Privacy Policy

1) Who operates StatX

LUMISSENCE SRL
CUI: RO49459066
EUID: ROONRC.J12/411/2024
Str. Donath 198, Cluj-Napoca, Romania
Email: matei@statx.dev
Phone: +40 746 259 316

StatX provides a connected analytics application, evidence-based AI-assisted reporting and recommendations, content operations, and technical analytics/measurement services for merchants and other business customers.

2) Our role and whose information we process

For our own website, inquiries, account administration, security and billing, LUMISSENCE SRL generally determines why and how personal data is processed. When a merchant connects a store or other business account and instructs StatX to analyze that data, the merchant generally determines the purposes of processing customer information; StatX processes it on the merchant's behalf, subject to the parties' applicable terms and data protection arrangements. Roles can differ by activity and applicable law.

We process information about website visitors, merchants and their authorized users, and (when authorized) individuals represented in merchant-connected store or analytics data. A merchant remains responsible for its own privacy notices, legal basis, consumer choices and instructions to service providers.

3) Information we handle

A. Website, communications and account information

• Name, business or store name, email, optional phone number, inquiry and support content, and relevant account or billing records.
• IP address, browser and device information, page visits, timestamps, referrers, cookie preferences, operational and security events.
• App-user identifiers, workspace permissions, connected-source status, integration configuration and usage or billing metadata.

B. Shopify merchant and customer information

Depending on merchant-granted permissions, active features and the specific request, Shopify information can include:

• Store and account identifiers, product and variant catalogs, inventory, markets and localization information.
• Order identifiers, order dates, products or line items, quantities, amounts, currencies, refunds, fulfillment and revenue-related reporting data.
• Customer identifiers and limited customer analytics attributes such as order counts, spend, geography and recorded marketing-consent status.
• Customer contact details or other order information when needed for a specifically authorized support lookup, identity verification, or privacy request. Such fields are not required for every analytics feature and are restricted or minimized where possible.
• Merchant questions, saved reports, analysis results, generated drafts, and other content intentionally supplied or requested in the app. Free-form content can itself contain personal data.

Some Shopify analytics capabilities, including native ShopifyQL reporting, are available only when Shopify grants the required permissions and the merchant authorizes them. Requesting protected-data access does not mean every protected field is collected or displayed.

C. Other connected services

Depending on your choices, we may handle Google Analytics 4, Search Console, Google Ads, Merchant Center, Meta and other connected platform identifiers, campaign metrics, search or conversion data, events, configuration details and authorized reporting outputs.

D. Credentials and technical copies

To operate authorized integrations, we may hold access or refresh tokens and source permissions in restricted credential storage. Relevant data can also appear in cloud datasets, staging records, saved results, conversation history, generated artifacts, security/audit logs and provider-managed backup or version history. Data minimization and access controls differ by purpose and copy.

4) Why we process information

• Provide merchant-authorized reports, comparisons, investigations, customer/order support lookups and AI-assisted recommendations.
• Operate requested product, content, localization and technical measurement workflows.
• Maintain integrations, authenticate users, enforce workspace permissions and prevent abuse.
• Respond to support, access, correction and deletion requests; keep necessary request and security evidence.
• Maintain service reliability, troubleshoot errors, manage accounts and billing, and comply with legal obligations.

Depending on our role and the activity, processing may rely on performance of an agreement, a merchant's lawful instructions, legitimate interests such as security and service delivery, compliance with law, or consent where required. For merchant customer data, the merchant is generally responsible for establishing and communicating the applicable lawful basis.

5) AI-assisted processing

StatX uses AI services, including OpenAI, for authorized questions, planning, summarization, recommendations and content generation. Relevant user prompts, constrained query context, source excerpts or model outputs may be processed by those providers to deliver the feature. We aim to limit unnecessary personal information and enforce application-side query and access controls; you should avoid entering unnecessary sensitive details in free-text requests.

AI-generated content can be incomplete or inaccurate and should be reviewed before business decisions, publication or external use. AI processing is not a general authorization to disclose all connected customer records or to make decisions with legal or similarly significant effects on individuals.

