Privacy policy
Last updated: October 2026
This policy explains what Commerce OS stores, why, and what you can do about it. It covers the people who use the platform (business owners and their teams) and the data those businesses keep in it.
What we store about you
- Account details: name, email, mobile number, password (hashed — we cannot read it), authenticator secret if you turn on two-factor.
- Sign-in records: when you signed in, from which IP address and device, and failed attempts — for security.
- Activity log: what was changed in the business and by whom, so the owner can see who did what.
- Support messages you send us.
What your business stores in the platform
Orders, customers (names, phone numbers, addresses), products, stock, suppliers, staff and payroll if you use those modules. For this data you are the controller and we are the processor: we store and process it only to run the service for you and on your instructions. You are responsible for having the right to store it, including your customers' details.
How it is used
- To run the platform and the modules of your plan.
- To send orders to the couriers and services you connect, using your own accounts with them.
- To send you bills, reminders, security alerts and announcements about the service.
- To fix errors: error reports may include the page and the business involved.
We do not sell data or use it for advertising.
Where it lives
On servers we manage, with encryption in transit. Daily backups are kept off-site in encrypted storage. Uploaded files (tax certificates, builties, employee documents) are stored privately and served only to signed-in users with permission.
Who sees it
- Your team, as far as the owner's roles and permissions allow.
- Couriers, Shopify, messaging and payment services you connect — only what is needed for the order or the sync.
- The platform's own staff, only to support you (opening a business is logged) or to keep the service running.
- Authorities, where the law requires.
Cookies
A session cookie keeps you signed in; a preference cookie remembers choices like the theme. No advertising or tracking cookies.
How long
While the account is open. After the account is closed, data is deleted within 30 days; backups cycle out within the following 30 days. Bills and payment records are kept as long as tax law requires.
Your rights
You can see and correct your account details in the app, download your business's data, ask us for a full copy, and ask us to delete the account. Write to the contact details on the front page.
Changes
Changes to this policy are announced in the app.