Privacy Policy

1. Introduction

Carrier Refund ("we", "us", or "our") operates as a specialized Business-to-Business (B2B) SaaS platform. This Privacy Policy outlines our strict data protection protocols regarding the collection, processing, and cryptographic securing of Merchant data, logistics tracking information, and e-commerce API integrations.

By utilizing our Platform, you consent to the data practices described in this policy. We are committed to operating in alignment with global privacy standards, including the principles of the General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA).

2. Zero-Knowledge Architecture & API Security

Given the sensitive nature of e-commerce integrations, Carrier Refund employs a "Zero-Knowledge" approach to critical Merchant credentials.

• API Keys and Tokens: Any third-party API keys (e.g., Shopify integrations) provided by the Merchant are encrypted at rest using military-grade AES-256-GCM encryption. Our architecture ensures that raw API keys are never stored in plain text.
• Anonymization of PII: Personally Identifiable Information (PII) belonging to the Merchant’s end-customers (such as buyer emails or physical addresses) is strictly limited to what is necessary for the dispute process. Where possible, data undergoes irreversible hashing (HMAC-SHA256) to prevent unauthorized identification.

3. Information We Collect & Process

To provide our automated dispute resolution services, we process the following data points:

• Merchant Data: Corporate entity names, authorized contact emails, and Wallet credit transaction logs.
• Logistical Data: Tracking numbers, carrier names, shipping timestamps, and Proof of Delivery (POD) documents.
• Telemetry & Auditing: System interactions are recorded in an immutable ledger (SHA-256 hashing) to ensure absolute transparency and prevent internal tampering of financial and platform credit states.

4. Artificial Intelligence & Data Processing

The Platform utilizes advanced artificial intelligence models (including Google AI infrastructure) and computer vision engines to analyze logistical delays and generate formal dispute claims.

Strict AI Data Boundaries: The data processed by our AI engines is strictly isolated per Merchant. We explicitly prohibit the use of Merchant data or end-customer logistical data to train public AI models. The AI acts solely as a deterministic processor to evaluate Service Level Agreement (SLA) breaches and format legal requests.

5. Data Retention, GDPR, and CCPA Rights

We retain your data only for as long as necessary to fulfill the B2B services outlined in our Terms of Service or as required by financial auditing laws. When you close your Merchant account, API integrations are severed, and credentials are cryptographically purged.

Subject to your jurisdiction (e.g., EU or California), you maintain the right to:

• Request access to the corporate data we hold about your Merchant account.
• Request the deletion of your account and associated logistical ledgers (Right to be Forgotten).
• Opt-out of any non-essential data processing.

6. International Data Transfers

As a global SaaS platform transitioning toward a US-based corporate structure, Merchant data may be processed in secure cloud infrastructure (e.g., Vercel, Supabase) located in the United States or other jurisdictions. By using the Platform, you consent to the secure transfer and processing of this data under standard contractual safeguards.

7. Contact Information

For any data protection inquiries, to exercise your privacy rights, or to contact our Data Protection Officer, please email:

support@agentcarrierrefund.com