Privacy & Data Governance

ComserX Privacy Policy

We are committed to protecting your privacy and business data. This policy explains how ComserX collects, processes, and safeguards data across our SaaS store builder platform.

Last Updated: September 2026

ComserX ("we", "our", or "us") provides cloud-based eCommerce store builder software, hosting, and business management tools. This Privacy Policy explains how we collect, use, and protect your information when you register an account, build an online store, or interact with our software platform.

By using ComserX, you agree to the data collection and processing practices described in this policy.

1. Who We Are & Our Role (Controller vs. Processor)

ComserX operates as a Software-as-a-Service (SaaS) provider. Under data protection regulations:

•ComserX as Data Controller: We are the Controller for account information, billing records, authentication credentials, and platform support communications collected directly from store owners.
•ComserX as Data Processor: For any end-customer order details, contact numbers, or addresses placed on a store owner's independent storefront, the store owner is the Data Controller. ComserX processes and stores that data strictly on behalf of the store owner to provide hosting, order tracking, and dashboard management tools.

Store owners are responsible for establishing their own privacy policies and obtaining proper consent from their store visitors and shoppers.

2. Legal Basis for Processing Data

We process personal data under recognized lawful bases (including the Sri Lanka Personal Data Protection Act):

•Contractual Performance: To provision your store dashboard, maintain your hosting, provide software features, and manage subscriptions.
•User Consent: When you register an account, configure store options, or contact our support team.
•Legitimate Business Interests: Platform security, fraud detection, server performance monitoring, and service improvements.

3. Information We Collect from Store Owners

We collect only the data necessary to provide and support your online storefront software.

A. Account Registration & Authentication

We collect:

• Email address
• Encrypted (hashed) password (for email/password registration)
• Google account profile data (name, email, profile photo) when authenticating via Google Sign-In
• Account username or display name

Purpose: Account authentication, administrative access, password resets, and critical service notifications.

Security Note: Passwords are cryptographic hashes and are never stored in plain text or visible to platform operators.

B. Store Configuration & Profile Data

We collect:

• Store name, tagline, and custom sub-domain / slug
• Store description, business category, and public business contact information (e.g. WhatsApp, phone, email)
• Store branding assets (logos, banners, custom colors, theme preferences)
• Store operating city, address, or location display settings

Purpose: To publish, configure, and render your storefront online according to your design specifications.

C. Product & Catalog Data

We collect:

• Product titles, descriptions, pricing, and variants
• Product media (images, banners, and catalog assets)
• Categories, tags, stock inventory counts, and fulfillment specifications

Purpose: To store, index, and display your merchandise catalog on your storefront.

D. Store Orders & Aggregate Statistics

To power your merchant administrative dashboard, our software stores:

• Order counts, order status records, and transaction totals processed through your store
• Storefront page visit metrics and traffic counts

Purpose: To render your store management dashboard, sales summaries, and analytics tools.

E. Administrative Notifications Data

We store in-app dashboard alerts for store owners:

• Notification title, message body, and notification category (e.g. new order alert, system update)
• Read/unread status and timestamps

Purpose: To keep store owners promptly informed of store activity, incoming orders, and important platform announcements.

F. Customer Support & Inquiries

We collect:

• Messages, bug reports, and correspondence submitted to our support team
• Technical details or attachments (such as screenshots) provided to assist in debugging

Purpose: To diagnose technical issues, assist store owners, and improve software reliability.

4. Cookies & Session Data

ComserX uses essential cookies strictly necessary for authenticating store owners and maintaining secure sessions:

• Authentication Cookies: Secure, HttpOnly tokens used to authenticate your login session.
• Security & CSRF Protection: Tokens used to verify valid form requests and prevent cross-site request forgery.
• No Third-Party Ad Trackers: We do not sell ad space or embed third-party advertising tracking cookies.

Disabling cookies in your browser settings will prevent you from signing in to your store dashboard.

5. Third-Party Sub-Processors & Infrastructure

We rely on reputable infrastructure and technology partners to host and deliver our software services:

• Google: For optional single sign-on (Google OAuth authentication).
• MongoDB: For managed cloud database storage and encrypted customer/store data persistence.
• Authorized Payment Processors: Third-party payment gateways for securely handling recurring billing and subscriptions without storing card numbers on ComserX servers.

We do not sell, rent, or trade your personal data or store data to data brokers or third-party advertisers.

6. Data Security

We implement technical and organizational measures designed to protect your data against unauthorized access, loss, or disclosure:

• Strong password hashing algorithms (e.g. bcrypt) with secure salting.
• End-to-end encryption in transit via HTTPS/TLS 1.3 across all store endpoints and dashboards.
• Tenant data isolation ensuring one store owner cannot access another store's administrative data.
• Role-based administrative access controls and API rate limiting against abuse.

7. Data Retention & Account Deletion

We retain store and account data for as long as your store account is active:

• Store catalogs, themes, and settings are retained to keep your store operating continuously.
• Upon store account closure or verified deletion request, your public storefront is decommissioned, and stored data is permanently deleted or anonymized, except where required for legal, tax, or accounting compliance.

8. Store Owner Rights

As a store owner, you have the right to:

• Access & Portability: View and export your store catalog and account details from your dashboard.
• Rectification: Edit or correct your business information and store profiles at any time.
• Deletion: Request permanent removal of your account and store data.
• Withdraw Consent: Close your account or unsubscribe from non-essential communications.

Requests can be submitted directly by contacting our support team.

9. Age Limitations & Minors

ComserX is a business software platform designed for individuals who are 18 years or older. We do not knowingly register accounts or collect personal data from minors. If you believe a minor has created an account, please contact us immediately for prompt deletion.

10. Changes to This Policy

We may periodically update this Privacy Policy to reflect enhancements in our store builder features, infrastructure upgrades, or regulatory revisions. Any updates will be published on this page with an updated "Last Updated" date.

11. Privacy Contact

If you have questions regarding this Privacy Policy or wish to exercise your data rights:

info@comserx.com