Privacy Policy

Last Updated: January 2025

1. Information We Collect

1.1 Store Data

When you install Algoboost, we access the following data from your BigCommerce store via OAuth:

• Store Information: Store name, store domain, store ID
• Product Data: Product names, SKUs, prices, images, and availability (read-only)
• Order Data: Order IDs, order totals, product purchases (read-only)
• Cart Events: Cart additions and removals (read-only)

1.2 What We DO NOT Store

We are committed to privacy-first design:

• ❌ No Customer PII: We do not store customer names, email addresses, phone numbers, or addresses
• ❌ No Payment Information: We never access or store credit card or payment details
• ❌ No Tracking Beyond Events: We do not track individual customer behavior across sessions
• ❌ No Data Selling: We never sell or share your data with third parties

1.3 Meta Pixel Configuration

You provide us with:

• Your Meta Pixel ID
• Meta Conversions API Access Token (optional, for CAPI tracking)

2. How We Use Information

We use the collected data solely for the following purposes:

2.1 Meta Pixel Event Tracking

• Send PageView, ViewContent, AddToCart, InitiateCheckout, and Purchase events to Meta
• Include product information (name, price, SKU) in tracking events
• Send order totals and product details for conversion tracking

2.2 Product Catalog Feed

• Generate XML feed of your products for Facebook & Instagram Shopping
• Update feed automatically when products change

2.3 Dashboard Analytics

• Display event history and tracking statistics in your dashboard
• Show usage metrics for billing purposes

3. Data Sharing and Third Parties

3.1 Meta (Facebook)

Event data is sent directly to Meta via:

• Meta Pixel (Browser): JavaScript tracking code installed on your storefront
• Meta Conversions API (Server): Server-to-server event transmission for Pro plan users

This data is governed by Meta's Privacy Policy.

3.2 BigCommerce

We access your store data via BigCommerce's official OAuth API. BigCommerce's privacy policy applies to data stored on their platform.

3.3 Hosting and Infrastructure

• Heroku: Application hosting (Salesforce subsidiary, GDPR compliant)
• PostgreSQL: Database for storing app configuration only (no customer PII)

3.4 No Other Third Parties

We do not share your data with any marketing platforms, analytics services, or data brokers.

4. Data Retention

• Event History: Stored for up to 30 days for dashboard display, then automatically deleted
• Store Configuration: Retained while your app is installed
• Uninstallation: All data is automatically deleted within 7 days of app uninstallation

5. Data Security

We implement industry-standard security measures:

• Encryption: All data transmission uses HTTPS/TLS encryption
• OAuth Authentication: Secure token-based authentication with BigCommerce
• Access Control: Limited employee access to production systems
• Regular Updates: Security patches applied promptly

6. GDPR Compliance

For users in the European Union:

• Legal Basis: We process data based on legitimate interest and contractual necessity
• Data Minimization: We only collect the minimum data necessary for service functionality
• Right to Access: Request a copy of your data by emailing support@algoboost.io
• Right to Deletion: Request data deletion at any time (or uninstall the app)
• Right to Portability: Export your configuration data on request

7. CCPA Compliance (California)

For California residents:

• No Sale of Data: We do not sell personal information
• Disclosure: We disclose data collection practices in this policy
• Right to Deletion: Request deletion at support@algoboost.io
• Non-Discrimination: Equal service regardless of privacy rights exercise

8. Cookies and Tracking

Algoboost uses minimal cookies:

• Session Cookies: For app authentication and dashboard functionality
• Meta Pixel Cookies: Set by Meta's JavaScript pixel (governed by Meta's policy)

No advertising or analytics cookies are used by Algoboost.

9. Children's Privacy

Algoboost is designed for businesses and is not intended for children under 13. We do not knowingly collect information from children.

10. International Data Transfers

Data may be transferred to and processed in the United States where our servers are located. We ensure adequate safeguards are in place for international transfers.

11. Changes to This Policy

We may update this privacy policy from time to time. Material changes will be communicated via:

• Email notification to app administrators
• In-app notification
• Updated "Last Updated" date at the top of this policy

12. Your Rights and Choices

You have the right to:

• Access your data
• Correct inaccurate data
• Request data deletion
• Opt-out of tracking (by uninstalling the app)
• Export your data

13. Contact Us

For privacy-related questions or requests:

14. Compliance Certifications

• ✅ GDPR Compliant
• ✅ CCPA Compliant
• ✅ BigCommerce App Marketplace Certified
• ✅ SOC 2 Type II (Infrastructure provider: Heroku/Salesforce)