Platform privacy notice

Connect360 collects as little personal data as it can. Names, email addresses, phone numbers and street addresses of the people who buy from our brands are never kept in our databases.

1. Who we are and what this notice covers

Connect360 (16244 E. Skinner Dr., Scottsdale, AZ 85262; "Connect360", "we") is a marketplace that connects ecommerce brands with AI marketing tools, measures what each tool adds to sales, and bills on that measured result.

This notice covers three groups of people:

• Brand users: people at a brand who sign in to the Connect360 client app.
• Shoppers: people who buy from a brand that has connected its store to Connect360. We never deal with shoppers directly; we process limited data about their orders on the brand's behalf.
• Vendor users: people at AI tool companies who sign in to the vendor portal.

Visitors to connect360.app are covered by our website privacy policy.

For shopper data, the brand is the controller and Connect360 is its processor, under the Data Processing Agreement in our brand terms. For everything else in this notice, Connect360 is the controller.

2. Information we collect

We also keep security and audit records of who did what in the platform, and technical logs (for example, the time and address of a request). Logs are written so that access tokens and sign-in codes are masked.

3. If you shop with a brand that uses Connect360

We use a brand's order data to work out which marketing produced its sales, so the brand pays its tools fairly. We don't market to you, and we don't build profiles of you.

• No direct identifiers kept. When an order arrives, we strip your name, email, phone number, addresses, IP address, browser details and order notes before storing anything.
• A pseudonymous key instead. To tell repeat orders from new customers, we replace your customer identity with a one-way hashed key, salted separately for each brand. The key can't be turned back into your details, and keys for the same person differ between brands.
• Holdout tests. To measure whether advertising works, a brand may keep a small random group of its customers out of its ads. If the brand has given us consent to do this, we read that group's email addresses and phone numbers from the store, hash them on the spot, and send only the hashes to Meta and Google so they can exclude those people from the brand's ads. The plain details exist only in memory while this runs and are never stored.
• Ask the brand first. The brand decides how your data is used. Requests to see or delete your data should go to the brand, which can pass them to us through Shopify. You can also contact us directly (section 8).

4. How we use information

AI agents in Connect360 make marketing decisions such as budget changes. They act on campaign-level data, not on decisions about individual shoppers. Every agent decision is recorded with its inputs, and agents can never change invoices or payouts. We don't sell personal data or share it for cross-context behavioural advertising.

5. Who we share information with

We don't sell personal information. Vendors can't see other vendors' data, other brands' data, store orders or the ledger; they see totals for their own tools only.

6. How long we keep it, and how we protect it

We keep personal data only as long as our Data Retention Policy allows. In short:

• Shopper data: a shopper's customer key is erased within 30 days of a deletion request from the store (in practice within minutes). When a brand uninstalls the Connect360 app, all its stores' customer keys are erased once Shopify sends the shop deletion request, 48 hours after the uninstall.
• Order amounts and invoices are kept for 7 years, without any customer key, as financial and tax records.
• Brand and vendor user accounts: for the life of the account, then 12 months.
• Logs: 1 to 3 months. Backups: up to 1 year, then deleted automatically.

Data is stored in the United States (AWS, Ohio). It is encrypted at rest and in transit. Each brand's data is walled off from every other brand's inside the database itself. Store access tokens are kept in a dedicated secrets vault, never in the database. Staff need multi-factor sign-in, and the operations console is closed to the public internet.

7. Your rights

Depending on where you live (for example the EU, UK, California and other US states), you may have the right to:

• know what personal data we hold about you and get a copy;
• correct it;
• delete it;
• object to or restrict some uses;
• withdraw consent where we rely on it;
• complain to a data protection authority.

Brand and vendor users: email privacy@connect360.app. We reply within 30 days and may need to confirm your identity first.

Shoppers: contact the brand you bought from. Shopify passes your request to us automatically, and we act on it within 30 days. Because we hold no names or emails, we can confirm what we hold about you only through the brand's store. You can also email us, and we'll work with the brand.

We won't treat you differently for using these rights.

8. Transfers, children, changes and contact

• International transfers: our data is stored in the United States. Where we transfer personal data from the EU or UK, we rely on the European Commission's Standard Contractual Clauses (and the UK addendum) or another lawful mechanism.
• Children: Connect360 is a business service and isn't directed at children under 16. We don't knowingly collect their data.
• Changes: we'll post updates here and change the date at the top. For material changes, we'll tell brand and vendor users by email before they take effect.
• Contact: Connect360, 16244 E. Skinner Dr., Scottsdale, AZ 85262, privacy@connect360.app.