Privacy

Who operates CommerceVigil

CommerceVigil is operated by Snygg Care LLC. Snygg Care LLC is responsible for the processing of personal information described in this Privacy Policy.

What we collect

CommerceVigil processes account information needed to provide the service, including your sign-in email address, organization membership, and the Google Merchant Center data you authorize us to access. If you contact support, we process the contact details and message content you submit so we can respond to your request.

How we use data

We use this information to monitor Merchant Center product and account health, present diagnostics, and deliver the in-app and email alerts you enable. We do not sell personal information.

On our public pages, we record first-party page views and acquisition steps to understand how visitors discover and use the free scan. This may include the visited page, campaign parameters, and a referrer URL without its query string. We use technical request details to deduplicate page views; we do not store raw IP addresses in these funnel events or use a third-party analytics SDK for this purpose.

The public contact form uses Cloudflare Turnstile to help prevent automated abuse. Cloudflare processes technical information needed to verify a submission; CommerceVigil checks the verification result before sending the message to support.

Google data

With your authorization, CommerceVigil may access Merchant Center account information, processed product information, product issues, account-level issues, performance and reporting information, and product status and notification information. Google OAuth tokens are stored encrypted and are used only to access the Merchant Center data needed for the connected organization. You can disconnect the Google Merchant connection from the application.

AI-assisted issue guidance

When an authorized user chooses to use CommerceVigil Copilot, we may send a limited set of Merchant issue details, deterministic performance summaries, and selected product fields to our AI service provider to generate guidance. We exclude Google access and refresh tokens, payment data, email-delivery credentials, and ambiguously matched performance data. Copilot output is advisory and should be verified before catalog changes are made.

Sharing and disclosure of Google user data

CommerceVigil does not sell Google user data, use it for advertising, or share it with third parties for their own independent marketing purposes.

We may disclose or process Google user data only with service providers that help us operate CommerceVigil and provide functionality requested by the user.

These service providers may include:

• Supabase — authentication, database hosting, and secure storage of CommerceVigil application data.
• Vercel — application hosting and server-side processing.
• Resend — delivery of transactional emails and Merchant Center monitoring alerts. Email content may include issue information necessary to provide the alerting functionality requested by the user.
• OpenAI — when CommerceVigil Copilot is used, selected Merchant Center issue, product, and diagnostic evidence may be processed to generate explanations and recommended next steps. CommerceVigil limits the data sent to what is necessary for the requested Copilot functionality and does not send Google OAuth tokens or application secrets.

These service providers process data on our behalf to provide CommerceVigil functionality. We do not permit them to use Google user data for unrelated advertising or marketing purposes.

Google user data may also be disclosed when required by applicable law, legal process, or to protect the security and integrity of CommerceVigil and its users.

CommerceVigil's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

How we protect Google user data

CommerceVigil uses technical and organizational safeguards designed to protect Google user data against unauthorized access, disclosure, alteration, or loss.

These safeguards include:

• Encryption in transit — CommerceVigil uses HTTPS/TLS for communications between users, CommerceVigil services, and supported third-party services.
• Protection of OAuth credentials — Google OAuth access and refresh credentials are handled only by server-side systems. Refresh tokens stored by CommerceVigil are encrypted at rest and are not exposed to the browser.
• Tenant isolation — Customer data is isolated by organization using database Row Level Security (RLS), server-side authorization, and tenant-consistency controls designed to prevent one customer from accessing another customer's Merchant Center data.
• Role-based access controls — Administrative and agency access is authorized server-side. Platform administration is separated from normal customer access.
• Server-side secret management — API keys, OAuth secrets, webhook secrets, and other application credentials are stored as protected server-side environment variables and are not exposed in client-side application code.
• Webhook and background-job protection — CommerceVigil validates authenticated webhook and scheduled-job requests and applies idempotency controls to prevent unauthorized or duplicate processing.
• Logging controls — CommerceVigil does not intentionally log Google OAuth access tokens, refresh tokens, OAuth authorization codes, API keys, or other application secrets. Operational logs are limited to information necessary to monitor and troubleshoot the service.
• Access minimization — CommerceVigil accesses Google Merchant Center data only for the monitoring, diagnostic, alerting, and user-requested Copilot functionality described in this Privacy Policy.

Users may disconnect their Google Merchant Center account from CommerceVigil, which stops ongoing Merchant Center monitoring and access using the stored connection credentials.

Service providers

We use service providers to operate CommerceVigil, including hosting, authentication and database, payment, email delivery, and—when Copilot is deliberately requested—AI processing. These providers process data on our behalf for the relevant service function.

Retention and security

We retain service data while your organization uses CommerceVigil and apply reasonable technical safeguards. No online service can guarantee absolute security.

Contact

For privacy questions or requests, contact Snygg Care LLC at support@commercevigil.com.