Privacy Policy

This Privacy Policy explains how Invoxion AI Solutions ("Invoxion", "we", "us"), a South African business based at 39 Niven Avenue, Douglasdale, Johannesburg, South Africa, handles personal information in connection with:

• CreatorMargin AI, our app for Shopify stores (the "App"); and
• creatormargin.invoxion.com, our website (the "Website").

If you have questions, email creatormargin@invoxion.com.

• Merchants and their staff. When a Shopify store installs the App, we are responsible for the account and usage information we collect about the store and its staff.
• The store's customers. The App reads order information from the merchant's Shopify store. For that information, the merchant decides why it is processed, and we process it on the merchant's behalf and on their instructions. If you are a customer of a store that uses the App, please contact that store first. We will help the store respond to your request.
• Creators. Merchants can record creators they work with, and CreatorMatch can find publicly listed creators. Section 5 explains what this involves and how a creator can ask us to remove their details.

The App connects to a Shopify store with read-only access to orders and products. It cannot change orders, products or customers.

Store and account information

• The store's Shopify domain, name, currency and time zone.
• Access tokens that Shopify issues so the App can read store data. These are deleted when the App is uninstalled.
• The numeric Shopify user ID of the staff member who makes a change in the App, recorded in an audit log so the merchant can see who changed what.
• Subscription status from Shopify: plan, trial end date and billing period. Shopify handles all billing. We never receive or store payment card details.

Order information

For each order, the App stores only what it needs to calculate profit:

• Order number, order dates, cancellation date and whether it is a test order.
• Currency, discount codes used and shipping charged or refunded.
• Each line item: product, variant, title, SKU, quantity, price, discount and any refunds.
• The marketing source of the last store visit before the order: the UTM source, medium and campaign, and the referring website's domain name (never the full referring address).
• Whether the order was the customer's first or a repeat order, stored as a number only.

The App does not store customer names, email addresses, phone numbers, postal addresses or Shopify customer IDs.

Product and cost information

Product and variant titles, SKUs and unit costs from Shopify. The App keeps a history of each variant's unit cost so that every order is costed at the price that applied when it was sold.

Information merchants enter

• Creators: display names, social media handles, the platforms they use and, optionally, follower counts.
• Creator discount codes, and whether the merchant confirmed or dismissed each one.
• Commission rates, campaigns, margin targets and alert settings.
• Expenses: samples, creator fees, ad spend, shipping and other costs, entered by hand or imported from a CSV file. We store the imported rows, the file name and a fingerprint used to detect duplicate uploads. We don't keep the file itself.
• Alert email recipients: up to five email addresses for the store's staff. Alert emails are not being sent yet. We will update this policy and name the email provider before sending begins.

AI features

• AI Profit Assistant. We record that a question was asked, whether it succeeded, which data tools the AI used, the AI model and the number of tokens used. This lets us apply plan limits and track costs. We don't store the text of questions or answers.
• CreatorMatch. We store each search's criteria, the product searched for, the results and their sources, and summary usage figures.
• Outreach drafts. We store the drafts the AI writes and the staff member who requested them.

We use the information above only to:

• provide the App's features: profit analysis, attribution through creator codes the merchant has confirmed, Commission Safety, Preflight, CreatorMatch, the AI Profit Assistant and alerts;
• apply plan limits and confirm the store's subscription with Shopify;
• keep an audit trail of changes that affect financial results;
• secure the App, prevent abuse and fix problems;
• reply to support requests; and
• meet legal obligations, including Shopify's privacy requirements.

We do not sell personal information. We do not use store data for advertising, and we do not combine one store's data with another's. Each store's data is kept separate and is used only for that store.

The AI features use the OpenAI API, provided by OpenAI, L.L.C. in the United States.

• AI Profit Assistant. We send OpenAI the merchant's question and the figures the App has already calculated for that store, such as creator, campaign and product totals. Those figures can include creator names and product titles. We don't send customer names or contact details.
• CreatorMatch. We send OpenAI the search criteria: product, platform, location, niche, follower range and engagement. OpenAI then searches the public web.
• Outreach drafts. We send OpenAI the facts needed to write a draft, such as the creator's public profile details, the product and the suggested commission.

We ask OpenAI not to store these requests (the API's store: false setting). Under OpenAI's API terms, API data is not used to train OpenAI's models by default. OpenAI may keep requests for a limited time to monitor for abuse, under its own policies.

AI output can be wrong. The App's figures come from its own calculations, not from the AI, and the Assistant is instructed to use only those figures.

Creators that merchants add. A merchant can record the creators they work with: name, handles, platforms, optional follower counts, discount codes, commission rates and fees paid. The merchant is responsible for having a lawful basis to record this information.

