Privacy policy

Who we are

CortexCommerce is operated by JTS Tech Services, based in Maple, Ontario, Canada. On Shopify it installs as the CortexGuard app; on WooCommerce it is a free plugin; for any other store it is the CortexCommerce app. All three are the same service, and this one policy covers them.

For the information described here we are the controller: we decide what is collected and why. Where we update a merchant's own store catalog on their instructions, we act as their processor.

For privacy questions, data requests, or to use any of the rights below, email privacy@cortexcommerce.ai.

What data we work with

Product-catalog data

The titles, descriptions, images and related fields that make up a store's products. This is what we read, enrich and, once you approve it, write back.

Store details

The account and store details Shopify provides when you install the CortexGuard app, the store address you connect for a WooCommerce store, or the store you add to the CortexCommerce app by catalog upload or from your own systems. This includes contact details for the store owner and the secure credentials needed to update your catalog on your behalf. We keep this to what we need to run the account.

CortexCommerce account information

If you create a CortexCommerce account (for a WooCommerce store or any other store): your name, your store or company name, and the email address you sign up with; the billing location you choose (a country, and a province for Canada); the stores connected to the account; the link to your customer record at Stripe once you first pay by card; and your credit balance and credit history. You sign up without a password: you set one from a link we email you, and our sign-in provider keeps it, not us.

Payment information

Shopify stores are billed through Shopify, and we receive no payment details. Accounts in the CortexCommerce app, including WooCommerce stores, pay by card through Stripe Checkout. Stripe collects and holds the card details; we never store them. We receive from Stripe only what we need to run billing, such as whether a payment succeeded and which plan or credit pack it was for. To create your customer record we give Stripe your account email, your name or company name, and your account id. With each checkout we give it your account id, the store id where a plan is for one store, and what you bought. Stripe asks for your billing address at checkout and uses it to calculate tax. Checkout lets a Canadian business enter its GST/HST number, which Stripe stores and we receive on the invoice.

Aggregate storefront traffic counts

Visits per product, broken out by referral source (such as search, social or AI assistants), collected by a lightweight first-party pixel on the merchant's storefront or, for stores connected by product feed, a small script the merchant adds to their site. The script keeps a random, per-tab session id in the browser's session storage so a visit is counted once; we use it only to count and never store it. These counts are aggregate and never identify an individual visitor.

WooCommerce store events

For a WooCommerce store that uses the plugin, the plugin sends us page-view, engagement (time on page and scroll depth) and add-to-cart events, and paid and refunded order events. Page-view, engagement and add-to-cart events hold the page viewed (its path), the referring site, campaign (UTM) tags, search terms typed into the store's search, time on page and scroll depth, the browser's language and time zone, the device class (mobile, tablet or desktop), page load timings, the product and quantity added to the cart, and the visitor's browser user-agent string. Paid order events hold the order number, the time it was created, its status, the order total, the currency, whether a coupon was used (yes or no), the line items (product, variation, quantity and line total), and, when WooCommerce recorded it, the store's own order-attribution data: the traffic source type, campaign (UTM) tags, the referring site's host, the entry page path, the pages and visits in the session, and the device type. Refunded order events hold the order number, the currency, and the refund's number and amount.

The plugin's script sets no cookies and uses no browser storage. We do not store names, email addresses, postal addresses or phone numbers, and the plugin does not send them. No full IP address is stored; for abuse protection, truncated network prefixes may appear in our operational logs. These events are kept for 13 months and then deleted automatically.

The product information we work with is already public on a merchant's online store, so the data we handle is low-sensitivity by design.

What we do not collect

On Shopify, the CortexGuard app does not request, access or store your customers' personal information: their names, email addresses, shipping addresses, orders or payment data. It works with product-catalog data only. The WooCommerce plugin sends only the events listed above, and never customer names, email addresses, postal addresses or phone numbers.

How we use data

• AI enrichment. Product details and your brand profile (voice, tone, examples) are processed by established large language models to write better titles, descriptions, tags and SEO content.
• Review and write-back. Drafts are stored for you to review and approve, then written back to your Shopify catalog, WooCommerce store or other store. Fields you lock are never changed. If you switch on automation, you choose the confidence threshold and limits under which content publishes without a further review step; automation is off unless you turn it on.
• Contacting you. We use the contact details from your install or sign-up to email you about the service: a welcome note, occasional service or account messages and, if you uninstall, a single note about coming back. Tell us to stop at any time by replying to any of them or writing to privacy@cortexcommerce.ai.
• Billing. Through Shopify for Shopify stores, and through Stripe for accounts in the CortexCommerce app. For a Canadian billing location, Stripe calculates sales tax from that location.
• The free allowance. It is given once per account and once per store domain. To enforce the domain limit we keep a one-way hash of each store domain that has used it. The hash cannot be turned back into the domain, but the same domain always gives the same hash, so we can recognise a domain that has used the allowance.

We do not sell merchant data, and we do not use one merchant's data to train AI models or to benefit another merchant.

This website

The contact form

When you write to us through Contact on this site, we receive your name, your email address, the topic if you give one, and your message. It is emailed to our support inbox through our email delivery provider, and we use it only to reply to you. It is never added to a mailing list. Ask us to delete it at any time.

