Privacy Policy

Account information. When you create an account we collect your name, email address, and password (stored as a hash by our authentication provider), along with your company name and workspace settings.

Demo and scan requests. When you request a demo or a free exposure scan we collect what you submit: name, work email, company, role, revenue and SKU ranges, storefront URL, and any message you include.

Billing information. Payments are processed by Stripe. We receive your plan, billing status, and the last four digits of your card; we never see or store full card numbers.

Service data. To operate the platform we store the storefront configurations you connect, the findings our Vulnerability Agent produces, and the purchase events you send to the Purchase Monitor (see Section 03).

Usage data. We collect standard logs (IP address, browser type, pages visited) and use privacy-friendly, cookie-less analytics from Vercel to understand aggregate site usage.

We use the information above to:

• provide, operate, and secure the Service;
• run the scans and monitoring you have authorized, and deliver alerts and reports;
• process payments and manage your subscription;
• respond to support requests and demo inquiries;
• improve the product and develop new detection capabilities;
• send service emails, and — only if you opted in — occasional product updates you can unsubscribe from at any time.

We do not sell your data, and we do not use your data to train AI models.

The Purchase Monitor analyzes order events that you choose to send us. Those events may include personal information about your customers (for example order details, email addresses, or shipping regions). For that data, you are the data controller and x17 acts as a processor: we use it solely to detect abuse on your storefront, per your instructions, and never for our own purposes. We encourage you to send only the fields needed for detection. Enterprise customers can request a data processing agreement at founders@x17.ai.

Part of the Service monitors publicly available sources — deal communities, forums, and social platforms — for chatter about pricing errors and exploits affecting our customers' storefronts. This monitoring targets merchant and product information, not consumer profiles, and we do not build profiles of individuals from these sources.

We share data only with the vendors that run the Service, each bound by their own confidentiality and security obligations:

• Supabase — database and authentication
• Vercel — hosting and analytics
• Stripe — payment processing
• Resend — transactional email and alerts
• Anthropic — AI processing for scans and analysis

We may also disclose information if required by law, or as part of a merger or acquisition (in which case this policy continues to apply to your data).

All data is encrypted in transit and at rest. Access to customer data is restricted to the founders and limited to what is needed to operate the Service. We retain your data while your account is active; when you close your account, we delete your service data within 30 days, except billing records we are legally required to keep.

Depending on where you live (including under GDPR and CCPA), you may have rights to access, correct, export, or delete your personal information, and to object to or restrict certain processing. To exercise any of these rights, email founders@x17.ai — we honor these requests for everyone, regardless of location. We will respond within 30 days.

We use only essential cookies: a session cookie to keep you logged in. Our analytics are cookie-less. We do not use advertising or cross-site tracking cookies.

The Service is for businesses and is not directed to anyone under 16. We do not knowingly collect personal information from children.

If we make material changes, we will notify account holders by email and update the date at the top of this page. Continued use of the Service after changes take effect means you accept the updated policy.

Questions, requests, or concerns: founders@x17.ai.