Privacy Policy

1. About this policy

xTrac AI is an AI-powered seller agent platform operated by iEllipse Technologies (referred to as iEllipse, we, us, or our), a partnership firm registered in India at #26 KHB Colony HIG I Group II Hootagalli, Mysuru, Karnataka 570018. xTrac AI is offered to e-commerce sellers through xtrac.app and through app marketplaces including the Shopify App Store and the Amazon Selling Partner Appstore, and it connects to channels such as Meta (WhatsApp Business & Instagram), Google Workspace, and other seller platforms.

This privacy policy explains how iEllipse collects, uses, retains, and protects data when sellers connect their accounts and use xTrac AI agents.

This policy supplements (and where applicable supersedes) any prior privacy notices for non-xTrac products of iEllipse Technologies.

2. Information we collect

From sellers using xTrac AI

When a seller signs up at xtrac.app we collect:

• Account identifiers: email address, organisation name, role, login timestamps
• Contact details: name, phone number (optional), business address
• Communication preferences and product usage telemetry (clicks, agent invocations, error events)

From the Amazon Selling Partner API (SP-API)

When a seller authorises xTrac AI to access their Amazon Seller Central account, we receive and process the following categories of data through the SP-API:

• Order metadata: order ID, line items, shipping city and state, order status, refund status
• Inventory data: SKU-level stock levels across FBA, MFN, and seller warehouses
• Listing data: product titles, descriptions, images, ASIN-level metadata
• Buyer-Seller Messaging content: only when the seller has enabled the customer support agent

We do not access individual buyer payment details, individual customer login credentials, or any data outside the SP-API scopes the seller has explicitly authorised.

From the Amazon Advertising API (Ads API)

When a seller authorises xTrac AI to access their Amazon Advertising account, we receive and process:

• Advertising profiles, campaign IDs, ad group IDs, keywords, bids, budgets
• Sponsored Products, Sponsored Brands, and Sponsored Display performance reports
• Search term reports and ad placement reports for campaign optimisation

From Shopify (Admin API)

When a seller connects their Shopify store to xTrac AI (via the Shopify App Store or from within xTrac), we receive and process the following through Shopify's official Admin API, limited to the scopes the seller grants at install:

• Store & product data: shop profile, product catalogue, variants, inventory levels, and pricing
• Order data: order IDs, line items, fulfilment and financial status, and totals
• Customer records (Protected Customer Data): name, email, phone, and addresses the seller has stored on Shopify — used only to answer the seller's questions and power the customer-support/ops agents, never sold or shared with third parties
• Shopify Inbox messages, only when the seller has enabled the customer-support agent

With the seller's explicit approval, xTrac AI can also write back to Shopify on the seller's behalf — updating orders, products, and inventory levels, and creating fulfilments. Every write is proposed to the seller and executed only after they confirm it; xTrac never modifies store data autonomously. We do not access individual buyer payment-card details, payouts, bank accounts, or themes.

We access only the scopes the seller authorises at install. A seller can revoke access at any time from Shopify admin → Apps → uninstall xTrac AI, which immediately invalidates our access token.

From other connected integrations

If a seller chooses to connect other channels, xTrac AI may also receive:

• WhatsApp Business: message content the seller has chosen to route through xTrac AI
• Instagram and Facebook Messenger: business inbox messages, comments where the seller has enabled the comment-reply agent
• Google Workspace: Gmail messages, Sheets data, Drive files, Calendar events, only with explicit per-scope consent
• Blinkit, Brand Central, and other marketplace connectors: order, inventory, and campaign data

3. How we use this data

We process seller data only to operate the AI agents the seller has configured. Specifically:

• To answer seller questions about their orders, inventory, listings, advertising performance, and other connected channel data
• To draft replies to customer messages, which the seller reviews and approves before sending (unless the seller has explicitly enabled auto-send within a defined policy)
• To generate daily briefings, anomaly alerts, and recommended actions
• To optimise advertising campaigns within the bid and budget rules the seller has approved
• To provide audit logs of agent actions for the seller to review
• To improve xTrac AI through aggregated and anonymised usage analytics

We do not sell seller data. We do not share one seller data with other sellers. We do not use one seller data to train models that benefit other sellers.

