Privacy policy

1. Who we are and what this covers

Hawkeyed (“Hawkeyed”, “we”, “us”) is an analytics app for BigCommerce stores. It keeps a complete copy of a store’s data, kept current as the store changes, and turns it into dashboards, alerts, reports and answers from Kestrel, Hawkeyed’s AI analyst.

This policy covers the Hawkeyed app (at hawkeyed.io/app and inside the BigCommerce control panel), the emails it sends, and this website. It applies to merchants and their team members who use Hawkeyed (“you”), and describes how we handle the data of the shoppers whose records are in a store we copy.

Hawkeyed is in early access. As it grows, we’ll update this policy (see Changes).

2. Controller and processor

We play two roles, depending on whose data it is:

• Your store’s data, including your shoppers’ personal data: the merchant is the controller and Hawkeyed is the merchant’s processor (or “service provider”). We process it only to provide Hawkeyed to that merchant, on the merchant’s instructions, which are given by installing and using the app. We don’t use it for our own purposes, combine it with other stores’ data, or sell it.
• Data about you as a user of Hawkeyed (your account details, settings, and how you use the app): Hawkeyed is the controller.

3. What we collect

3.1 Your account details, from BigCommerce

BigCommerce signs you in; Hawkeyed has no passwords of its own. When the app is installed and each time someone opens it from the control panel, BigCommerce sends us a signed message. From it we keep:

• the store’s identifier (its “store hash”) and the store’s name;
• for the store owner and each team member who opens Hawkeyed: their BigCommerce user ID and email address, whether they are the store owner, their role in Hawkeyed, and when they were added and last seen;
• the access token BigCommerce issues to the app, and the list of permissions (scopes) it was granted. The token is encrypted before it is stored.

Your display name is the one you enter in Settings; until you do, it’s taken from your email address.

3.2 Your store’s data

With the read-only permissions you approve at install, Hawkeyed copies your store’s data from the BigCommerce API and keeps it current with BigCommerce webhooks. The copy includes:

• orders, with their line items, shipping and billing addresses, shipments, transactions and refunds;
• customers, their addresses, customer groups, newsletter subscribers and wishlists. This is personal data about your shoppers: names, email addresses, phone numbers, postal addresses and what they bought;
• products, variants, categories, brands and inventory by location;
• coupons, promotions, channels, order statuses, metafields and store settings such as currency and time zone;
• an archive of the raw responses BigCommerce returned, compressed, so that figures can be rebuilt exactly.

Hawkeyed doesn’t request access to stored payment instruments, and BigCommerce’s API doesn’t return full card numbers.

3.3 What you and your team create in Hawkeyed

• conversations with Kestrel, including the questions you ask, its answers, the queries it ran and their results, and files you attach (images, PDFs, spreadsheets);
• memories and instructions you give Kestrel, answers you give about your business, and files you add to Memory;
• dashboards, cards, reports, alerts, workflows, skills, inbox items, preferences and feedback on answers.

3.4 Usage

• AI usage: for each Kestrel reply, the model used, the number of tokens it consumed, and when. We use it to apply fair-use limits and understand costs.
• Onboarding events: moments in a person’s first run (for example, starting the import or adding a dashboard), with who (store and user ID) and when. They don’t contain free text. We use them to improve onboarding.
• Email log: which emails Hawkeyed sent to whom and whether delivery succeeded.

3.5 Technical data

Our servers keep operational logs (requests, errors, and the store and user identifiers involved) to run, secure and debug the service. Your browser keeps a few cookies and storage entries for signing in and remembering preferences; they’re listed in the cookie policy.

3.6 Apps you connect

If you connect another app to Hawkeyed (for example Gmail, Outlook or Slack) so Kestrel or a workflow can use it, the connection is held by our integration provider, Composio, and we keep a record of which apps you connected and the permissions they granted. What Hawkeyed sends or reads through a connected app is limited to what you ask for, approve or set up in a workflow.

3.7 This website

This website doesn’t use analytics or advertising trackers and sets no cookies. If you email us, we keep your message and address to reply.

4. How we use it

• to provide Hawkeyed: copy and update your store’s data, draw dashboards, run reports and alerts, and answer questions with Kestrel;
• to sign you in through BigCommerce and check, on every visit, that the app is still installed and you still have access;
• to send the emails you’ve chosen (reports, alerts and account emails), each with a one-click unsubscribe link;
• to keep the service secure, prevent abuse, apply usage limits and fix problems;
• to support you when you contact us;
• to improve Hawkeyed, using usage information about the app, not the contents of your store.

