This policy explains what data Arxos (operated by Midfluence LLC, a Delaware limited liability company) collects when you use joinarxos.com, how we use it, and the choices you have. We wrote this to be readable. If anything is unclear, email privacy@joinarxos.com and we'll explain in plain English.
1. Who we are
Arxos is a software service that runs back-office work for ecommerce businesses: customer support (a chat on your store and your support email), inventory and purchase orders, finance and reporting, and a workspace for your team. The service is provided by Midfluence LLC ("Arxos," "we," "us"), 221 North Broad Street, Suite 3A, Middletown, DE 19709, USA.
2. Data we collect
2.1 Account data
When you sign up, our identity provider Clerk collects your name, email address, and (if you choose) a password or third-party login (Google, etc.). We never see or store your password directly.
2.2 Connected-store data
If you connect a Shopify store, we receive an OAuth access token granting read access to orders, products, inventory, and customers in your store, plus write access used for changes you make or approve in Arxos (for example, a stock count or an order edit) and for the changes the chat makes on its own for a customer who proves an order is theirs: correcting the shipping address before it ships, swapping an item for one of the same price that is in stock, and cancelling the order while it has not shipped and is inside your return window, which refunds the payment through your store. Every other refund, and every purchase order, happens only when you approve it. We store this token encrypted at rest (AES-256-GCM) and only use it on your behalf.
If you connect Amazon Seller Central, we receive read-only access to your orders, FBA inventory, and fees through Amazon's Selling Partner API.
2.3 Email data
When you forward your support inbox to Arxos or connect a mailbox, we read incoming messages to sort them and draft replies. Replies are sent when you approve them, or on their own for the topics you switch to send automatically, or, at the higher autonomy settings you choose, for every topic that has earned it; each such send waits in your inbox first with a Stop button. If you turn on the auto-responder, customers get a short “we got your message” email on arrival. Replies go out from your own domain through our email provider, Postmark. Arxos does not store email passwords: you forward your support mail to Arxos instead of connecting a mailbox.
2.4 Content you provide
Brand guidelines, support policies, supplier information, purchase orders, financial entries (bank balances, credit cards, loans), and anything else you type into Arxos is stored to deliver the service.
2.5 Usage + diagnostic data
Server logs (IP address, request path, timestamps, error traces) and a record of what the service did for your account, for debugging, security and improving the service. We keep these for as long as they are useful for those purposes.
2.6 Payment data
If your store is on Shopify, your subscription is billed through Shopify; we store the Shopify subscription ID and its status. If you pay by card, Stripe processes the payment; we do not store your card number or CVC, only the Stripe customer and subscription IDs and the subscription status.
2.7 Bank and financial-account data (Plaid)
If you connect a bank or credit-card account, we use Plaid to retrieve your account balances and transaction history so Arxos can show your real cash position, spending, and profit. Access is read-only: Arxos cannot move money. You enter your bank login directly with Plaid; Arxos never sees or stores those credentials. We receive the resulting data through Plaid and store a Plaid access token encrypted at rest (AES-256-GCM), used only to refresh your financial dashboard on your behalf. Inside your business, only the account owner and admin seats can see bank and card data. We never sell this data. You can disconnect a bank at any time, which revokes Plaid's access and stops updates; the balances and transactions already imported stay in your account's history until you ask us to delete them at privacy@joinarxos.com. Plaid's own handling of your data is described in the Plaid End User Privacy Policy.
2.8 Data about your customers (store visitors)
When your customers use the Arxos chat on your storefront or email your support address, we process their messages, name, email address, and related order details on your behalf to answer their questions. For this data you are the controller and Arxos is a processor. We do not use it for advertising, we do not sell it, and we do not use it to train AI models for other businesses. The chat keeps a conversation ID, and the name and email a visitor gives (or, for a customer signed in to your store, the name and email on their account), in that visitor's browser storage so the conversation continues on their next visit, and records the page each message was sent from. Visitors can ask the store or privacy@joinarxos.com to access or delete their conversation data; deletion requests arriving through Shopify's customer-privacy system are honored automatically.
3. How we use your data
- Provide the Arxos service (answer and draft support replies, keep stock and purchase orders, show your finances, send notifications)
- Authenticate you and protect your account
- Send service-related emails (receipts, security alerts, important updates)
- Improve product quality (aggregated, de-identified analytics only)
- Comply with legal obligations
You keep ownership of the data you bring to Arxos, and you grant us the license in section 6 of our Terms of Service: to host, process, analyze and display it to run, secure and improve the service, for as long as we hold it. Arxos learns from how every business uses it (which questions customers ask, which answers work, how orders, stock and costs behave) and uses what it learns to improve the service for every business. The support playbook every business's replies start from was written from our own brand's support history and improves from those learnings. Data that no longer identifies you, your business or your customers (aggregated or de-identified data) is ours to use for any purpose. Data that reaches Arxos through Shopify, Amazon or Plaid is used within those platforms' own rules as well. We do not sell your data, and we do not advertise to you.
