Privacy Policy

1. Scope & Introduction

Celirox AI ("Celirox", "we", "us", or "our") provides intelligent software solutions, including Shopify Applications (such as SmartFlow Checkout and Celirox Store Operator) and the Celirox AI Operator platform—an autonomous operational integrity workforce that connects across multi-platform enterprise software (e.g., Shopify, Stripe, HubSpot, Salesforce, Slack, Klaviyo, QuickBooks, and custom APIs).

This Privacy Policy explains how we collect, use, store, protect, and share data when merchants, enterprise customers, and operators install our applications, connect third-party platforms, or utilize our AI workforce services. By accessing or using any Celirox product or connecting an account, you accept the practices outlined in this policy.

2. Information We Collect

We collect information necessary to deliver operational AI features, execute workflows, enforce business invariants, and support our users:

• Account & Contact Information: Your name, business email address, organization name, store domain, and billing details provided during signup or app installation.
• Integration & OAuth Credentials: Authorization tokens, refresh tokens, store API keys, and scope metadata provided when connecting third-party services (Shopify, Stripe, CRMs, messaging channels) to Celirox.
• Business State & Operational Data: Store configurations, customer records, invoices, subscription statuses, orders, and workflow logs synchronized to construct your Business State Engine and verify invariant rules.
• AI Interaction & Global Memory Data: Custom policy documents, SOPs, prompts, rulebooks, and operational context stored in vector databases (`pgvector`) to inform AI decision-making.

3. OAuth 2.0 & Third-Party Integration Permissions

Celirox AI products utilize OAuth 2.0 authentication and secure API connections to integrate seamlessly with third-party software.

• Scoped Access: We request only the explicit API permissions and scopes strictly required to perform requested tasks, monitor data drift, or execute automated checkout and operational actions.
• AES-256 Token Encryption: All OAuth access tokens, refresh tokens, secrets, and API keys are immediately encrypted at rest using enterprise-grade AES-256 encryption. Credentials are strictly isolated per tenant organization.
• Token Revocation: You retain complete control over your integrations. Disconnecting an application or revoking OAuth permissions from your store or third-party dashboard immediately halts data synchronization and renders associated access tokens void.

4. AI Data Processing & LLM Model Isolation

Our AI Operators and Store Operator features utilize Large Language Models (LLMs) from trusted AI providers (such as OpenAI and Anthropic) to process natural language instructions, generate configuration rules, and analyze operational mismatches.

5. How We Use Information

We use collected information solely for business operational purposes:

• Delivering and operating Shopify checkout extensions, payment rules, shipping customizations, and post-purchase features.
• Monitoring business state invariants, detecting data drift across connected SaaS platforms, and proposing automated reconciliation actions.
• Executing Human-in-the-Loop (HITL) approval workflows via dashboard or connected communication channels (e.g., WhatsApp/Slack notifications).
• Maintaining immutable audit logs for compliance, system security, and troubleshooting.
• Providing technical support, system health alerts, and performance updates.

6. Data Sharing & Third-Party Processors

Celirox does not sell your personal or business data. Data is shared strictly with trusted sub-processors necessary to operate our platform:

• AI Engine Partners (OpenAI / Anthropic): For natural language understanding and operational execution suggestions under strict enterprise data protection agreements.
• PostHog Analytics: For aggregated application usage metrics and diagnostic analytics to improve platform performance. We do not track end-customer identities for advertising.

7. Data Security & Retention

We implement robust administrative, technical, and physical safeguards designed to protect against unauthorized access, loss, or misuse:

• Zero Plain-Text Credential Access: Integration credentials, secret keys, and OAuth refresh tokens are encrypted at rest with AES-256 and kept strictly inaccessible to human eyes.
• Encryption in Transit & at Rest: TLS 1.3 for all data in transit and AES-256 for databases and sensitive credentials at rest.
• Multi-Tenant Isolation: Strict database scoping ensuring that your organization’s business state engine and vector memory cannot be accessed by other tenants.
• Data Retention: We retain data for as long as your account remains active. Upon app uninstallation or account termination, data is purged according to our platform retention schedules and legal obligations.

8. Your Rights & Choices (GDPR / CCPA)

Depending on your location, you have rights regarding your personal information, including the right to access, rectify, export, or delete your data, as well as to restrict processing or revoke OAuth authorizations.

Merchants and enterprise administrators can exercise these rights or request complete data deletion by reaching out to our privacy team.