1. Our role
We determine how information about our website visitors, account holders, and business contacts is used for account administration, security, support, and billing. When processing a merchant's customer information to provide connected commerce features, we generally act on that merchant's instructions. The merchant remains responsible for its customer-facing privacy notices and permissions. If you bought something from a connected store, contact that store first about your purchase or personal information; we assist with requests within our role.
2. Information we receive
Information comes from you, your authorized users, connected platforms, and service infrastructure. What we receive depends on the permissions and features you enable.
- Account and contact information: names, business and store identifiers, email addresses, account roles, authentication identifiers, and information you send to support.
- Connected commerce information: catalog and SKU data, inventory, order identifiers, purchased items, quantities, prices, taxes, discounts, order status, refunds, and shipment or tracking details. Shipping information can include a recipient's name, address, company, and telephone number.
- Connection and usage information: authorization tokens, permission scopes, installation and session records, billing-plan identifiers, order usage, and transaction references. Payment providers handle payment credentials when paid billing is enabled.
- Technical information: network and browser information received when you use the service, access events, security logs, timestamps, errors, and operational records needed to deliver and protect it.
3. How we use information
We use information to authenticate users, connect authorized accounts, process supported commerce operations, keep related records consistent, show activity history, provide support, calculate approved billing usage, prevent abuse, investigate problems, and meet legal obligations. We do not use merchants' customer information for our own advertising or sell it to data brokers.
Operational records are designed to retain necessary commerce fields rather than entire customer profiles. Their standard projections exclude buyer email, payment credentials, and free-form customer notes. Connected platforms may nevertheless supply broader original payloads; those can be processed or retained temporarily for validation, troubleshooting, unresolved work, or an applicable hold. Do not send passwords, card numbers, or unrelated sensitive information through support or product fields.
4. Providers and other disclosures
Cloudflare provides application hosting and storage services. Shopify and marketplaces you authorize exchange information needed for the selected connection. When public account sign-in is enabled, Google Firebase Authentication handles account authentication, email verification, and password-reset features; this is separate from authorizing Shopify store access. Billing providers identified during purchase or approval process paid subscriptions when enabled. Support communications are handled through our business email service.
If you choose Google sign-in, Google provides authentication information such as your account identifier, email address, verification status, name, and profile image when available. We use this information to authenticate and maintain your CommerceOS account.
Authorized service providers receive information needed for their work. Connected commerce platforms also process information under their own terms and privacy notices. We may disclose information to comply with valid legal demands, protect rights and security, or investigate fraud. A merger, financing, reorganization, or sale may involve relevant information, subject to applicable confidentiality and privacy requirements. We do not sell personal information or share it for cross-context behavioral advertising.
5. Cookies and browser storage
Authentication uses necessary cookies or browser storage to maintain sessions and security. Browser storage may also remember interface preferences. The current website does not use advertising cookies or a marketing analytics tracker. Blocking necessary storage can prevent sign-in or connected features from working. If optional tracking is introduced, we will explain it and provide consent or choice where required.
6. Retention and deletion
We retain information for the service relationship and afterward only as reasonably needed for outstanding orders, support, security, billing, dispute resolution, applicable recordkeeping, or legal holds. Retention depends on the record's purpose, age, operational status, and applicable retention settings. Unresolved orders, pending work, or holds can delay routine cleanup.
Uninstalling the Shopify app disables its processing and removes stored connection credentials; it does not itself erase every record immediately. Store-erasure requests remove associated workspace records and archives, with limited billing, duplicate-prevention, and deletion evidence retained when needed. Customer deletion can retain a pseudonymous fingerprint to prevent deleted data from being reintroduced. Such identifiers are not necessarily anonymous. Application access-audit records are scheduled for cleanup after 90 days. Generated customer export files expire after seven days. Backup copies may remain until their applicable expiration or deletion process, and deletion requests must also be respected when restoring data.
7. Security
Application safeguards include HTTPS, access controls, encrypted connection credentials and privacy exports, and minimized access-audit records. Security also depends on provider configuration, account permissions, and operational procedures. No service can promise complete security. Protect your accounts and devices, restrict administrator access, and report suspected unauthorized access to info@sellerydigital.com. We will provide legally required incident notifications.
8. Your rights and choices
Depending on applicable law, you may request access, correction, deletion, or a portable copy; object to or restrict certain processing; withdraw consent; or appeal a request decision. Email info@sellerydigital.com with your request. We may verify identity, store authority, and an authorized agent's permission before acting. Some information must be retained or a request referred to the responsible merchant. We respond within applicable legal deadlines and do not discriminate for exercising protected rights.
Merchants can disconnect accounts and use available access, export, and deletion tools. Customer exports are restricted to authorized merchant administrators; the merchant is responsible for securely delivering them to the verified requester. You may also complain to your competent data-protection regulator. Privacy rights that cannot legally be waived remain fully available.
9. International processing and legal grounds
Our providers may process information outside your state or country, where laws can differ. Where required, transfers and processing must use an applicable legal mechanism and contractual safeguards. For information we control, legal grounds may include providing the requested service, legitimate interests in operating and protecting it, legal obligations, or consent where required. Merchant customer data is processed under authorized instructions and applicable data-processing arrangements.
10. Children and policy updates
CommerceOS accounts are intended for adult business users. We do not knowingly solicit accounts from children under 16. Tell us if you believe a child supplied information directly to us. Merchants remain responsible for lawful handling of their customers' information.
We may update this policy as the service changes. The effective date identifies the current version. We will provide additional notice of material changes and obtain consent where required; a policy update does not remove your statutory rights.