6) Google API data and Limited Use

When you connect Google services, StatX accesses Google user data for the features you authorize and request. We request relevant permissions, describe their purposes, apply appropriate access controls, and do not sell Google user data or use it for independent advertising purposes unrelated to the authorized service.

StatX's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Material changes to data use may require an updated notice or renewed authorization.

7) Cookies and website consent

We use necessary storage for website operation and consent preferences, and may use analytics or marketing technologies where permitted. The website offers analytics and marketing choices; non-essential uses requiring consent should remain disabled until that consent is provided. You can change your choices through the site's cookie-preferences controls. Browser settings and applicable privacy signals may provide additional controls.

Website cookie choices are separate from customer preferences managed in a merchant's Shopify store. Merchants must configure their own storefront consent and notices appropriately; connecting StatX does not replace those obligations.

8) Sharing and service providers

We do not sell personal data. We share or make data accessible only as needed for the service, security, legal requirements or a merchant-authorized workflow. Depending on the feature, categories of recipients include:

• Google Cloud and related infrastructure, database, credential-storage and operational services.
• OpenAI and other specifically configured AI processing providers for requested AI-assisted features.
• Shopify, Google and other connected platforms when exchanging authorized API requests and results.
• Communications, customer support, website hosting, payment and accounting providers, as applicable.
• Professional advisers and competent authorities when required by law.

Where required, we use contractual safeguards with processors and restrict access according to the services being delivered. A request to stop an integration does not necessarily revoke access already granted directly to other providers or instantly remove their independent records.

9) Retention, disconnection and deletion

We retain personal data for as long as reasonably necessary for the service, the merchant's instructions, security, dispute handling and applicable legal or accounting obligations. The duration depends on the data category, source, purpose and any valid legal hold or exception; we do not promise a single universal retention period.

Disconnecting an integration can prevent further authorized access, but it is not equivalent to immediate erasure of all historical information. We review relevant raw and derived records, reports, saved content, logs and retained technical copies when processing an applicable deletion request. Nonidentifying financial records and legally required records may be retained where permitted. Backups, cloud-object versions and provider-held copies may be subject to additional retention and recovery controls.

Some deletion and retention operations require identity checks, manual review or separate technical validation, especially for mixed, ambiguous or historical copies. Automated deletion across every copy is not currently represented as fully operational. We will not treat an acknowledged request or account disconnection as proof that all copies were immediately erased. Contact us about a specific request and its status.

10) Shopify customer privacy requests

Shopify merchants can receive customer access or erasure requests through Shopify. StatX is designed to accept the related Shopify privacy notifications and associate them with the correct store and customer where possible. Some responses require merchant verification, secure delivery coordination, legal-retention review or operational resolution before they can be completed.

Merchants should contact matei@statx.dev for assistance with an outstanding request. We do not automatically send a customer's personal data to an email address contained in a webhook. Where Shopify or applicable law establishes deadlines, requests must be managed within those requirements; an incomplete technical workflow is not an exemption.

11) Security

We use measures designed to protect personal information, including HTTPS/TLS for application traffic, restricted authentication and authorization, controlled credentials and cloud storage, logging and safeguards against unauthorized cross-merchant access. We review these controls and their operational configuration as our service evolves. No system can guarantee absolute security.

12) International processing

Some infrastructure, support or AI providers may process information outside Romania or the European Economic Area. Where transfers require safeguards, we assess and use appropriate contractual or other lawful transfer mechanisms. The applicable location can depend on the service and its provider configuration.

13) Your privacy rights

Subject to applicable law, individuals may have rights to access, correction, erasure, restriction, objection, portability, withdrawal of consent, and complaint to a data protection authority. Requests can be sent to matei@statx.dev. When the information was provided by a merchant, we may direct the request to that merchant or assist the merchant in responding; we may need to verify identity before disclosing or deleting records.

14) Changes to this policy

We may update this policy to reflect changes in services, integrations, providers, law or security practice. Material changes will be communicated when required, and the updated version will appear here with its revision date.

15) Contact

Privacy questions or requests: LUMISSENCE SRL, Str. Donath 198, Cluj-Napoca, Romania.
Email: matei@statx.dev
Phone: +40 746 259 316