Privacy Policy

Introduction

Nexus Commerce ("we," "us," or "our") operates the Nexus Commerce platform, including the merchant workspace at app.nexuscommerce.co, our website at nexuscommerce.co, the Nexus Commerce Shopify app, and related services (collectively, the "Service"). This Privacy Policy explains how we collect, use, store, and protect information when you use the Service.

By creating an account, connecting your Shopify store, or otherwise using the Service, you agree to the practices described in this policy.

Effective date: March 13, 2026
Last updated: August 9, 2026

Information we collect

Account information

When you sign up or manage a Nexus Commerce workspace, we collect information such as your name, email address, company or store name, and workspace role. Authentication is handled by Clerk. Payment and billing details are processed by Stripe; we do not store full card numbers.

Shopify store data

When you connect a Shopify store, we access and store data through the Shopify Admin API as needed to operate the Service. Depending on your setup and the work Nexus performs, this may include:

Product catalog data (titles, descriptions, prices, variants, images, inventory, collections); order data (totals, line items, dates, fulfillment status, discount codes); customer data (names, email addresses, order history, tags); abandoned checkout data where applicable; and theme or storefront configuration needed for analysis, recommendations, and deliverables.

We request only the access scopes required for the features you use.

Brand and workspace data

When you provide a storefront URL or connect integrations, we may collect and store brand context used to power Nexus Brain, including public storefront content, logos, fonts, product and page references, style signals, and workspace settings you configure in the dashboard.

Connected integrations

If you connect third-party tools through our integrations layer (for example email, ads, analytics, or support platforms via Nango), we may access read-only signals from those tools to enrich analysis and recommendations within your workspace. We do not access integrations you have not connected.

Usage and workspace activity

We collect information about how you use the Service, including dashboard activity, project and delivery workflow actions, comments and mentions, MCP connection and usage events, approval or rejection of recommended work, and product analytics events in the merchant app.

How we use your information

We use the information we collect to:

Provide and operate the Service, including store analysis, recommendations, scoped deliverables, and workspace collaboration; resolve and maintain Nexus Brain context for your brand; power AI-assisted workflows that prepare work for your review; send transactional and workspace-related communications; manage billing and customer support; improve product performance, reliability, and relevance; and maintain security, fraud prevention, and audit logs.

We do not use your store data to train general-purpose AI models for unrelated products. Your data is used to operate the Service for your account.

How we share your information

We do not sell, rent, or trade your personal information or your customers' personal information.

We share data only with service providers that help us operate the Service, including:

Clerk for authentication and account management; Stripe for subscription billing; Supabase / PostgreSQL for encrypted database hosting; Nango for OAuth connection management; Shopify for store data access through your authorized connection; Anthropic and other model providers for AI analysis and generation within your account; Loops for transactional email delivery; Linear for agency workflow and delivery coordination where enabled; context.dev and related context services for brand resolution; Amplitude for product analytics in the merchant app; and infrastructure providers such as Vercel and Railway that host our applications and API.

These providers process data on our behalf under their own privacy terms and security standards. We select providers that maintain appropriate security controls, such as SOC 2 compliance or equivalent safeguards where available.

Your customers' data

When the Service processes data about your store's customers, we do so on your behalf as a service provider. That data is used only to operate the Service for your account, stored with tenant isolation so other merchants cannot access it, not sold or used for advertising, and deleted after account cancellation according to our retention schedule below.

You are responsible for ensuring your use of Nexus Commerce complies with your own privacy policy and applicable laws regarding your customers' data.

Data security

We use administrative, technical, and organizational measures designed to protect your information, including encryption in transit (TLS/HTTPS), encryption at rest for stored data, tenant isolation by workspace, authenticated access to merchant and API surfaces, encrypted storage of OAuth and MCP credentials where applicable, rate limiting on API endpoints, and human review gates before customer-facing store changes are published where that workflow applies.

No method of transmission or storage is completely secure. We work to protect your data but cannot guarantee absolute security.

Data retention

We retain account and store data for as long as your subscription is active and your connections remain enabled. Synced Shopify data is refreshed on ongoing sync cycles rather than kept as indefinite duplicate history unless needed for an active workflow.

If you cancel your subscription or uninstall the Shopify app, we delete account-associated data within 30 days, subject to limited backup retention by our hosting providers and any legal obligations to retain certain records.

Your rights

Depending on your location, you may have the right to access, correct, delete, or export personal data we hold about you, and to object to or restrict certain processing.

Customer-facing actions prepared by Nexus are staged for your review where that workflow applies. You may approve, edit, or reject work before it ships.

To exercise your rights, contact privacy@nexuscommerce.co.

Your customers' rights

If a customer of your store contacts us directly about their personal data, we will direct them to you as the merchant responsible for that relationship. We will cooperate with you to fulfill valid requests.

Cookies and tracking

The merchant workspace uses essential cookies and local storage needed for authentication and session management through Clerk. We use product analytics in the merchant app to understand feature usage. We do not use third-party advertising cookies or sell browsing data from the Service.

Our marketing website may use standard analytics needed to understand site performance. You can control cookies through your browser settings where applicable.

Third-party services and MCP connections

If you connect Nexus to external AI tools through MCP or other integrations, data shared with those tools is governed by both this policy and the privacy practices of the host you choose (for example Claude, Cursor, or ChatGPT). Only connect tools and accounts you trust for your brand data.

Children's privacy

The Service is intended for business use by merchants and operators. We do not knowingly collect personal information from children under 16.

International data transfers

Your data may be processed in the United States, where our infrastructure and service providers are located. By using the Service, you consent to this transfer subject to the safeguards described above.

Changes to this policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you by email or through the Service. The "Last updated" date at the top of this page shows when the policy was most recently revised.

Shopify app users

If you install the Nexus Commerce app from the Shopify App Store, we access your store through Shopify OAuth credentials managed by Nango, request only the scopes needed for the features you use, comply with Shopify's API Terms of Service and Partner Program Agreement, and delete store-associated data within 30 days after app uninstall unless retention is required by law.

Contact us

Questions about this Privacy Policy or our data practices:

Nexus Commerce
Email: privacy@nexuscommerce.co
Website: https://nexuscommerce.co