Privacy Policy

Version 1.0

Effective date: 23 August 2026

Version: 1.0 Effective date: 23 August 2026 Last updated: 23 August 2026

This Privacy Policy explains how Oxbow collects, uses, discloses and protects information when merchants, authorised users and website visitors use our services.

1. Who we are

Oxbow AI, Inc. is a Delaware corporation and the primary operator of the Oxbow services. It is the primary controller of the information described in this Privacy Policy unless a contract or another notice states otherwise. Our group also includes Oxbow AI (Ireland) Limited, our Irish subsidiary.

In this Privacy Policy, “Oxbow”, “we”, “us” and “our” refer to Oxbow AI, Inc. and, where relevant, its subsidiary. You can contact us about privacy or support at support@oxbow.ai.

2. Scope of this Privacy Policy

This Privacy Policy applies to the Oxbow website, accounts, support channels, Shopify app and related financial and inventory analysis services. It covers information about:

  • merchants and businesses that use Oxbow;

  • people authorised to use Oxbow for a merchant;

  • people who contact us or visit our website; and

  • other individuals whose information may be included in data a merchant makes available to Oxbow.

This Privacy Policy does not govern Shopify’s own processing, a merchant’s independent privacy practices or third-party services that are governed by their own privacy notices.

When a merchant connects its Shopify store, the merchant determines why store information is made available to Oxbow. Depending on the circumstances and applicable law, the merchant may be the controller of that information and Oxbow may process it on the merchant’s behalf. Oxbow remains responsible for information it processes for its own business purposes, such as account administration, security and support.

3. Information merchants and users provide

We may receive information that merchants, users or other contacts provide directly, including:

  • name, work email address, business name, role and contact details;

  • account, authentication and access information;

  • store preferences, configuration and other business information;

  • support requests, feedback and communications; and

  • information supplied when exercising a privacy right or making another request.

Please do not send personal information that we have not requested or do not need to provide the service or respond to you.

4. Information received through Shopify

When a merchant installs and authorises the Oxbow Shopify app, Shopify provides access according to the permissions approved by the merchant. The current app requests permission to read products, inventory, locations, reports and orders.

To provide financial and inventory analysis, Oxbow may process and store:

  • the Shopify shop identity and domain;

  • installation status, permissions granted by the merchant and encrypted OAuth credentials;

  • store profile information and configuration;

  • products, variants, collections, SKUs, descriptions, prices and costs;

  • inventory quantities and Shopify location information;

  • order identifiers, dates, statuses, totals, taxes, refunds and shipping summaries;

  • order-line details such as product or variant identifiers, titles, quantities, SKUs, prices and tax summaries;

  • transaction amounts, currencies, gateways, types, dates and statuses; and

  • sync, webhook and Shopify privacy-request operational records.

Our current stored Shopify order mirror is designed to exclude customer names, customer contact details, customer postal addresses, payment-card and payment-instrument details, and raw Shopify order payloads. This data-minimisation design does not mean that Oxbow processes no personal data. Merchant user details, support communications, shop information, IP and security logs, and some Shopify location information may still be personal data.

5. Website, account, support and technical information

When someone visits our website, signs in, uses an Oxbow account or contacts support, we may receive technical and operational information needed to run and protect the service. This may include IP address, browser and device details, authentication or session information, event timestamps, pages or features requested, error and diagnostic information, and an approximate location derived from network information.

We also keep records of account activity and support communications where needed to administer the service, investigate problems and respond to requests.

6. How we use information

We use information described in this Privacy Policy to:

  • provide, operate and administer Oxbow;

  • connect to authorised Shopify stores and maintain installation state;

  • synchronise and organise product, inventory, location and order information;

  • produce financial, inventory and operational analysis for merchants;

  • authenticate users and manage permissions;

  • provide support and communicate about the service;

  • maintain reliability, troubleshoot errors and improve service functionality;

  • monitor, prevent and investigate fraud, abuse and security incidents;

  • comply with legal obligations and respond to valid legal or privacy requests; and

  • establish, exercise or defend legal claims and resolve disputes.

We may create aggregated or de-identified information for service operation and improvement where the information is not reasonably capable of identifying an individual.

7. Legal bases where applicable

Where the laws of the European Economic Area, the United Kingdom or another jurisdiction require a legal basis, we rely on one or more of the following, depending on the context:

  • Performance of a contract: to provide the services requested by a merchant or user and administer the related account.

  • Legitimate interests: to operate, secure, support and improve Oxbow; communicate with business users; prevent misuse; and protect our rights and those of others. We consider the impact on individuals before relying on this basis.

  • Legal obligations: to comply with applicable law, lawful requests and regulatory requirements.

  • Consent: where we ask for consent for a specific activity. Consent can be withdrawn at any time, without affecting processing that occurred before withdrawal.

