Privacy Policy

1. Introduction

CoreXBiz Inc. (“CoreXBiz,” “we,” “us,” or “our”) is a British Columbia corporation that builds and operates software for businesses. This Privacy Policy explains how we collect, use, disclose, and protect personal information when you:

• visit corexbiz.com or create an account there;
• use CoreXBiz AI Workers, our hosted AI service, on its own or inside another platform;
• use our apps and plugins on WordPress/WooCommerce, Shopify, or Wix, including CoreXBiz Core, CoreXUpload Print, and CoreXBiz Price Calculator; or
• contact us or ask for a demo.

We serve businesses in Canada and the United States. We handle personal information in accordance with the Personal Information Protection Act (PIPA) of British Columbia, the Personal Information Protection and Electronic Documents Act (PIPEDA) of Canada, and applicable United States privacy laws.

1.1 Our role

For your account, billing, and our website, we decide how personal information is used (we are the “controller”). When a business uses our products to handle information about its own customers, staff, or contacts, that business decides how the information is used and we process it on its behalf (we are a “service provider” or “processor”). Section 12 explains what this means for merchants and their customers.

2. Personal Information We Collect

2.1 Account information

When you create an account, we collect your name, email address, and password, or the name, email address, and Google account identifier provided when you sign in with Google. Passwords are stored only as secure hashes. If you complete your profile, we may also collect your phone number, billing email, business name and address, and website addresses.

2.2 Payment and billing information

Payments on corexbiz.com are processed by Stripe. Your card details are entered directly into Stripe and are never received or stored by us. We keep your Stripe customer identifier, plan, subscription status, card type, and the last four digits of your card.

2.3 Sign-in and security information

When you sign in, we record the date and time, IP address, browser user agent, and whether the attempt succeeded, to detect and prevent unauthorized access. If you turn on two-factor authentication, we store an encrypted authentication secret.

2.4 License validation (WordPress plugins)

Our WordPress plugins periodically contact our servers to confirm your subscription. Each check sends your license key, site URL, plugin version, and a one-way hashed server identifier. We use this only to confirm that your subscription is active and that the plugin runs on an authorized site.

2.5 Demo requests and inquiries

If you request a demo or contact us, we collect the details you enter in the form, such as your name, email, company, website, job title, country, and role, and use them to respond to you.

2.6 CoreXBiz AI Workers

When you or your team use AI Workers, we collect and store:

• the messages you send, the tasks you give, and the Workers’ replies, reports, and drafts;
• records of work the Workers ran, the steps they took, and the approvals or signatures you gave;
• business information the Workers read from the systems you connect, such as products, orders and order totals, blog content, marketing figures, and bookkeeping records;
• your record of consent to AI processing, which we keep as an unchangeable audit record; and
• for voice conversations, your speech is sent from your browser to our AI provider to be turned into text, and the Worker’s reply is turned into speech. We store the text of the conversation, not the audio recording.

2.7 Google account data

If you connect Google to AI Workers, we ask for access only to the services you choose: Google Analytics (read-only, and optionally the ability to mark key events), Google Search Console (read-only), and Google Ads (to read performance and to adjust budgets, bids, keywords, and campaign status; each change waits for your approval unless you have allowed automatic changes within limits you set, see Section 4). We also receive your Google email address and account identifier. Google access tokens are encrypted before we store them. Section 6 describes how we use Google data.

2.8 Shopify and Wix stores

When you install one of our apps on Shopify or Wix, we receive your store’s identifier and domain, the store owner’s name and email, and an access token for the permissions you approved. Depending on the app, those permissions let us read or create products, and read blog content and orders. When our AI Workers app reads orders, it reads the order identifier, date, total, and customer identifier; it does not request your customers’ names, email addresses, or postal addresses.

2.9 Print files (CoreXUpload Print)

When a shopper uploads an image to a store that uses CoreXUpload Print, the file and its preview are stored either on the merchant’s own WordPress server or, for Shopify and Wix stores and for WordPress stores that choose CoreXBiz cloud storage, in our Google Cloud storage. Files may include information contained in the image itself (for example camera details).

