Privacy & Terms
Updated August 2026
Our Privacy Policy (sections 1–14) and Terms of Service (sections 15–24) in one document. It covers what we collect, the legal basis for each purpose, who we share it with, the rights you have under the GDPR and the CCPA, and the terms on which you use Commerce365.
This document has two parts. Part A, sections 1 to 14, is our Privacy Policy — how Flatline Agency B.V. handles personal data on this website and inside the Commerce365 platform. Part B, sections 15 to 24, is our Terms of Service — the terms on which you use the platform. Sections are numbered continuously so any one of them can be cited on its own.
Part A — Privacy Policy
1. Who we are
Commerce365 is operated by Flatline Agency B.V., a company registered in the Netherlands. For the processing described in section 5, Flatline Agency is the data controller. Privacy questions, data subject requests and California privacy requests all go to privacy@flatlineagency.com.
2. Controller or processor — which are we?
This distinction decides whose legal basis applies, so it comes before everything else.
Your account and website data — we are the controller. Your name, email address, company, billing details, and how you use this site and the platform. Section 5 sets out our legal basis for each purpose.
Your store data — we are a processor. The product, order, customer, advertising and marketing data that Commerce365 reads from the platforms you connect is yours. Where it contains personal data about your customers, you are the controller and we process it only on your documented instructions under Article 28 GDPR. The legal basis for that processing is yours to determine, not ours. A data processing agreement is available on request.
Under the CCPA the same split makes us a service provider for your store data. We do not retain, use or disclose it for any purpose other than performing the service for you.
3. What we collect
Information you give us: name, email address, job title, company name, and anything else you submit through a contact form, a sign-up, or a message to our team.
Account information: your organization name and login credentials, which are handled by our authentication provider and never stored by us in readable form.
Connected platform data: product, order, inventory, customer, advertising and marketing data from the platforms you connect — Shopify, Klaviyo, Meta Ads, Google Ads, Google Analytics, Search Console and others. We only ever access the scopes you explicitly authorise, and you can revoke them at the platform at any time.
Usage data: your chat messages, agent instructions, generated reports and agent run history.
Technical data: IP address, browser and device information, server logs and error diagnostics.
Billing data: billing contact details and transaction records. Card details go directly to our payment processor and never reach our servers.
We do not ask for, and do not want, special categories of data under Article 9 GDPR — health, biometrics, political opinions and the like. Please do not enter them into the product.
4. How we use it
To run the service you signed up for: analysing your commerce data, running agents, building dashboards and reports, and executing the changes you approve. To bill you. To keep the platform secure and working. To answer you when you get in touch. And, if you opted in, to send you product news.
We do not sell your personal information, and we do not use your store data to train AI models — ours or anyone else’s.
5. Our legal bases under the GDPR
Article 6(1) GDPR requires a lawful basis for each purpose. These are ours, for the data we control (see section 2).
Creating and running your account, authenticating you, giving you access to the platform — Article 6(1)(b), performance of the contract with you.
Connecting your platforms over OAuth and reading the data you authorise — Article 6(1)(b), performance of the contract with you.
Running AI analysis, agents, dashboards and reports — Article 6(1)(b), performance of the contract with you.
Executing a change you approve in a connected platform — Article 6(1)(b), performance of the contract with you.
Taking payment and issuing invoices — Article 6(1)(b) for the payment itself, and Article 6(1)(c), legal obligation, for retaining the accounting records that tax law requires.
Service and transactional email: alerts, approval requests, digests, security notices — Article 6(1)(b), performance of the contract with you.
Responding to your enquiry when you contact us through this website — Article 6(1)(b) where you are or are becoming a customer, otherwise Article 6(1)(f), our legitimate interest in answering people who write to us.
Keeping the platform and site secure: authentication logs, abuse and fraud prevention, error monitoring — Article 6(1)(f), our legitimate interest in a secure and available service, weighed against your rights.
Understanding how the product and site are used so we can fix and improve them — Article 6(1)(f), our legitimate interest in improving a service you use.
Marketing email, newsletters and event invitations — Article 6(1)(a), your consent, which you can withdraw at any time through the unsubscribe link in every message.
Responding to a lawful request from a court, regulator or law enforcement authority — Article 6(1)(c), compliance with a legal obligation.
Where we rely on legitimate interests, we have weighed those interests against your rights and freedoms, and you can object at any time under Article 21. Where we rely on consent, you can withdraw it at any time, and doing so does not affect processing carried out before you withdrew it.
6. Who we share data with
We do not sell your data. We share it only with the providers below, each under a contract that binds them to process it solely on our instructions.
Supabase (European Union) — database, authentication and encrypted secret storage. Your platform access tokens are held here, encrypted in Supabase Vault.
Vercel (EU hosting region; US company) — application hosting and delivery.
OpenRouter (United States) — routes every AI request to the underlying model provider. All model calls go through OpenRouter.
