Privacy statement

1. Who we are and what this covers

Auditor ("Auditor", "we", "us") is operated by Inflexi Technologies Private Limited, registered at OCAC Tower, Bhubaneswar, India. We publish the Auditor app for BigCommerce stores and the website at auditor.inflexi.com.

This statement covers:

• this website, including the pricing, help and contact pages;
• the Auditor app and its dashboard, as installed in a BigCommerce store;
• emails and support conversations connected to the website or app.
• any additional Auditor features or communications that may be introduced in the future, where applicable.

It does not cover BigCommerce itself, the store that installed Auditor, or any other app in that store. Those are governed by their own privacy notices.

2. Our two roles

This is an important distinction because it determines how different types of information are handled and who you should contact about what.

We are the controller of information relating to the merchant relationship, including information about the account that installs the app, the person who signs up, support communications, billing records, and website analytics. We determine how this information is used, as described in this privacy statement.

We act as a processor for audit history recorded from a store, where applicable. The merchant determines the purposes for which that audit history is collected and used. Audit history may contain personal information about store staff and shoppers because a log entry may identify the person who made a change and the record or resource that was changed. We process this information on the merchant's instructions and in accordance with our terms of service and, where required, a data processing agreement.

We do not use the merchant's audit history for our own independent purposes, sell it, or use it to train artificial intelligence or machine-learning models.

3. Information we collect

3.1 Merchant and account information — we control this

• Store name, store hash or ID, store domain and BigCommerce plan.
• Name, work email address and role of the person who installs Auditor and of any colleague they invite.
• Chosen plan, subscription status, and the billing reference BigCommerce gives us. We never receive your card number — BigCommerce takes the payment.
• Alert recipient addresses you configure.

3.2 Store audit data — the merchant controls this, we process it

When an event happens in the store, BigCommerce notifies us and we record a normalised entry. Depending on the event, an entry can contain:

What we deliberately do not record. Auditor holds read-only permissions and requests only the scopes it needs. We do not receive or store full payment card numbers, CVVs, bank details, or store or staff passwords. Where BigCommerce sends us a field we have no use for, it is dropped before the entry is written.

3.3 Website and support information — we control this

• What you type into the contact form: your name, email, store address, and your message.
• Emails you send to our support, billing, security or privacy addresses.
• Standard server records for this website: IP address, browser and operating system, pages requested, and the time of the request.

3.4 Service records

We keep technical logs of our own systems — request timings, error traces, delivery status of alert emails, and which dashboard features are used. These help us keep the app working and occasionally contain an IP address or a store ID.

4. How we use it

We do not sell personal information, we do not share it for cross-context behavioural advertising, and we do not use store audit data to train machine learning models. Anomaly detection runs on a single store's own data, for that store only.

5. Cookies on this website

This website uses cookies and similar technologies that are necessary for the website and Auditor dashboard to function properly.

These may include a cookie that remembers your cookie preferences and a session cookie used to maintain your session when you sign in to the Auditor dashboard.

We do not currently use advertising cookies or cross-site tracking cookies on this website.

If we introduce analytics, advertising, or other non-essential tracking technologies in the future, we will update this privacy statement and, where required, provide an appropriate consent mechanism before using those technologies.

6. Who we share it with

We share information only with organisations and service providers that help us operate, maintain, secure, and improve Auditor, and only to the extent reasonably necessary for them to provide those services. Where appropriate, we require these providers to process information only on our instructions and to protect it through contractual or other appropriate safeguards.

We may change or add service providers as Auditor develops. If we do, we will select providers that are appropriate for the services they perform and require appropriate safeguards for personal information.

We also disclose information when the law requires it — for example, in response to a valid court order, regulator's demand, or where necessary to establish, exercise, or defend a legal claim. Where we are legally permitted to notify the affected merchant, we will do so.

If Auditor is ever sold, merged, reorganised, or transferred to another organisation, information may be transferred as part of that transaction. Where required, we will provide appropriate notice and ensure that applicable privacy protections continue to apply.

7. Where it is stored

Auditor uses cloud-based infrastructure and service providers to operate the application, store information, and provide related services. Our current infrastructure includes Google Cloud Platform, but we may use or change cloud, storage, security, or other service providers as Auditor develops.

Depending on the services we use and where our providers operate, information may be stored or accessed in India or in other countries. When information is transferred across borders, we take reasonable steps to ensure that appropriate privacy and security safeguards are in place as required by applicable law.

If you have questions about where particular information is stored or the safeguards used for an international transfer, you can contact us using the details provided on our contact page.

8. How long we keep it

When a retention period expires, we delete or securely dispose of the relevant information, unless we are required or permitted by law to retain it for longer. Information may also be retained where necessary to establish, exercise, or defend a legal claim.

Audit entries are designed to be append-only while they exist: individual entries are not intended to be quietly changed or removed. This is a core purpose of an audit log. Where deletion is required, it occurs through the applicable retention or deletion process rather than by silently altering an individual audit entry.

9. How we protect it

• Read-only access. Auditor requests read scopes only and makes no write calls to a store.
• Encryption. In transit with TLS, and at rest on our hosting and database providers.
• Verified events. Every incoming event is checked against BigCommerce's signature before it is written, so a forged entry cannot enter the record.
• Separation. Each store's history is scoped to its own credentials and cannot be queried by another store.
• Least privilege. Our staff access production only when a support or reliability task requires it, through individual accounts with multi-factor authentication, and that access is itself logged.

No system is perfect. If a breach affects your personal information and is likely to put you at risk, we will notify the relevant supervisory authority within 72 hours of becoming aware, and tell affected merchants without undue delay.

10. Your rights

Depending on where you live, you may have the right to:

• Know and access what we hold about you, and get a copy.
• Correct anything inaccurate.
• Delete it, where no legal reason requires us to keep it.
• Restrict or object to a use we base on legitimate interests.
• Portability — receive it in a machine-readable form.
• Withdraw consent at any time, where consent was our basis.
• Not be discriminated against for exercising any of these rights.

Write to auditor@inflexi.com. We answer within one month, and will tell you if we need longer. We may ask a question or two to confirm who you are — never more than we need. You can use an authorised agent.

If we hold your information only as a processor for a merchant, we will point you to that merchant rather than act on the request ourselves, and we will tell you that we have.

If you are unhappy with our response, you can contact the relevant data protection or privacy authority in your country or region, where applicable. We encourage you to contact us first so that we have an opportunity to understand and address your concern.

11. Shoppers and staff of a store using Auditor

You may have reached this page because a merchant told you they use Auditor. Here is what that means for you.

• Auditor keeps a record of changes made in that store. If you are a staff member, entries will name you as the person who made a change. If you are a shopper, an entry may reference your order or customer record, and may hold a value as it was before it was changed.
• The merchant decides what is recorded, how long it is kept, and who at the store can see it. They are the controller.
• So requests about that data — access, correction, deletion — go to the merchant. If you have sent one and heard nothing, write to us at auditor@inflexi.com and we will help you reach the right person and support the merchant in acting on it.

12. Children

Auditor is a business tool and is not directed at children. We do not knowingly collect information from anyone under 16. If you believe a child's information has reached us through a store's audit history, tell us and we will work with the merchant to remove it.

13. Changes to this statement

When we change this statement we update the version and date at the top. For a change that materially affects how we handle information, we email the account contact of every store with Auditor installed at least 30 days before it takes effect. Previous versions are available on request.

14. How to reach us

Terms of service · Contact us · Help centre