2.10 Website analytics and advertising measurement

corexbiz.com uses Google Tag Manager to manage website tags, and an OpenAI advertising measurement tag to understand how visitors who see our advertising use our website. These tools may collect your IP address, browser and device details, pages visited, and the actions you take, and may set cookies or similar identifiers. See Section 7.

2.11 The CoreXBiz Guide

If you ask the CoreXBiz Guide a question on our website without an account, we store your question and the answer. We set a cookie to apply fair-use limits, and we keep only a one-way hash of your visitor identifier and IP address, not the address itself. The Guide’s answers are prepared by an AI model provided by Anthropic (Section 4).

3. How We Use Personal Information

• to provide, operate, and support our products, including running AI Workers on your instructions;
• to create and manage accounts, process payments, and manage subscriptions and usage limits;
• to verify licenses and deliver software updates;
• to keep our services secure and prevent fraud and abuse;
• to respond to demo requests, questions, and support requests;
• to measure how our website and advertising perform; and
• to comply with law and enforce our agreements.

We do not sell personal information for money. We do not use the business data you connect to our products for advertising, and we do not use it to train AI models.

4. AI Processing

AI Workers use AI models provided by OpenAI to understand your instructions and prepare replies, reports, and drafts. To do this, we send the model the instructions you give and the business information needed for the task, which can include data from Google, your store, or your books. Under OpenAI’s business API terms, OpenAI does not use this data to train its models; it may keep it for a limited time to operate its service and detect abuse.

The CoreXBiz Guide, which answers questions about CoreXBiz on our website and in the app, uses an AI model provided by Anthropic. We send it your question and our product information; it has no access to your business data or connected accounts. Under Anthropic’s commercial terms, Anthropic does not use this data to train its models; it may keep it for a limited time to operate its service and detect abuse.

AI output can be wrong or incomplete. Changes to your books are prepared as drafts and wait for your approval. Changes to your advertising, such as budgets, bids, keywords, or pausing a campaign, also wait for your approval, unless you have allowed automatic changes for that area within limits you set, such as an amount per change and over a day, week, or month. Outside those limits, AI Workers do not make these decisions on their own. We will update this policy before adding another AI provider.

5. Information From Connected Platforms

When you connect a platform (WordPress, Shopify, Wix, or Google), we access only the data covered by the permissions you approve, and only to provide the features you use. You can disconnect at any time from your settings or by uninstalling the app; see Section 9 for what happens to the data.

6. Google API Services: Limited Use

CoreXBiz’s use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular:

• We use Google user data only to provide and improve the features you see and use in AI Workers.
• We transfer Google user data to others only to provide those features (for example, to our AI model provider to prepare a report you asked for), to comply with law, or as part of a merger or acquisition.
• We do not use Google user data for advertising, and we do not sell it.
• We do not use Google user data to train or improve general AI models.
• People at CoreXBiz do not read your Google user data unless you ask us to (for example for support), it is needed for security, or the law requires it.

You can disconnect Google from AI Workers at any time; we then ask Google to revoke our access, delete the stored access tokens, and stop reading from your Google accounts. You can also remove access from your Google Account’s security settings.

Google data we already read stays in your business account after you disconnect: the copy of your Google Ads figures that the Workers use, and the reports, conversations, and work records that contain Google figures. It is deleted when you close your business account, or when you ask us to delete it (Section 11).

7. Cookies and Similar Technologies

corexbiz.com and our apps use:

• Essential cookies: a session cookie, a security (XSRF) cookie, and, if you choose it, a “remember me” cookie.
• Preference cookies: your display mode and whether the sidebar is open.
• Fair-use cookie: used by the CoreXBiz Guide to apply question limits.
• Analytics and advertising measurement: tags managed through Google Tag Manager and the OpenAI advertising measurement tag, which may set their own cookies or identifiers.

You can block or delete cookies in your browser settings. Blocking essential cookies will stop sign-in from working. Our WordPress plugins and store apps do not add advertising or analytics tracking to your shoppers’ browsers.

8. Service Providers

We share personal information with the service providers below, only as needed for them to provide their services to us, and under contractual protections. We do not share personal information with data brokers.

We may also disclose personal information if required by law, to protect rights and safety, or as part of a merger, acquisition, or sale of assets, in which case the information remains subject to this policy.

