Privacy Policy

This policy explains how Bitrism Technologies LLC ("Bitrism", "we", "us") handles personal information. It covers our website, bitrism.com, and our products: CODIQ and the AI Sales Agent (together, the "Services").

1. Who this policy applies to

• Website visitors: people who browse bitrism.com or email us.
• Merchants: businesses that install or subscribe to our Services, and the people who use them on the business's behalf.
• Shoppers: customers of those merchants. Their information reaches us when they order from, or message, a store that uses our Services.

2. Our role

For merchant accounts and for this website, we are the controller: we decide how that information is used.

For shoppers' information, we mostly act as a processor, also called a service provider, on the merchant's behalf. We handle it to confirm orders, prevent failed deliveries, answer questions and create orders, following the merchant's instructions. The merchant is responsible for its own privacy notice to shoppers.

There is one exception: the cross-store risk signals described in section 5. For those, we decide the purpose and the means ourselves, so we act as a controller.

3. Information we collect

Website visitors

• Technical data: our hosting provider keeps standard server logs, which record your IP address, browser type, the pages you requested and when.
• Emails you send us: your name, email address and whatever you write.

Our website does not use advertising or analytics cookies, and it does not load third-party trackers.

Merchants

• Store and account details from your commerce platform, such as Shopify or WooCommerce: store name, domain, owner name and email address, plan, currency and time zone.
• Your settings, message templates, automation rules and knowledge-base content.
• Connected-account identifiers, for example your WhatsApp Business account, Meta, Google, TikTok or Snapchat. We store the access tokens that link these accounts in encrypted form.
• Billing status. Your commerce platform's billing system handles payment, and we never receive your card details.

Shoppers (processed for merchants)

• Name, phone number, email address and delivery address.
• What was ordered, its value, its payment method and the delivery outcome.
• Messages exchanged with the merchant through our Services on WhatsApp, Instagram, Messenger or web chat, including photos and voice notes the shopper sends.
• Information we derive from the above: a delivery-risk score and band, and an address-quality score.

4. How we use information

• To provide the Services: confirming orders, sending order updates and the messages a merchant has enabled, recovering abandoned checkouts, answering shoppers and creating orders.
• To prevent fraud and failed (RTO) deliveries.
• To send conversion events to advertising platforms, but only where the merchant has connected their own ad account. Email addresses and phone numbers are hashed before they are sent.
• To support, secure, maintain and improve the Services, and to meet our legal obligations.

We do not sell personal information, and we do not use shoppers' information for our own advertising.

5. Cross-store risk signals

CODIQ runs a shared risk network across participating stores. When an order is delivered, refused or returned undelivered, we record that outcome against a one-way cryptographic fingerprint of the shopper's phone number (a keyed hash). We do not record it against their name, address, email or order contents.

A store in the network can ask whether the phone number on an order has a history of failed deliveries. The store gets back a risk band and a short reason. It does not see the shopper's details, their order history, or which other stores they bought from.

• We store counts only, such as orders, confirmed, declined, delivered and returned. We never store order contents.
• No signal is returned until a phone number has at least three orders across the network.
• This information is used only to prevent fraud and delivery failures. It is never used for marketing, and it is never sold.
• A fingerprint is pseudonymous rather than anonymous: it still relates to a person, so we treat it as personal data.

We rely on legitimate interests for this processing. Shoppers have the right to object to it (see section 9). A merchant uses the risk band to decide what to do with an order, such as asking for confirmation, asking for prepayment, holding the order or cancelling it. Those decisions are the merchant's, and shoppers can ask the merchant to review them.

6. Who we share information with

We require our service providers to protect personal information and to use it only to provide their service to us. If our business is ever merged or sold, information may transfer to the new owner under this policy.

7. How long we keep information

• Abandoned checkouts: we remove personal details 30 days after a checkout that never became an order, and 90 days after one that was recovered or dismissed.
• Orders and messages: we keep them for as long as the merchant uses the Service.
• When a merchant uninstalls: we delete their data once their platform sends a deletion request, and in any case within 90 days.
• Risk-network fingerprints and counts: we keep these until erasure is requested, or until the record falls out of use.
• Emails to us: we keep them for as long as we need them to deal with your enquiry.

8. Security

We encrypt data in transit and at rest. Each merchant's data is isolated at the database level, and access is limited to the people who need it. We encrypt access tokens and keep secrets in a managed key service. No system is perfectly secure. If a breach affects you, we will notify you as the law requires.

9. Your rights

Depending on where you live, you can ask us for a copy of your information, ask us to correct or delete it, or object to how we process it, including the risk-signal processing in section 5.

• Shoppers: the fastest route is through the store you bought from, which can send us a data request or a deletion request on your behalf. You can also email us directly. If we delete your information, we also remove your fingerprint and its counts from the risk network.
• Merchants and visitors: email us at the address below.

Write to privacy@bitrism.com. We may need to verify your identity before acting on a request. You also have the right to complain to your local data-protection authority.

10. International transfers

We are a United States company, and our service providers may process information in other countries. Where the law requires it, we use appropriate safeguards for those transfers. We serve merchants worldwide and apply one privacy baseline across every market we operate in.

11. Children

Our Services are for businesses, and our website is not directed at children. We do not knowingly collect personal information from children.

12. Changes to this policy

We will update this policy when our Services or the law change, and show the new date at the top. For significant changes, we will also notify merchants directly.

13. Contact

Bitrism Technologies LLC
Privacy: privacy@bitrism.com
General: info@bitrism.com