CommerceForAI

Privacy Policy

Last updated: November 13, 2026

This policy explains how Codehorts LLC ("CommerceForAI", "we", "us") handles personal information when you visit commerceforai.com, join our waitlist, use our dashboard, API or AI-agent tools, or buy from a store that uses CommerceForAI.

1. Two roles we play

  • For our own users (website visitors, waitlist sign-ups, and merchants who use the dashboard or API), we decide how your information is used. This policy covers that.
  • For our merchants' customers (people who buy from a store that runs on CommerceForAI), we process information on behalf of that merchant. The merchant decides how it is used, and their privacy policy applies. If you bought from a store, contact the store about your information. We'll help them respond.

2. Information we collect

Website and waitlist

  • If you join the waitlist: your email address, what you tell us you sell (optional), and which form you used.
  • Website analytics: our public marketing and documentation pages use Google Analytics, through Google Tag Manager, to understand how visitors use the site. Google may set cookies and receives data such as pages viewed, device and browser details, approximate location, and how you arrived. We don't use it in the dashboard, on sign-in pages, or on store pages we host for merchants. We don't use advertising cookies.

Dashboard accounts

  • Your email address, when your account was created, and when you last signed in.
  • Sign-in links and sessions. We store only a one-way hash of each sign-in link and session token, never the token itself. Sign-in links expire after 15 minutes. Sessions last up to 30 days.
  • A single cookie, cfa_session, which keeps you signed in to the dashboard. It's strictly necessary and is set only after you sign in.
  • Team invites: the invited person's email address, who invited them, and when. Invite links are stored only as hashes and expire after 14 days.
  • Connected AI apps: when you connect an app such as Claude or ChatGPT, we store the app's name and registered return address, which store you connected and with what access, and when it was last used. Access and refresh tokens are stored only as hashes.

Store and integration details (from merchants)

  • Store settings: name, currency, country, ship-from address, shipping rates, storefront and policy URLs, email sender details, checkout settings, and the status of any ChatGPT shopping application you record.
  • Your Stripe connected account ID and its onboarding status. Stripe collects your business and identity information during Stripe's onboarding. We don't receive or store your bank account or identity documents. When you provide personal data in connection with Stripe onboarding, Stripe receives that personal data and processes it in accordance with Stripe's Privacy Policy.
  • API keys you give us for services you connect (Printful, Printify, EasyPost, Shippo, Resend, and Stripe keys for stores set up before Connect). These are encrypted at rest. A Shopify access token you give us for an import is used for that import and not stored.
  • Your CommerceForAI API keys. We store only a hash of each key, plus its first 12 characters so you can tell keys apart, and when it was last used.

Order and customer information (processed for merchants)

  • Customer name, email address, and shipping address.
  • What they ordered, prices, and any customization they entered (for example, a name or a list of places to print on a shirt), plus links to the related print artwork.
  • Payment references from Stripe (for example, payment and checkout IDs, amounts, refund amounts). Card details are collected and stored by Stripe, not by us.
  • Fulfillment details: shipping labels, carriers, tracking numbers, returns, and a log of the order emails sent.
  • Order emails we send for a merchant: if a store hasn't connected its own email provider, we send its order emails to the customer from a CommerceForAI address, and the store owner's email is set as the reply-to address. We keep a copy of each email we send.
  • Customer lists and reports: we build each store's customer list, sales reports and sales-tax reports from its orders. The merchant can see them.
  • Unfinished-checkout reminders: if a merchant turns these on and a shopper enters an email at checkout but doesn't finish, we send one reminder for the merchant. Every reminder has an unsubscribe link, and we keep a list of addresses that unsubscribed from each store so we don't email them again.
  • Store pages we host: when a shopper uses a store page on commerceforai.com, their cart is kept in their own browser's storage, not on our servers, until they check out. These pages don't use analytics or advertising cookies.
  • Images and files: product images and print artwork a merchant uploads, or asks us to copy from a link, are stored and served from cdn.commerceforai.com. Anyone with a file's link can view it.
  • Gift cards, invoices and subscriptions: if someone buys a gift card for another person, we store the recipient's email address (and any message) to send them the card. For invoices a store sends, we store the customer's name and email. For subscriptions, we store what the customer subscribed to, when it renews, and whether they've canceled.
  • Private customer pages: order tracking, invoice, subscription and account pages are reached only through links in a customer's emails. A customer can ask a store to email them the link to their account page, which lists their orders at that store.
  • Test orders created with our simulation tool are marked as simulated and aren't sent to anyone.