4. Third-party service providers

To operate the AI agents, we send portions of seller data to the following service providers, under data processing agreements that prohibit each provider from using customer data to train their models:

• Anthropic, Inc. (Claude API) for AI inference. Anthropic processes data per its commercial Privacy Policy and does not train models on customer data.
• OpenAI, L.L.C. for AI inference fallback. OpenAI processes data per its Enterprise Privacy commitments and does not train models on customer data.
• Amazon Web Services, Inc. for cloud infrastructure (compute, storage, queueing). Data residency is selected based on the seller marketplace.
• Microsoft Corporation (Azure) for specific cloud services and Container Apps hosting.
• Vercel, Inc. for static site hosting (xtrac.app marketing surfaces).
• Stripe, Inc. and Razorpay for payment processing where the seller subscribes to a paid plan.
• Twilio, Inc. for one-time password delivery (where SMS verification is used).

We do not transfer seller data to any service provider beyond the categories required to operate xTrac AI. We do not enrol seller data in marketing or advertising programmes operated by third parties.

5. Data retention

• Active integration credentials are retained while the seller maintains the connection. Credentials are encrypted at rest using envelope encryption.
• Conversation history (agent reasoning, drafted messages, approval logs) is retained for 90 days by default. Sellers may configure shorter or longer retention from the workspace settings page.
• Aggregated and anonymised analytics may be retained longer for product improvement and capacity planning, but cannot be linked back to an individual seller.
• When a seller disconnects an integration, the associated OAuth refresh tokens are revoked immediately and underlying transient data is purged within 30 days.
• When a seller deletes their xTrac AI workspace, all associated personal data is purged within 30 days, except where retention is required by law (such as for tax and accounting records, retained per Indian statutory periods).

6. Your rights

Sellers and their personnel have the following rights regarding personal data we hold:

• Right of access: request a copy of the personal data we hold about you by emailing support@xtrac.app
• Right of deletion: request deletion of all your data by emailing support@xtrac.app. We will confirm deletion within 14 days, except where retention is required by law.
• Right of correction: update incorrect data through the xtrac.app account settings page, or by emailing support@xtrac.app
• Right to revoke integrations: revoke any integration at any time from the xtrac.app integrations page. Revocation immediately stops all data processing through that channel.
• Right to restrict processing: restrict specific agents from accessing specific data surfaces through the workspace settings page
• Right to portability: request a structured export of your data in machine-readable format by emailing support@xtrac.app
• Right to lodge a complaint: if you believe we have not handled your data lawfully, you may lodge a complaint with the Data Protection Board of India or your local data protection authority

7. Compliance (DPDP, GDPR)

xTrac AI complies with the Indian Digital Personal Data Protection Act 2023 (DPDP Act). Under the DPDP Act, iEllipse Technologies is the Data Fiduciary for seller personal data processed through xTrac AI.

For sellers in jurisdictions covered by the EU General Data Protection Regulation (GDPR), we honour data subject rights under GDPR Articles 15-22. iEllipse Technologies is the Data Controller (under GDPR) for seller data processed through xTrac AI. Our service providers act as Data Processors. Data transferred outside the European Economic Area is protected by Standard Contractual Clauses.

For sellers in California, we honour rights under the California Consumer Privacy Act (CCPA) as amended, including the right to know, the right to delete, the right to correct, and the right to opt out of sale (we do not sell personal data).

8. Security

We implement industry-standard technical and organisational measures to protect personal data, including:

• TLS encryption in transit for all data flows
• Envelope encryption at rest for OAuth tokens, secrets, and sensitive personal data using AWS KMS or equivalent
• Least-privilege access controls for engineering and support personnel
• Audit logging of all data access by personnel
• Regular security reviews including third-party penetration testing
• Vendor security review before onboarding new service providers

If a personal data breach occurs that is likely to result in a risk to seller rights, we will notify affected sellers and the relevant supervisory authority within 72 hours of becoming aware of the breach, as required by DPDP, GDPR, and applicable laws.

9. Cookies

xtrac.app uses a small number of strictly necessary cookies to maintain seller login sessions and remember workspace preferences. We do not use third-party advertising cookies on xtrac.app. The xtrac.app domain does not run advertising trackers.

The session cookie is named xtracai_session and is set with HttpOnly, Secure, and SameSite=Lax flags. It is required for the application to function and cannot be disabled while logged in.

10. Changes to this policy

We may update this privacy policy from time to time. When we make material changes we will notify registered sellers by email and update the Last updated date at the top of this page. Continued use of xTrac AI after a material change constitutes acceptance of the revised policy. Sellers who do not agree with a revised policy may revoke their integrations and delete their workspace at any time.

11. Contact