9. Where Information Is Stored and How Long We Keep It

CoreXBiz is based in Canada. Our cloud services and databases run on Google Cloud in the United States, and some files are stored in Canada. Several service providers are in the United States. Information stored outside Canada may be accessed by courts and authorities there under local law.

We keep personal information only as long as needed for the purposes above:

• Account and billing records: while your account is open, and afterward as required for tax and accounting law.
• AI Workers conversations, work records, and connected business data: while your business account is active, or until you ask us to delete them.
• Google access tokens: until you disconnect Google or close your account.
• Google data already read: while your business account is active, including after you disconnect Google, or until you ask us to delete it (Section 6).
• Shopify and Wix access tokens: deleted when you uninstall the app.
• Print files in our cloud storage: while needed to fulfil the related order, or until the merchant asks us to delete them.
• Sign-in and security records: as long as reasonably needed to protect accounts.
• Consent records: kept as proof of consent for as long as the law requires.

When information is no longer needed, we delete it or make it anonymous. You can ask us to delete your information at any time (Section 11).

10. Security

We protect information with encryption in transit (HTTPS/TLS), encryption of stored access tokens and authentication secrets, hashed passwords, access controls that keep each business’s data separate, and short-lived signed links for file uploads and downloads. No system is perfectly secure; if a breach creates a real risk of significant harm, we will notify affected individuals and regulators as the law requires.

11. Your Privacy Rights

11.1 In Canada

Under PIPA and PIPEDA you may ask to access the personal information we hold about you, ask us to correct it, and withdraw your consent, subject to legal and contractual limits.

11.2 In the United States

Depending on the state where you live (for example California, Colorado, Connecticut, Virginia, or Utah), you may have the right to know what personal information we collect and how we use it, to access it, to correct it, to delete it, and to opt out of the “sale” or “sharing” of personal information for targeted advertising. Our website’s advertising measurement tags (Section 2.10) may be considered “sharing” under some state laws; you can opt out by emailing us or by blocking cookies in your browser. We will not discriminate against you for exercising your rights.

11.3 How to make a request

Email [email protected] or [email protected]. We will respond within 30 days and may need to verify your identity. An authorized agent may make a request for you with your written permission. If your information was provided to us by a business that uses our products, we may refer your request to that business.

12. Information for Merchants and Their Customers

When a merchant uses our products, the merchant is responsible for its own privacy notice to its customers and for obtaining any required consent. We handle the merchant’s customer information only to provide the services and follow the merchant’s instructions.

12.1 WordPress / WooCommerce

Our plugins store most data, including order information and, unless cloud storage is chosen, shopper uploads, in the merchant’s own WordPress database and uploads folder. Temporary upload files are removed automatically after a configurable period (48 hours by default). Our plugins do not yet connect to WordPress’s built-in personal data export and erasure tools; merchants can contact us for help with a customer request.

12.2 Shopify

Our Shopify apps receive Shopify’s privacy requests. When Shopify tells us that a customer asked for their data, or asked for it to be deleted, we provide or delete any of that customer’s personal information we hold for the store within 30 days. When a store uninstalls our app, we delete the store’s access token right away, and when Shopify asks us to erase the store’s data (48 hours after uninstall), we delete the store’s data within 30 days, except records we must keep by law.

12.3 Wix

When a site removes our Wix app, we delete the site’s access token right away and delete the site’s data within 30 days of a deletion request from the site owner, except records we must keep by law.

12.4 Shopper uploads

Shoppers who uploaded files to a store should contact that store first. We will help the store answer the request.

13. Children

Our products are for businesses and are not directed to anyone under 18. We do not knowingly collect personal information from children; if we learn that we have, we will delete it.

14. Changes to This Policy

We may update this policy as our products or the law change. We will post the new version here with a new effective date and, for significant changes, notify account holders by email before the change takes effect.

15. Contact Us

Questions, requests, or complaints about privacy can be sent to our Privacy Officer:

Email: [email protected]

If you are not satisfied with our answer, you may contact the Office of the Information and Privacy Commissioner for British Columbia or the Office of the Privacy Commissioner of Canada. United States residents may also contact their state attorney general.