Technical information

  • Our API logs each request's time, method, path, response status, and duration, with a request ID. It doesn't log request bodies or credentials.
  • Our hosting providers process IP addresses and similar connection data to deliver and protect the Service. We use IP addresses briefly, in memory, to rate-limit abuse.
  • When something fails, an error report is sent to our error-monitoring provider. It contains technical details of the failure, such as the request path, and connection data such as IP address.

3. How we use information

  • To provide the Service: sign you in, run your stores, process orders, send order data to the providers you've connected, send order emails, send team invites, and let the AI apps you connect act on your store.
  • To send you service messages: sign-in links, security notices, and important changes. If you joined the waitlist, we'll email you about access to the beta.
  • To keep the Service secure: prevent fraud and abuse, enforce rate limits, and investigate problems.
  • To support you and improve the Service, using aggregated or de-identified information where possible.
  • To comply with law and enforce our Terms of Service.

We don't sell personal information, and we don't share it for cross-context behavioral advertising.

4. Who we share it with

We share personal information only as needed to run the Service:

Provider What for
Stripe Payment processing, Stripe Connect onboarding, refunds, and sales tax calculation when a merchant turns it on
Railway Hosting the CommerceForAI API (United States)
Supabase Database hosting (United States, us-east-1)
Vercel Hosting commerceforai.com and the dashboard
Cloudflare DNS for commerceforai.com, and storing and serving merchants' images and files
Sentry Error monitoring for the API and website
Google Website analytics on our public pages (Google Analytics, through Google Tag Manager)
Resend Sending sign-in emails, team invites, and order emails to a store's customers
Printful, Printify, EasyPost, Shippo Only when a merchant connects them: printing, shipping labels, and delivery
AI apps a merchant connects (for example Anthropic's Claude or OpenAI's ChatGPT) Only when a merchant connects them: the app can read the store's data, including orders and customer information, and change it if allowed. The app provider's own privacy policy applies.
OpenAI Only if a merchant applies to ChatGPT shopping and sets up feed delivery: product information, never customer information

We also share information:

  • With the merchant: a merchant can see the orders and customer information for their own store.
  • Publicly, when a merchant chooses: if a merchant turns on store pages or product feeds, their product and store information (never customer information) is published, including to AI shopping agents, which can search the store's products and start a checkout for a shopper.
  • For legal reasons: to comply with law or valid legal process, or to protect the rights, safety, or property of our users, the public, or CommerceForAI.
  • In a business transfer: if CommerceForAI is involved in a merger, acquisition, or sale of assets, subject to this policy.

5. How long we keep it

We don't yet delete information automatically on a schedule. Today:

  • Waitlist and dashboard accounts: kept until you ask us to delete them.
  • Store, order, and customer information: kept for as long as the merchant's store exists, and afterwards until the merchant asks us to delete it. Merchants need order records for refunds, disputes and taxes.
  • Team invites and connected AI apps: invite links expire after 14 days; a connected app keeps access until it's disconnected.
  • Request logs: kept by our hosting provider for a limited period and then removed.
  • Backups are overwritten on a rolling basis.

Ask us at any time and we'll delete what we hold about you, except what the law requires us to keep. If we introduce fixed retention periods, we'll update this policy.

6. Security

  • All traffic to commerceforai.com and api.commerceforai.com is encrypted with HTTPS.
  • Third-party API keys are encrypted at rest with AES-256-GCM.
  • CommerceForAI API keys, session tokens, sign-in tokens, invite links, and AI-app access tokens are stored only as hashes.
  • AI apps connect with OAuth 2.1 and PKCE, and each connection is limited to one store and the access you chose.
  • Each store's data is accessible only to that store's members, its API keys, and the AI apps its members connect.

No system is perfectly secure. If we learn of a breach affecting your information, we'll notify you as the law requires.

7. Your choices and rights

  • Waitlist: ask us to remove you at any time.
  • Account holders: you can access, correct, export, or delete your information. Email us at lee@socialsforai.com.
  • Customers of a store: contact the store you bought from. We'll help the merchant with your request.
  • Depending on where you live (for example, California, other US states, the EU, or the UK), you may have rights to know, access, correct, delete, or port your information, and to object to or restrict some processing. We won't discriminate against you for exercising them. We'll verify requests and respond within the time the law requires. You can use an authorized agent where the law allows.

8. Where information is processed

We're based in the United States, and our providers process information in the United States. If you use the Service from outside the US, your information is transferred to the US.

9. Children

The Service is for businesses and isn't directed to children under 16. We don't knowingly collect their personal information. If you believe a child has given us information, contact us and we'll delete it.

10. Changes

We'll post updates here and change the "Last updated" date. For material changes, we'll notify account holders by email or in the dashboard before they take effect.

11. Contact

Codehorts LLC · 1421 B St., Eureka, CA 95501 · lee@socialsforai.com