Privacy policy

Who operates this workspace

Commerce OS is a private brand workspace for Monolith Systems. The legal business entity, public privacy contact, business address, and operating jurisdiction still need the owner’s confirmation. See Business details for the current status. These details and the applicable legal grounds must be finalized before customer data collection or public launch.

Information used and why

• The hosting sign-in service authenticates access. The app receives a stable Site user identifier to keep saved records separate by owner.
• Brand briefs, launch plans, product ideas, creative links, image descriptions, uploads, and upload-rights declarations are saved when you choose to save them. They provide the workspace features you request.
• Demo catalog, creator business names/handles, planning notes, simulated orders, and cart state may be saved in this browser. Use fictional data in simulations. Do not enter card numbers, passwords, health information, identity documents, or unnecessary personal details.
• The host and infrastructure providers process network information such as IP addresses and request/security logs to deliver and protect the service. Their exact log and backup retention schedules have not been verified in this audit.

Tracking and optional content

The application has no installed advertising pixels, behavioral analytics SDK, session replay, or newsletter signup. The Analytics page summarizes workspace records; it is not visitor tracking. Optional external email images are blocked until you explicitly load them. That choice lets Klaviyo’s CloudFront image host receive your IP address and ordinary request information. You can stop future loading with the Block external images control; it cannot undo requests already made.

The app does not sell personal information or share it for cross-context behavioral advertising. No app tracking changes in response to Do Not Track or Global Privacy Control because those tracking activities are not enabled. Reassess these signals and notices before adding advertising or analytics.

Providers and links

OpenAI Sites provides hosting access and deployment services. Cloudflare infrastructure provides application execution, database storage, and private file storage. The operator must confirm the applicable vendor agreements, processing locations, transfer safeguards, and retention arrangements before public operations.

Canva and Google Drive resources are external links, not embedded account sessions. Following a link opens that provider, whose own privacy and sharing settings apply. Existing Klaviyo designs are dated imports. Supabase and Stripe commerce adapters are prepared but are not active production integrations. If enabled later, this notice and the data inventory must be updated before the new processing starts.

Storage, retention, and your controls

Confirmed brand and launch saves remain in the private database; uploaded images remain in private file storage. An automatic server retention schedule and self-service server deletion workflow have not yet been implemented. Do not treat closing a tab or clearing browser data as deleting those records.

The Privacy & launch page lets the signed-in owner export saved brand records and media metadata, and clear Commerce OS browser drafts and demo records. Image files can be opened individually from the private library. Clearing browser data does not delete host logs, backups, server records, or data held by external providers.

Access, correction, deletion, objection, restriction, portability, and complaint rights depend on the law that applies. A verified public request contact and response process must be established before public collection; no unsupported response deadline is promised here.

Children and sensitive information

This is an owner-only business workspace, not a service directed to children. Do not add children’s personal information or sensitive personal data. A future consumer brand needs a separate audience and age-appropriate privacy review.

Updates

The date above identifies this notice version. Material changes in data collection, providers, or purposes require an updated notice and any legally required new choice or consent before the change takes effect.