Privacy Policy

1. Information We Collect

To provide our deduction recovery services, we collect and process the following categories of information:

• Account Information: Organization name, contact details, team member names, email addresses, and roles.
• Deduction Data: Shortage claim reports, deduction CSVs exported from retailer portals (Amazon Vendor Central, Walmart Retail Link, Target, Costco, Kroger, and others), including claim IDs, amounts, dates, and reason codes.
• Shipping Records: Purchase order numbers, shipment dates, tracking numbers, PRO numbers, carrier information, and quantities shipped.
• Evidence Documents: Bills of Lading (BOLs), Proof of Delivery (PODs), signed delivery receipts, and other shipping documentation uploaded for dispute resolution.
• Usage Data: Platform interaction logs, feature usage analytics, and performance telemetry to improve our services.
• Communications: Correspondence between you and Plixo, including support requests and feedback.

2. How We Use Your Information

We use the information we collect for the following purposes:

• Deduction Recovery: Analyzing shortage claims, matching claims to shipping records, calculating win probability, and generating dispute packets for retailer submission.
• Evidence Assembly: Aggregating and formatting PODs, BOLs, and tracking data into retailer-compliant dispute documentation.
• Billing and Invoicing: Calculating contingency fees based on successful recoveries and issuing invoices.
• Platform Improvement: Analyzing usage patterns to enhance our AI matching algorithms, improve win rates, and develop new features.
• Customer Support: Responding to inquiries, troubleshooting issues, and providing technical assistance.
• Legal Compliance: Meeting regulatory requirements, responding to legal requests, and protecting our rights.

3. Data Sharing and Disclosure

We do not sell, rent, or trade your personal information or business data. We may share information only in the following circumstances:

• Service Providers (Subprocessors): We use vetted third-party services to operate our platform, including Vercel (hosting and file storage), Supabase (database), Clerk (authentication), Stripe (payment processing), Resend (email communications), and EasyPost (carrier tracking). Each subprocessor is contractually bound to maintain confidentiality and implement appropriate security controls.
• At Your Direction: When you instruct us to share data, such as when generating dispute packets intended for retailer submission.
• Legal Requirements: When required by law, court order, or government authority, or to protect the rights, property, or safety of Plixo, our customers, or others.
• Business Transfers: In connection with a merger, acquisition, or sale of assets, where customer data may be transferred to the successor entity.

4. Data Storage and Security

We implement industry-standard security measures to protect your information:

• Encryption: Data is encrypted in transit (TLS 1.2+) and at rest using AES-256 encryption.
• Access Controls: Role-based access with audit logging. Access to customer data is limited to authorized personnel on a need-to-know basis.
• File Storage: Uploaded evidence documents and generated dispute packets are stored securely in Vercel Blob storage with organization-scoped access controls.
• Infrastructure: Our platform is hosted on SOC 2 compliant infrastructure with regular security assessments.

5. No Custody of Funds

Plixo does not take custody of recovered funds at any time. All payments from retailers flow directly to you through your existing payment channels with those retailers. We invoice separately for our contingency fee only after you have received the credit from the retailer.

6. Data Retention

We retain your data for as long as your account is active and as needed to provide our services. Deduction records and dispute packets are retained for a minimum of seven (7) years to support audit requirements and potential future disputes. Upon account termination, you may request data export and deletion. We will delete customer data from active systems within thirty (30) days of a verified deletion request, unless legal or regulatory obligations require longer retention.

7. Your Rights

Depending on your jurisdiction, you may have the following rights regarding your personal information:

• Access: Request a copy of the personal information we hold about you.
• Correction: Request correction of inaccurate or incomplete information.
• Deletion: Request deletion of your personal information, subject to legal retention requirements.
• Data Portability: Request an export of your data in a machine-readable format.
• Opt-Out: Opt out of marketing communications at any time.

To exercise these rights, contact us at privacy@plixo.ai. We will respond within thirty (30) days.

8. Cookies and Tracking

We use essential cookies to operate our platform and optional analytics cookies to understand usage patterns. You can control cookie preferences through your browser settings. We do not use third-party advertising cookies or sell data to advertisers.

9. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on our website with a new “Last updated” date. Your continued use of our services after such changes constitutes acceptance of the updated policy.

10. Contact Us

If you have questions about this Privacy Policy or our data practices, please contact us: