request to that store, which is the controller.
If you are in the EEA or UK, you may also lodge a complaint with your local supervisory authority. In Korea, you may contact the Personal Information Protection Commission or the Korea Internet & Security Agency's privacy report centre.
9. Cookies
We use only cookies that are necessary to operate the service: a session cookie, a CSRF protection cookie, and a cookie that remembers your language choice. We do not use advertising or analytics cookies. You can block cookies in your browser, but parts of the dashboard will stop working.
Our Shopify app does not rely on cookies at all — it authenticates using Shopify session tokens.
10. Children
VuDrop is a business tool and is not directed to children. We do not knowingly collect personal data from anyone under 16.
11. Changes
We will post any change to this policy on this page and update the date above. If a change materially affects how we handle personal data, we will notify merchants in the dashboard before it takes effect.
12. Contact
| Company | SUPARAIN, Inc. |
| Privacy contact | help@suparain.com |
| Support | help@suparain.com |
A Korean-language version of this policy, written for the Republic of Korea's Personal Information Protection Act, is available at /privacy?lang=ko.