Creators found with CreatorMatch. CreatorMatch searches publicly available web pages for creators who match a merchant's product. For each result we store only public professional details:

• name, handle, platform and profile link;
• location and content niche, where these are public;
• follower count, engagement rate and published rates, kept only when a source the search consulted showed them;
• the sources and a short note on why the creator matched.

We do not store personal email addresses or phone numbers. The App never contacts creators. It writes drafts that the merchant may choose to send themselves.

If you are a creator and want your details removed from CreatorMatch results, email creatormargin@invoxion.com with your profile link. We will delete them from every store where they appear and confirm when it's done.

We share information only with service providers that help us run the App and the Website, and only as needed:

• Shopify (Shopify Inc. and its affiliates): the platform the App runs on, installation and billing.
• Amazon Web Services, Inc.: hosting, database, storage and logs. Our servers are in the United States (us-east-1).
• OpenAI, L.L.C.: AI processing, as described in section 4.
• xneelo (Pty) Ltd: hosting for this Website, in South Africa.

We may also disclose information:

• if the law requires it;
• to protect the rights, safety or security of our users or others; or
• as part of a merger or sale of our business. In that case, this policy would continue to apply to the information.

We are based in South Africa. The App's data is processed in the United States by Amazon Web Services and OpenAI. The Website is hosted in South Africa. These countries may have different data protection laws from yours. When we transfer personal information outside South Africa, we do so as allowed by section 72 of POPIA: the recipient is bound by contract to protect it to a standard substantially similar to POPIA, or the transfer is needed to provide the service you asked for. Where other laws such as the GDPR apply, we rely on appropriate safeguards such as standard contractual clauses.

• While the App is installed: we keep store data so that profit reports can cover the store's history.
• When the App is uninstalled: we delete the store's access tokens straight away. About 48 hours later, Shopify sends us a request to delete the store's data, and we then delete all of it: orders, costs, creators, campaigns, expenses, CreatorMatch results, drafts, settings and audit history.
• When a store asks us to delete a customer's data (through Shopify's customer data request process): we delete the order records linked to that customer.
• Backups and logs: deleted data can remain in encrypted database backups for up to 14 days. Server logs are kept for up to 90 days. Neither is used for any other purpose.
• Waitlist entries on the Website: kept until the App launches, or the plan you asked about becomes available, and then for up to 12 months, unless you ask us to delete them sooner.
• Contact form messages and support emails: kept for up to 24 months after the conversation ends, so we can follow up on earlier requests.

• Data is encrypted in transit (HTTPS) and at rest.
• The database is not reachable from the internet.
• Access keys are kept in a secrets manager, not in code.
• Every request from Shopify is checked to confirm it really came from Shopify.
• Each store can access only its own data, and our automated tests check this.

No system is completely secure. If a breach affects your information, we will notify you and the relevant authorities as the law requires.

• Contact form. If you send us a message, we receive your name, email address, company if you give it, topic and message. We use them only to reply to you.
• Waitlist form. If you join a waitlist, we store your email address, your store address if you give it, the plan you're interested in, the consent text you agreed to and the date. To prevent spam, we keep a scrambled (hashed) version of your IP address for a short time. We never store your actual IP address.
• Cookies. The Website does not use analytics, advertising or tracking cookies. WordPress sets cookies only for site administrators who sign in.
• Fonts. The Website's fonts are served from our own server, so viewing the Website doesn't send your information to font providers.
• Videos. Videos from YouTube load only when you click play, and use YouTube's privacy-enhanced mode (youtube-nocookie.com). Once you play a video, Google's privacy policy applies to it.
• Links to the Shopify App Store take you to Shopify's website, which has its own privacy policy.

Depending on where you live, data protection laws may give you the right to:

• access the personal information we hold about you;
• correct it;
• delete it;
• object to or restrict how we use it;
• receive a copy in a portable format; and
• withdraw consent you have given, such as for the waitlist.

These laws include the GDPR in the European Union, the UK GDPR, South Africa's Protection of Personal Information Act (POPIA) and US state privacy laws such as the CCPA.

To make a request, email creatormargin@invoxion.com. We will reply within 30 days and may need to confirm your identity first. We won't treat you differently for using these rights.

If you are a customer of a store that uses the App, please contact the store first, because it controls your order data. Sections 2 and 8 explain what the App holds.

You may also complain to your local data protection authority. In South Africa, that is the Information Regulator (inforegulator.org.za).

The App and the Website are for businesses. They are not directed at anyone under 18, and we don't knowingly collect information from children.

We will post any changes on this page and update the date at the top. If a change materially affects how we use store data, we will also tell installed merchants through the App or by email.

Invoxion AI Solutions
39 Niven Avenue, Douglasdale, Johannesburg, South Africa

Email: creatormargin@invoxion.com
Information Officer (POPIA): contact creatormargin@invoxion.com