Privacy Policy

From merchants who sign up directly: business name, email address, phone number (optional), password (stored as a bcrypt hash — never the plaintext), branding (logo, theme colour), subscription tier, billing transaction references.

From connected commerce platforms (Shopify, WooCommerce, Custom API, CSV import): orders and the customer details on those orders — customer name, email, phone, shipping address, line items, totals, fulfilment status. We also receive shop-level metadata (shop name, plan, primary currency).

From operational telemetry: call-centre call logs (tied to orders), webhook delivery audit trail, fraud signals (phone + address fingerprints, stored as one-way SHA-256 hashes — never reversible to the original number / address), tracking events from courier integrations.

From the storefront behavior tracker (optional, opt-in by the merchant): anonymised browsing + cart-intent events tied to a hashed visitor identifier. Identity is resolved to a known customer only when the visitor submits their phone or email on the merchant’s site.

Strictly to deliver the contracted service: order management, COD order verification (operator-driven review of high-risk orders), customer outreach (recovery / call-centre), courier dispatch, analytics for the merchant. We do not sell merchant or customer data to anyone, ever.

We aggregate anonymised usage telemetry across merchants to improve the product (for example, to set sensible defaults for fraud scoring weights). Aggregated metrics never reveal individual merchants or customers.

Production data lives in a managed MongoDB cluster with at-rest encryption. Access tokens (Shopify, WooCommerce consumer keys) are encrypted with AES-256-GCM before being written to the database; the decryption key lives in a separate secret store and rotates on a defined schedule.

Passwords are stored as bcrypt hashes with a per-installation salt. We never see, log, or transmit plaintext passwords. Sessions use HTTP-only signed cookies with CSRF double-submit protection.

All inbound webhooks (Shopify, WooCommerce, custom API) are verified via HMAC-SHA256 over the raw request bytes before any database write. A 5-minute freshness window blocks replay attacks using captured payloads.

Merchant data is retained for the lifetime of the merchant’s subscription. When a merchant uninstalls our Shopify app, Shopify notifies us via the shop/redact webhook 48 hours later, after which we delete every row tied to that merchant — orders, calls, tracking, fraud history, audit log, the integration row itself.

Webhook delivery records (the audit trail of incoming events) are retained for 90 days for debugging and SLA verification, then purged.

Aggregated, fully-anonymised analytics may be retained indefinitely.

If a customer of one of our merchants asks the merchant for their data, the merchant relays the request to Shopify, which forwards us a customers/data_request webhook. We log the request to our audit trail (shopify.gdpr_webhook and shopify.gdpr_dispatch events). Per our processor / controller relationship, the merchant fulfils the data subject access request using the data they hold; we are available to them to extract additional context if needed.

If a customer asks to be erased, Shopify forwards us a customers/redact webhook. Within 30 days of receipt we pseudonymise that customer’s identifying fields across our order, call-log, recovery, tracking, audit, and webhook inbox collections, and hard-delete identity-pivoted rows (recovery tasks, tracking sessions, matching webhook-inbox entries). Aggregated analytics remain because they no longer identify the individual.

A customer who wants to skip the merchant and contact us directly may email privacy@confirmx.ai.

We use the following third-party processors. Each handles only the data necessary for its named purpose, under contractual data protection commitments.

• MongoDB Atlas — primary database hosting.
• Stripe — subscription billing. Card details never reach our servers; we receive only an opaque customer / subscription id.
• Twilio / SendGrid — transactional SMS and email. Recipient phone / email only; never order or payment details.
• Shopify, WooCommerce — merchant has authorised the bidirectional sync.
• Cloud hosting provider — runs our API and web tier. No application data is stored in their object storage outside the database.

Our dashboard uses session cookies for authentication and CSRF protection. We do not use third-party advertising or analytics cookies on our dashboard. Our marketing site uses minimal first-party analytics for traffic counts.

The optional storefront behavior tracker that merchants can install on their own site uses cookies only when explicitly enabled by the merchant. The merchant is responsible for its consent surface on their storefront.

We will post material changes here at least 30 days before they take effect, and notify active merchants by email. The “last updated” date at the top of this page is the authoritative timestamp.

Questions about this policy or about how we handle data: privacy@confirmx.ai.

For Shopify-mandated privacy webhooks, the receiver is at /api/webhooks/shopify/gdpr on our production API domain.