Privacy Policy & Data Governance

This Privacy Policy explains how AisleNode (“AisleNode,” “we,” “us,” or “our”) collects, processes, and protects information when you use our offline-to-agent retail connection platform, visit our website, connect merchant inventories, or interact with our Model Context Protocol (MCP) server endpoints.

We operate on a zero-custody, data-minimization architecture. We do not sell personal data, we do not pool customer payment information, and we do not use your proprietary retail pricing or private messages to train public artificial intelligence models.

1. Information We Collect

A. Merchant Account Information:

When you authenticate via Google Sign-In, we receive your email address, full name, and user identifier to provision your store instance. When configuring your store, you provide store name, physical street address, latitude and longitude coordinates, and a WhatsApp business dispatch number.

B. Catalog & Inventory Data:

Product titles, descriptions, categories, SKUs, inventory counts, and price points uploaded via CSV or manually created. This information is publicly exposed via MCP endpoints for AI shopping agents to discover and match.

C. Customer Order Data:

When a customer or autonomous agent initiates a reservation or order, we process the customer name, phone number, delivery address (or pickup indication), items selected, and fulfillment notes strictly for order routing and receipt generation.

D. Technical & Routing Logs:

Standard web request headers, IP addresses, and MCP query parameters used for system health, rate-limiting, and error diagnosis.

2. Zero-Custody Payment Processing & Refund Disclaimer

AisleNode does not collect, process, hold, or store credit card numbers, bank account credentials, or CVVs. All consumer payments and subsequent refunds execute directly between the customer and the merchant's personal processor:

Stripe: Transactions execute directly through merchant Stripe accounts or PaymentIntents.
PayPal: Transactions are completed through PayPal client APIs directly into the merchant account.
Flutterwave: Processed directly via merchant regional public keys.
Non-Custodial Refund Policy: Because AisleNode holds zero transaction funds, AisleNode cannot initiate, hold, reverse, or guarantee refunds. All refund claims, cancellations, and disputes are governed directly between the merchant and the consumer via the merchant's gateway.
Protocol Licensing Fees: Settled through Lemon Squeezy, our Merchant of Record for software maintenance invoices.

3. AI Agents & Model Context Protocol (MCP) Data Flows

Our Model Context Protocol endpoints (`/api/mcp`) allow conversational AI clients (such as Meta Muse, Claude, and autonomous agents) to read in-stock products and generate reservations:

Data Minimization: MCP tools only return catalog information necessary to answer the shopper's request (product title, price, store location, and stock availability).
Stateless Agent Context: AisleNode does not harvest, store, or log the conversational chat histories of shoppers interacting with external LLMs outside the immediate order payload submitted to our checkout tool.
No Public Model Training: Merchant inventory data and customer order records are never used to train or fine-tune public foundation models.

4. WhatsApp & Direct Messaging Privacy

AisleNode facilitates peer-to-peer communication between merchants and shoppers via WhatsApp:

No Automated Outbound Spam: AisleNode does not send automated marketing blasts or sell customer numbers. WhatsApp dispatch links open standard direct chat threads on the user's own device.
Fulfillment-Only Use: Customer telephone numbers provided during checkout are shared with the merchant solely for the purpose of communicating pickup status or delivery coordination.
Compliance with Meta Policies: We adhere to Meta's developer and platform privacy terms governing business messaging integrations.

5. Merchant Storefront Verification & Ephemeral Proof Data

When a store is submitted for network launch, our trust and safety operators may request supplementary proof of physical storefront operation (such as a storefront exterior/counter photograph, business registration document, or utility bill) to protect consumers and agents against fraudulent listings.

Immediate Deletion Policy: Any supplementary verification photographs, official business filings, or utility documents uploaded by merchants are strictly ephemeral. All verification media files are permanently and automatically deleted from our storage infrastructure immediately upon completion of the verification review.

AisleNode does not archive, retain, or monetize merchant identification or physical storefront verification media.

6. How We Share Information

We never sell or rent your personal information. We disclose data only in the following operational contexts:

Between Shoppers and Merchants: Order items, recipient names, contact numbers, and fulfillment addresses are transmitted to the selected merchant to fulfill orders.
Service Infrastructure: With trusted infrastructure providers that host our database and edge routing (Supabase, Vercel, Cloudflare) subject to strict data protection agreements.
Legal Compliance: If required by law, subpoena, or valid regulatory process to protect safety or platform integrity.

7. Data Retention & Deletion Rights

We retain merchant catalog and order records as long as your merchant account remains active. Under applicable privacy regulations (such as GDPR and CCPA), you have the right to:

Access and export the personal data associated with your store or orders.
Request correction of inaccurate GPS coordinates, contact numbers, or business details.
Request the deletion of your merchant account, product catalog, and historical order records.

To submit a data deletion or access request, email us at aislenode@soltrixstudios.com.

8. Security

We implement industry-standard cryptographic transport (TLS/HTTPS), role-based database row-level security (RLS), and isolated merchant authentication tokens to protect your records from unauthorized access.

9. Contact

For any questions regarding this Privacy Policy or our data practices, contact us at:

AisleNode Protocol
aislenode@soltrixstudios.com