Privacy notice

This notice describes how the Aindexc seller workspace handles information. Contact the organization administrator who provided your access for privacy questions or requests.

Information the app handles

Your sign-in email, account display name, stores, orders, customer delivery details, research, financial entries and settings are used to provide your workspace. Only enter information you are authorized to process. Do not enter payment-card numbers, bank logins, passwords, access tokens or recovery codes into business records.

Storage and encryption

Supabase provides authentication and database storage; Vercel hosts the app. Passwords are stored by the authentication provider as hashes. HTTPS protects supported connections. Optional end-to-end encryption encrypts workspace content, trash and recovery snapshots before upload. Each user must enable it and safeguard their separate vault passphrase and recovery key. Account metadata, opaque identifiers, relationships and timestamps remain visible to the service. Earlier provider backups may retain plaintext until their retention expires.

Google Sheets and exports

Connecting Google Sheets is optional. It sends a readable copy of a selected store’s saved orders to the spreadsheet you choose, including delivery details. That copy is outside end-to-end encryption and follows Google permissions and version history. Disconnecting or deleting your app account does not delete Google Sheets copies or downloaded exports. Manage those copies separately.

Browser storage and security records

The app uses an organization access cookie and browser storage for sign-in sessions. “Remember me” keeps the login session on that device; business records and vault keys are not stored there. Short-lived Google tokens and decrypted workspace content are held in memory while in use. Application audit logs contain action identifiers and timing, not order bodies, passwords or card details. Hosting and authentication providers may maintain their own operational logs. If configured, Cloudflare Turnstile processes a security challenge on account forms to help prevent abuse.

Retention and deletion

Records remain until you delete them. Trash expires after 3 days; app recovery snapshots expire after 7 days. Permanent deletion removes the item from app recovery copies. Security audit entries are retained for up to 90 days. Account deletion removes your account and live app records, trash and snapshots. Provider backups follow provider retention schedules; the app cannot instantly erase independently retained backups or external copies.

Usage analytics

The app uses Vercel Web Analytics for page-view statistics. App events include only allowlisted section names; order details, search text, account identifiers, query strings and URL fragments are not included in these events. Custom business-data events are disabled. The app skips analytics when the browser signals Do Not Track or Global Privacy Control. Vercel processes technical request information under its own service terms.

Your controls

You can edit records, export an encrypted backup, disconnect Google Sheets, sign out, enable vault encryption or delete your account in Settings. Losing both your vault passphrase and recovery key makes encrypted records unrecoverable through the app. Consult your organization administrator about customer-data requests and applicable handling obligations.