Privacy policy

cistem.ai is operated by Krazy Kreators. We are the data controller for information about you as our customer, and a data processor for the trading records you connect to the service — see section 3, which matters if you have obligations of your own to the people who buy from you.

For anything in this policy, write to [email protected].

Information you give us

• Your name, email address and, if you provide one, a phone number — used to create your account, sign you in, and contact you about the service.
• Your company name and the details needed to invoice you.
• The content of support messages you send us.

Information from the channels you connect

When you connect a Shopify store or an Amazon seller account, cistem.ai reads the records it needs to keep stock, orders and prices in step: products, variants, SKUs, stock levels, prices, orders, fulfilments and returns.

Orders carry information about your customers. We keep this to the minimum the job needs and we do not request more access than that. On Amazon in particular, we hold no restricted personal-information role — so buyer contact details are not sent to us at all, and delivery addresses arrive already reduced by Amazon to city, state and postcode.

Information collected automatically

• Server logs: the requests your browser and the connected channels make, with timestamps and IP addresses, kept so we can diagnose faults and detect abuse.
• A small cookie recording that you signed in on this device, so you are not asked again on every page.

We do not use advertising cookies, we do not run third-party trackers on the application, and we do not sell data to anyone, ever.

The order records inside your cistem.ai account belong to your business, not to us. We process them on your instructions and for one purpose: running the service you are paying for. We do not use them to train models, we do not mine them for our own commercial purposes, and we do not share them with other customers — every account is separated at the database level so one seller cannot see another’s records.

If you are subject to data-protection law in your own market, you are the controller for this information and we act as your processor. Ask us at [email protected] if you need a data-processing agreement.

• To perform our contract with you — running the account you subscribed to, syncing your channels, taking payment.
• Our legitimate interests — keeping the service secure, diagnosing faults, preventing abuse.
• Legal obligation — keeping billing and tax records for as long as the law requires.

We share data only with the services needed to run cistem.ai:

• Razorpay — payment processing. Your card details go to Razorpay directly and are never stored on our systems; we see only whether a charge succeeded.
• Shopify and Amazon — the channels you choose to connect. Data flows both ways by your instruction, which is the point of the product.
• Hetzner — our hosting and file storage provider, in Germany.
• Cloudflare — serves this website and protects it from attack.
• Our email provider — to send you service notifications and password resets.

We will also disclose information if the law requires it. We do not otherwise give your data to anybody.

• The credentials you give us for Shopify and Amazon are encrypted before they are written to the database, so they are not readable from a database copy alone.
• All traffic between your browser, our servers and the connected channels runs over TLS.
• Every account's records are isolated at the database level, enforced by the database itself rather than by application code remembering to filter.
• Access to production systems is limited to the people who operate the service.

No system is perfectly secure. If we ever suffer a breach affecting your data, we will tell you and the relevant authority without undue delay.

We keep your account and trading records for as long as your subscription is open, and for a period afterwards so that an account closed by mistake or by a failed payment can be restored. Billing records are kept for as long as tax law requires.

You can ask us to delete your data at any time and we will, other than records we are legally required to retain.

You can ask us to:

• Show you what we hold about you.
• Correct anything that is wrong.
• Delete your data, subject to section 7.
• Export your data in a machine-readable form.
• Stop processing it for a particular purpose.

Write to [email protected]. We will respond within 30 days. If you are not satisfied with our answer you may complain to your local data-protection authority.

If we change this policy in a way that affects you, we will email you before it takes effect. The date at the top of this page always shows when the current wording came into force.