Anthropic (United States) — provides the Claude models used for analysis, chat and agents, reached through OpenRouter. Your data is not used to train their models.
MiniMax (outside the EEA) — provides models used for parts of report generation, reached through OpenRouter.
Inngest (United States) — runs scheduled and background agent work.
Stripe (United States / European Union) — payment processing. We never see or store your full card details.
Resend (United States) — sends transactional and notification email.
Sentry (United States) — error monitoring. Events carry the user and organization identifier so a fault can be traced to the account that hit it.
Gleap (European Union) — in-app support and feedback, when you choose to contact us through it.
We may also disclose data where the law compels us to, and to a successor entity if the business is sold — in which case this policy continues to apply until you are told otherwise.
7. International transfers
Your account and store data is stored in the European Union. Several of the providers in section 6 are established in the United States, so processing there does happen — most notably when an AI request is routed to a model provider.
Those transfers are covered by the European Commission’s Standard Contractual Clauses together with supplementary technical measures, or, where the provider is certified, by the EU–US Data Privacy Framework. Ask us and we will tell you which safeguard applies to a specific transfer.
8. Security
Data is encrypted in transit and at rest. Access tokens for your connected platforms are held in an encrypted vault, separately from the rest of the database. Every table carries row-level security keyed to your organization, so one organization cannot read another’s data. Access to production is restricted and logged.
No system is immune. If a breach affects your personal data we will notify the Dutch Data Protection Authority within 72 hours as Article 33 requires, and notify you directly where Article 34 requires it.
9. How long we keep it
Account and store data — for as long as your account is active. When you delete your account or uninstall the app, we delete it within 30 days.
Billing records — seven years, as Dutch tax law requires.
Security and error logs — up to 90 days.
Marketing contact details — until you unsubscribe, plus a suppression record so we do not email you again.
Website enquiries — up to two years after our last exchange.
10. Your rights under the GDPR and UK GDPR
If you are in the EEA, the UK or Switzerland, you have the right to:
Access a copy of the data we hold about you (Article 15).
Rectify data that is wrong or incomplete (Article 16).
Erase your data (Article 17).
Restrict processing while a dispute is resolved (Article 18).
Port your data to another provider in a machine-readable format (Article 20).
Object to processing based on legitimate interests, and to direct marketing at any time (Article 21).
Withdraw consent where consent is the basis (Article 7(3)).
Email privacy@flatlineagency.com to exercise any of these. We respond within one month, and will tell you if we need to extend that by up to two further months as Article 12(3) allows. There is no charge.
You can also complain to a supervisory authority. In the Netherlands that is the Autoriteit Persoonsgegevens; elsewhere, the authority where you live or work.
If your request concerns data a merchant holds about you as their customer, send it to that merchant — they are the controller and we act on their instructions. Tell us anyway and we will pass it on.
11. California privacy rights (CCPA / CPRA)
This section applies if you are a California resident, and sets out the disclosures the California Consumer Privacy Act, as amended by the CPRA, requires. Commerce365 is available worldwide, so we make these disclosures rather than assuming our users are only in Europe.
Personal information we collect. In the last twelve months we have collected the following statutory categories:
A. Identifiers — name, email address, company name, account ID, IP address. Collected directly from you and automatically from your browser. Used to provide and secure the service, to bill you and to support you. Disclosed to our hosting, database, email and payment providers.
B. Customer records (Cal. Civ. Code §1798.80(e)) — billing contact details and company address. Collected from you and from our payment processor. Used to take payment and issue invoices. Disclosed to our payment processor and our accountants.
D. Commercial information — subscription tier, transaction and usage records. Generated by your use of the service. Used for billing, plan enforcement and support. Disclosed to our payment processor and database provider.
F. Internet or other electronic network activity — pages viewed, features used, chat and agent activity, error diagnostics. Collected automatically. Used to provide the service, to keep it secure and to improve it. Disclosed to our hosting, database, error-monitoring and AI providers.
We do not collect the other statutory categories — biometric information, precise geolocation, education records, or professional information beyond your job title and employer.
Sensitive personal information. The only sensitive personal information involved is your account log-in credential. We use it solely to authenticate you, a use the CPRA exempts from the right to limit, and never to infer anything about you.
We do not sell or share your personal information. We have not sold personal information, and have not shared it for cross-context behavioural advertising, in the preceding twelve months, using the definitions of “sell” and “share” in the CCPA. We also do not sell or share the personal information of anyone we know to be under 16.
Your California rights. You have the right to:
Know what we collect, where it came from, why we collect it and who we disclose it to.
Access a copy of the specific pieces of personal information we hold.
Delete your personal information, subject to the exceptions the statute allows.
Correct inaccurate personal information.
Opt out of sale or sharing — we do neither, so there is nothing to opt out of. If that ever changes we will add a “Do Not Sell or Share My Personal Information” link before it does.
Limit the use of sensitive personal information — we use it only to authenticate you, which the statute exempts.