In some Shopify-related processing, Oxbow acts on a merchant’s instructions. The merchant is responsible for identifying its own legal basis and giving required notices to its customers and users.

8. When we share information

We disclose information only as reasonably necessary for the purposes described in this Privacy Policy, including:

  • Service providers: companies that provide services such as hosting, data storage, authentication, communications, support, monitoring and security. They may process information only to perform services for us, subject to appropriate contractual or other safeguards.

  • Within the Oxbow group: including Oxbow AI (Ireland) Limited, where needed to operate, support and administer the service.

  • Professional advisers: lawyers, accountants, auditors, insurers and other advisers where reasonably necessary for their work.

  • Authorities and legal recipients: courts, regulators, law-enforcement bodies or other parties when we reasonably believe disclosure is required by law, is necessary to respond to valid legal process, or is needed to protect rights, safety and security.

  • Business transfers: a buyer, investor, lender or adviser in connection with a proposed or completed financing, merger, acquisition, reorganisation, sale of assets or similar transaction, subject to appropriate confidentiality protections where applicable.

  • At a merchant’s direction or with permission: where a merchant enables an integration, asks us to disclose information or otherwise authorises the disclosure.

9. Data retention and deletion

We retain information only for as long as necessary to provide and secure the service, fulfil the purposes described in this Privacy Policy, satisfy legal, accounting and reporting obligations, resolve disputes and enforce agreements.

Retention periods depend on the type of information, the relationship with the merchant or user, operational needs, legal requirements and whether the information is needed to handle a claim or privacy request. When information is no longer required, we delete or anonymise it according to Oxbow’s retention procedures and valid privacy requests, unless continued retention is required or permitted by law.

10. Shopify privacy requests and app uninstallation

Shopify provides standard privacy-request mechanisms for customers and merchants. Oxbow receives the mandatory customers/data_request, customers/redact and shop/redact notifications when applicable. We record operational information needed to track these requests and assess the information covered by each request. We do not retain the customer details contained in customers/data_request or customers/redact notifications as webhook-event payloads.

We respond to valid Shopify privacy requests in accordance with applicable requirements, the merchant’s instructions where relevant, and Oxbow’s retention procedures. Information may be retained where required or permitted by law, including to meet legal obligations or resolve disputes.

When a merchant uninstalls the Oxbow app, the installation is marked as uninstalled and Oxbow stops using the app credentials to obtain new store data. Uninstallation does not necessarily delete all previously stored information immediately. Merchants may request deletion by contacting support@oxbow.ai. We will assess the request, applicable legal requirements and any information that must be retained.

11. Data security

We use administrative, technical and organisational measures designed to protect information against unauthorised access, loss, misuse, alteration and disclosure. These measures are selected in light of the nature of the information and the risks involved and include controls intended to restrict access to people and systems that need the information for authorised purposes.

No method of transmission or storage is completely secure. We therefore cannot guarantee absolute security. If you believe an Oxbow account or information may have been compromised, contact us promptly at support@oxbow.ai.

12. International processing and transfers

Oxbow operates through entities in the United States and Ireland and uses service providers that may process information in other countries. As a result, information may be processed outside the country where it was collected, including in countries whose data-protection laws differ from local law.

Where applicable law requires a transfer mechanism or additional safeguards, we take steps designed to provide an appropriate level of protection for transferred personal data. You may contact us for more information about safeguards relevant to your information.

13. Individual privacy rights

Depending on where you live and the circumstances of the processing, you may have the right to:

  • request access to personal data we hold about you;

  • request correction of inaccurate or incomplete personal data;

  • request deletion of personal data;

  • object to or request restriction of certain processing;

  • receive certain personal data in a portable format;

  • withdraw consent where processing is based on consent; and

  • complain to a competent data-protection or privacy authority.

These rights are not absolute and may be subject to legal conditions and exceptions. We may need to verify your identity and authority before acting on a request. If Oxbow processes the relevant information only on behalf of a merchant, we may direct the request to that merchant or assist the merchant in responding.

To exercise a privacy right, email support@oxbow.ai. Please describe your relationship with Oxbow and the information or Shopify store involved so that we can identify the relevant records.

14. Children’s privacy

Oxbow is a business service and is not directed to children or intended for use by people under 18. We do not intend to collect personal data directly from children. If you believe a child has provided personal data to Oxbow, contact us so that we can investigate and take appropriate action.

15. Changes to this Privacy Policy

We may update this Privacy Policy to reflect changes to our services, data practices or legal obligations. We will post the updated version on this page and change the “Last updated” date. If a change is material, we may provide additional notice where appropriate or required by law.

16. Contact us

For privacy questions, support requests or to exercise a privacy right, contact:

Oxbow AI, Inc. Email: support@oxbow.ai