4. Third parties that process your data
Arxos uses the following sub-processors. Each has its own privacy commitments; links below.
- AI model providers, the AI models and APIs best suited to each task power Arxos's replies, drafts, and summaries. Inputs include relevant context from your account (e.g. a customer email being answered). The providers' commercial terms do not allow them to train their models on this data.
- Supabase, Postgres database hosting (US-East). Supabase privacy
- Vercel, application hosting + serverless runtime. Vercel privacy
- Clerk, authentication. Clerk privacy
- Stripe, payment processing for businesses that pay by card. Stripe privacy
- Plaid, connects your bank and credit-card accounts, read-only, to retrieve balances and transactions for your financial dashboard. You enter your bank login directly with Plaid; Arxos never receives your credentials. Plaid End User Privacy Policy
- Shopify, when you connect your store, data flows between Shopify and Arxos via OAuth, and Shopify bills Shopify stores for Arxos. Shopify privacy
- Amazon, if you connect Seller Central, Arxos reads your orders, FBA inventory, and fees through the Selling Partner API, under Amazon's own privacy terms.
- Postmark, receives the support email you forward to Arxos and sends your replies from your own domain. Postmark privacy
- Google (Gmail), the mailbox Arxos uses to answer its own customers. Businesses forward their support mail to Arxos and do not connect a mailbox.
- OpenStreetMap (Nominatim), turns a warehouse or supplier address you enter on the Supply Chain page into a map point. It receives that address and nothing about your customers. OSM privacy
5. Data retention
We keep your data while your account is open. After it closes, or after you disconnect a store, a marketplace or a bank, we may keep what we hold for our records, for billing and tax purposes, to meet legal obligations, to protect the service, and to keep improving it as section 3 describes. Disconnecting stops new data from arriving; it does not by itself delete what already arrived. We delete data when you ask us to at privacy@joinarxos.com, within a reasonable time and to the extent the law and our platform agreements require. Two platform rules apply on top of this: a deletion request that arrives through Shopify's customer-privacy system removes the identifying fields on that customer's conversations at once, and Amazon buyer information received through Amazon's Selling Partner API is kept no longer than Amazon's Data Protection Policy allows (buyer-identifying fields for 30 days after the order is delivered, apart from what tax and legal records require) and is then deleted or anonymized.
6. Your rights
Depending on your jurisdiction (GDPR, UK GDPR, CCPA, etc.) you may have rights including:
- Access, request a copy of your data
- Correction, fix inaccurate data
- Deletion, request we delete your data
- Portability, receive your data in a machine-readable format
- Restriction or objection, limit how we process your data
- Withdrawal of consent, for processing based on consent
To exercise any of these, email privacy@joinarxos.com. We'll respond within 30 days.
7. Security
We use industry-standard security practices: TLS 1.2+ in transit, encryption at rest for store, marketplace and bank connection credentials (AES-256-GCM), every read and write filtered by business in the application, backups by our database host, and reasonable physical/operational safeguards via our hosting providers.
Incidents. If we confirm a security incident that affects your data, we tell you within 72 hours of confirming it, with what happened, what data was involved and what we are doing. An incident involving Amazon data is reported to Amazon within 24 hours of our detecting it.
No system is perfectly secure. If you discover a vulnerability, please report it to security@joinarxos.com.
8. Cookies
We use first-party cookies to keep you signed in (set by our authentication provider, Clerk), to remember which of your businesses you are working in, and, for half an hour while you install from Shopify, which store is installing. Your browser's storage holds display preferences and a copy of pages you opened (your refunds list and stock) so they open faster. The chat on a store uses the visitor's browser storage as described in section 2.8. We do not set third-party advertising or tracking cookies.
9. Children
Arxos is a B2B product not intended for users under 16. We do not knowingly collect data from children.
10. International transfers
Arxos servers are in the United States. If you use Arxos from outside the US, your data will be transferred to the US. By using the service, you consent to this transfer.
11. Changes to this policy
We may update this policy as Arxos evolves. Changes take effect when they are posted here, and we tell registered users about material changes by email or inside the app. The current version is always at this URL.
12. Contact
Privacy questions: privacy@joinarxos.com
Security disclosures: security@joinarxos.com
General support: support@joinarxos.com