The free scanner and the leaderboard

Anyone can submit a public store address at cortexcommerce.ai/scan and get a 0 to 100 score of how AI crawlers see that storefront. We collect measurements of publicly reachable pages (the same HTML, robots and discovery files an AI crawler would fetch). We never ask for a store password, admin credentials, payment data or a customer list.

If you opt in, we take a contact email so we can send the report link or finish an email-gated full-catalog crawl; you may also give a first name and company. Those fields are never shown on the shareable report. We use them to run the scan, send the report and, because you gave us your email, to follow up about CortexCommerce. Technical request details are used only to rate-limit abuse, never to build a marketing profile.

The leaderboard scores well-known stores from their public pages in the same way. It holds no personal data.

Cookies and analytics

This website asks before it measures anything. Until you choose, Google Analytics is not loaded at all and sets no cookies. If you click Yeah, go ahead on the cookie bar, Google Analytics 4 counts which pages are visited, where visitors came from, and the kind of device and browser used, so we know which pages are useful. We switch on analytics storage only: never advertising storage, and Analytics data is not used for ads. If you click Nah, leave me alone, Google Analytics stays off.

Change your mind at any time with Cookie settings in the footer of every page, or right here: Cookie settings

Declining, or switching off later, removes the Google Analytics cookies from your browser. You can also block or clear cookies in your browser settings.

On a merchant's own store, our storefront traffic pixel, tracking script and WooCommerce plugin set no cookies of ours, and neither does the CortexGuard app itself.

Providers we rely on

We list them by category, and name the ones you deal with directly or whose name you would expect:

• Shopify: the platform your Shopify store runs on, and our billing processor for Shopify stores.
• Stripe: card payments and sales tax for accounts in the CortexCommerce app. Stripe collects card details itself, under its own terms and privacy policy.
• Google Analytics: visit counts on this website, only if you accept cookies.
• A leading cloud infrastructure provider: secure hosting and storage.
• Established AI providers: content generation. Data is processed under their terms and is not used to train their models.
• A sign-in provider: sign-in for CortexCommerce accounts.
• An email delivery provider: the service messages above, and messages sent through the contact form.

We keep the rest of this list at the level of categories so it stays accurate as tooling changes. If you need the other providers named, for example for a vendor-security review, email privacy@cortexcommerce.ai and we will send the current list.

Where data is stored, and international transfers

Merchant and account data is stored in the United States, kept separate and isolated for each merchant so that one merchant can never reach another's. Scanner reports and any contact email you give on the scanner are also stored in the United States.

If you are in the European Economic Area, the United Kingdom or Switzerland, your data is transferred outside your region. We make those transfers under the safeguards our providers offer, including standard contractual clauses where they apply.

Keeping and deleting data

Which path applies depends on where your store runs.

• Uninstalling the CortexGuard app on Shopify: the store is marked uninstalled at once and all its data is scheduled for permanent deletion 48 hours later. About 48 hours after uninstall, Shopify also sends a shop/redact request, which permanently deletes all stored product and settings data. If you reinstall before it arrives, deletion is skipped and your data is kept.
• Disconnecting or deactivating the WooCommerce plugin ends our access: the plugin revokes the store's WooCommerce keys and tells us, and we delete our copy of them. It does not by itself delete the store's data. To do that, remove the store from your account or delete the account.
• Removing a store from your CortexCommerce account is treated like an uninstall: the store is marked removed at once and its data is deleted 48 hours later. If the store is on a paid plan, its Stripe subscription is cancelled at once, so it is not charged again.
• Delete my account (Settings in the CortexCommerce app) erases the whole account: the account, the record linking your email to it, your user record, your credit history and the records of service emails we sent you. It deletes your sign-in, cancels any Stripe subscription, and starts permanent deletion of each connected store's data straight away, without the 48-hour wait. It does not delete a Shopify store's data: that stays until you uninstall the CortexGuard app, and is then deleted as above.
• What we keep after you delete your account: the one-way hash of each store domain that used the free allowance, and the identifiers of the Stripe events we processed, which hold no personal data. Stripe keeps the customer and invoice records it holds for tax purposes, under its own policies.
• Shopify customers/data_request and customers/redact: because we store no end-customer personal data, there is nothing to return or erase; these requests are acknowledged and logged.
• Scanner reports are kept so shared links keep working. A contact email given on the scanner, and messages sent through the contact form, are kept until you ask us to delete them.

You can ask for deletion at any time by uninstalling the app, removing a store or deleting your account in the CortexCommerce app, or by emailing privacy@cortexcommerce.ai.

Security

Data is encrypted in transit, access is authenticated and scoped to each merchant, every platform request and webhook is cryptographically verified, and credentials are held in secure managed storage. Each merchant's data is isolated so that one merchant can never reach another's.

Your rights

Wherever you are, you may ask for a copy of the personal data we hold about you, or ask us to correct it, delete it, or stop using it for a particular purpose, including our service and product messages. Email privacy@cortexcommerce.ai and we will respond within the time your local law allows.

Depending on where you live, those rights come from the GDPR and UK GDPR (Europe and the UK), PIPEDA (Canada), or state privacy laws such as the CCPA (United States). We do not sell personal information under any of them. If you are in the EEA or the UK and are not satisfied with how we handled your request, you can complain to your local data protection authority.

Changes to this policy

We may update this policy as the service changes. Material changes are reflected in the "Last updated" date above and, where required, told to merchants. The terms of service are at cortexcommerce.ai/terms.