Non-discrimination — we will not deny you service, change your price, or give you a lesser experience for exercising any of these rights.
How to exercise them. Email privacy@flatlineagency.com with “California privacy request” in the subject line and tell us which right you want to exercise. We verify your identity by matching the details in your request against our records, and may ask you to confirm from your registered email address. An authorised agent may act for you with written permission we can verify. We confirm receipt within 10 business days and respond within 45 calendar days; if we need longer we will tell you within those 45 days and take no more than 45 further days. There is no charge.
If your request concerns data a merchant holds about you as their customer, we act as that merchant’s service provider. Send the request to the merchant; if you send it to us we will forward it.
12. Cookies and third-party tools
Inside the platform we use only what the service needs to work: a session cookie to keep you signed in, and your interface preferences. We do not run advertising or cross-site tracking cookies there.
On this website we use cookies and similar technologies to keep the site working, to measure how it is used, and — only with your consent — for marketing measurement. You can change or withdraw that consent at any time through your browser settings or the cookie controls on this site.
This site may link to websites we do not operate or control. This policy applies only to our own site and services; we are not responsible for the content or privacy practices of anyone else, and we recommend reading their policies before giving them your information.
13. Children
Commerce365 is a business tool and is not directed at children. We do not knowingly collect personal data from anyone under 16. If you believe a child has given us data, tell us and we will delete it.
14. Changes to this policy
We may revise this policy to reflect changes in our practices, our legal obligations or our services. The date at the top always reflects the current version, and we will notify you by email or in the platform before any change that materially affects your rights takes effect.
Part B — Terms of Service
These terms govern your use of Commerce365. By creating an account or using the service you agree to them. Part A above explains how we handle personal data and forms part of this agreement.
15. The service
Commerce365 is an AI-powered ecommerce operations platform operated by Flatline Agency B.V. (the Netherlands). It provides automated analytics, agent-based workflows, dashboards and reporting for online merchants by connecting to third-party platforms such as Shopify, Klaviyo, Meta Ads and Google Ads.
16. Your account
You need a valid email address and an organization to use Commerce365. You are responsible for keeping your credentials secure and for all activity under your account. Tell us promptly if you believe your account has been compromised.
You must be at least 16 years old and, where you act for a company, authorised to bind it to these terms.
17. Pricing and billing
Commerce365 offers several subscription tiers, billed monthly through Stripe or through the app store you installed from. Current prices are on our pricing page.
Prices are shown in euros and are exclusive of VAT where applicable.
Agent runs and AI features draw from a monthly credit balance included in your plan. You can top up if you need more; we do not bill you for overage without you choosing to.
You may cancel at any time. Access continues to the end of the current billing period, and we do not refund part-periods unless the law requires it.
We may change pricing with 30 days’ notice.
18. Data processing
By connecting a third-party platform you authorise Commerce365 to access and process the data within the OAuth scopes you approve. We process that data solely to provide the service to you, as set out in Part A. You remain the controller of your store data and can revoke our access at the platform at any time.
You are responsible for having a lawful basis for the personal data you put into the platform, and for your own privacy notice to your customers.
19. AI-generated content
Commerce365 uses AI models, reached through OpenRouter, to generate insights, summaries, recommendations and proposed actions. AI output is provided as-is and is not professional financial, legal or tax advice.
You are responsible for reviewing anything before you act on it. Agents propose changes and queue them for your approval; where you enable autonomous execution, you accept responsibility for the actions taken within the limits you set.
20. Acceptable use
You agree not to:
Use the service for any unlawful purpose.
Reverse-engineer, exploit or abuse the platform.
Exceed rate limits or circumvent usage restrictions.
Share account credentials with unauthorised parties.
Connect accounts you are not authorised to access, or use the service to reach data belonging to someone else.
21. Limitation of liability
Commerce365 is provided “as is”, without warranties of any kind. To the maximum extent Dutch law permits:
We are not liable for indirect, incidental or consequential damages arising from your use of the service.
Our total liability is limited to the amount you paid for the service in the twelve months before the claim.
We are not responsible for actions taken by AI agents that you approved, or that you configured to run autonomously.
Nothing here limits liability that cannot be limited by law, including for intent or gross negligence.
22. Availability
We aim for high availability but do not guarantee uninterrupted service. Scheduled maintenance is communicated in advance where possible. We are not liable for downtime caused by third-party providers, including the platforms you connect.
23. Termination
You may terminate your account at any time from the platform or by contacting us. We may suspend or terminate an account that breaches these terms, with reasonable notice except where the breach requires immediate action.
On termination your data is deleted in line with section 9 and the app store data-deletion requirements that apply to us.
24. Governing law
These terms are governed by the laws of the Netherlands. Disputes are submitted to the competent court in the Netherlands. If any provision is held unenforceable, the rest remains in force.
Questions about these terms: privacy@flatlineagency.com.