1. Scope
This Privacy Policy applies to RedPhinx-operated websites, RedPhinx Commerce, merchant dashboards, hosted storefront infrastructure, subscription and billing flows, integrations and related services.
A merchant may also publish their own privacy policy for customers visiting or purchasing from that merchant's store. Where a merchant determines how customer information is used for its own business purposes, the merchant is responsible for those privacy practices.
2. RedPhinx's Role
Depending on the context, RedPhinx may process information for its own legitimate business purposes, such as operating accounts, subscriptions, security and support, and may also process information on behalf of a merchant to provide the merchant's storefront and commerce tools.
Merchants are responsible for ensuring they have an appropriate lawful basis to collect and use customer information through their stores and connected marketing tools.
3. Information We Collect
Merchant and Staff Account Information
We may collect information such as:
- name, email address and phone number;
- business name, store information and account role;
- login and authentication information;
- subscription, plan and billing status;
- support communications and account activity;
- IP address, browser/device information and security logs.
Business and Store Information
Merchants may provide product information, categories, prices, inventory, images, store branding, custom-domain information, shipping settings, return policies and other store configuration.
Integration Information
When a merchant connects a supported integration, RedPhinx may process configuration details, identifiers, access tokens, API keys, SMTP settings or similar technical credentials required to operate that integration. Sensitive credentials may be encrypted where supported by the platform.
4. Store Customer and Order Information
When a customer places an order or interacts with a merchant's store, RedPhinx may process information on behalf of the merchant, including:
- customer name;
- email address;
- phone or WhatsApp number where provided;
- shipping/billing address;
- order items, variants, quantities and order totals;
- coupon, loyalty, referral and discount information;
- shipping, fulfilment, tracking and return information;
- payment status and payment-provider transaction identifiers;
- marketing or transactional communication preferences where collected.
RedPhinx does not require a customer account for standard guest checkout unless a future feature expressly introduces one.
5. How We Use Information
We may use information to:
- create and manage RedPhinx accounts;
- provide merchant dashboards and storefronts;
- process and maintain subscription status;
- support checkout, order, inventory, shipping, return and refund workflows;
- provide analytics and reporting;
- operate merchant-requested email, WhatsApp, AI or other integrations;
- detect abuse, fraud, security incidents and unauthorised access;
- provide customer support and resolve technical issues;
- maintain platform reliability, backups and logs;
- comply with legal, regulatory and contractual obligations;
- improve and develop RedPhinx services.
6. Legal Basis for Processing
Depending on the applicable law and circumstances, RedPhinx may process personal information because it is necessary to perform a contract, comply with legal obligations, pursue legitimate interests such as security and service improvement, or because consent has been provided.
Where merchants use customer information for marketing, campaigns or other merchant-controlled purposes, the merchant is responsible for obtaining consent or another valid legal basis where required.
7. Payment Information
RedPhinx may integrate with third-party payment processors such as Razorpay or other supported providers. Card, bank or payment credentials may be collected directly by the payment provider rather than by RedPhinx.
RedPhinx may store payment-related references such as payment IDs, order IDs, refund IDs, payment status, amounts and reconciliation information necessary to operate commerce and subscription workflows.
Payment providers process information according to their own privacy policies and terms.
8. Third-Party Integrations
Merchants may choose to connect third-party services including payment gateways, SMTP/email providers, WhatsApp/Meta services, AI providers, analytics platforms and domain services.
When an integration is enabled, RedPhinx may transmit the minimum information reasonably necessary to provide the requested functionality. For example:
- order/customer details may be used for merchant-requested transactional communications;
- WhatsApp messages may be sent through the merchant's connected Meta/WhatsApp account;
- AI prompts may include merchant-provided product or marketing content;
- analytics events may be transmitted to configured analytics services.
Merchants should review the privacy terms of every third-party service they connect.
11. Data Retention
We retain information for as long as reasonably necessary to provide the service, maintain account and transaction records, comply with legal and tax requirements, prevent fraud, resolve disputes and enforce agreements.
Different categories of information may have different retention periods. Security, payment, order and audit records may be retained after an account closes where reasonably necessary or legally required.
12. Security
RedPhinx uses administrative, technical and organisational safeguards designed to protect information against unauthorised access, alteration, disclosure or destruction. These may include authentication controls, access restrictions, encrypted storage of certain integration secrets, logging, rate limiting and security monitoring.
No internet service can guarantee absolute security. Merchants are responsible for protecting their passwords, API credentials, payment credentials and connected-service access.
13. Access, Correction and Other Privacy Rights
Depending on applicable law, individuals may have rights to request access, correction, deletion, restriction, objection, withdrawal of consent or other action concerning their personal information.
If your request concerns information held by a specific merchant through that merchant's store, you should generally contact the merchant first because the merchant may control how that information is used.
RedPhinx may request reasonable verification before acting on a privacy request and may retain information where required or permitted by law.
14. International Processing
RedPhinx and its service providers may process information in locations different from the user's location. Where required, appropriate contractual, technical or legal safeguards may be used for cross-border processing.
15. Children's Privacy
RedPhinx Commerce is intended for businesses and persons legally capable of entering into contracts. It is not designed as a service directed to children. Merchants are responsible for ensuring their own stores comply with applicable requirements if their products or services are directed to younger users.
16. Changes to This Privacy Policy
We may update this Privacy Policy to reflect changes in technology, business operations, legal requirements or RedPhinx services. The current version will be published on redphinx.com with an updated effective date.
17. Contact
Privacy questions or requests may be submitted through the contact methods available on redphinx.com.