Where the GDPR or similar laws apply, our legal bases are: performing our contract with the merchant (providing the service), our legitimate interests (security, support and improving the product), and, for data we process as a processor, the merchant’s instructions.

5. Kestrel and AI providers

Kestrel answers questions by running queries on your store’s copy and sending the conversation to an AI model. To answer, the model receives your question, a description of your store’s tables, the results of the queries Kestrel runs (which can include shoppers’ personal data when your question is about them), and any memories, instructions and attachments that apply.

Kestrel runs on Anthropic’s Claude models, through Anthropic’s commercial API. Anthropic’s commercial terms don’t allow it to train its models on content sent through the API. When Kestrel searches the web for you, the search runs through the same provider.

Hawkeyed’s code can also use models from OpenAI and Google. They aren’t turned on today; we’ll add a provider to the sub-processor list before any of your data is sent to it.

Kestrel’s queries run as a read-only database user that can only see your store’s rows. Kestrel can make mistakes; it shows the figures and queries behind its answers so you can check them.

6. Who we share it with

We don’t sell or rent personal data, and we don’t share it for advertising. We share data only:

• with our sub-processors, the companies that host and run parts of Hawkeyed for us (cloud hosting, databases, AI, email, maps and app connections), only as needed to provide the service. The current list, with what each one processes and where, is on the sub-processors page;
• with your team: people with access to your store in BigCommerce who open Hawkeyed see your store’s data; dashboards are shared with the team, while chats are private to the person who started them unless shared;
• with apps you connect, when you or a workflow you set up sends something to them;
• when the law requires it, for example in response to a valid legal request, or to protect the rights, safety and security of our users or the service;
• in a business transfer, such as a merger or acquisition, in which case this policy continues to apply to your data.

7. Where it’s stored

Your store’s copy is kept in ClickHouse Cloud on Google Cloud in the us-central1 region (Iowa, United States). Accounts, conversations, dashboards and the other things you create are kept in Convex, in the United States. The app runs on Cloudflare’s network, and our sync service runs on Railway in the United States.

If you’re outside the United States, your data is transferred to and processed there. Write to privacy@hawkeyed.io for information about the safeguards that apply to these transfers.

8. How long we keep it

While Hawkeyed is installed, we keep your store’s copy for as long as it’s installed, because the copy is the service: it holds your store’s full history. Records deleted in your store are marked deleted in the copy when BigCommerce tells us, or at a later full refresh. Things you delete in Hawkeyed (chats, memories, dashboards, cards, reports, alerts, workflows) are removed for good after a short undo window. Attachments no message uses any more are removed daily.

When you uninstall Hawkeyed, deletion is automatic:

1. At once, the store’s access token is erased and every team member’s access is removed.
2. Our sync service checks for uninstalled stores every 15 seconds and then deletes your store’s rows from every table of the copy, including the raw archive, along with its working data in our queue.
3. Then everything Hawkeyed kept about the store in Convex is deleted: conversations, memories and their files, dashboards, cards, reports, alerts, workflows, skills, inbox, preferences, feedback, AI usage, onboarding answers and events, and the email log. Connected app accounts are revoked at Composio.

We keep a minimal record that the store installed and uninstalled Hawkeyed (the store’s identifier and name, the owner’s email address, the permissions granted and the dates), with the access token erased, so that a reinstall works and we can answer questions about the account. Our hosting providers may keep backups for a limited period, after which they expire.

When a team member is removed from your store in BigCommerce, their access to Hawkeyed ends.

9. How we protect it

• Hawkeyed asks BigCommerce for read-only access only, so it can’t change your store.
• Store access tokens are encrypted with AES-256-GCM before they’re saved, and only the two services that call BigCommerce hold the key.
• Connections between your browser, BigCommerce, our services and our databases use TLS. Our database providers encrypt stored data at rest.
• Each part of Hawkeyed uses its own database user with only the access it needs. The web app and Kestrel read through read-only users limited, by the database itself, to one store’s rows.
• Every request checks that the app is still installed and that you still have access.

More on the security page. No system is perfectly secure; if we learn of a breach that affects your data, we’ll tell you without undue delay.

10. Your rights

Depending on where you live, you may have the right to access the personal data we hold about you, to correct it, to delete it, to receive a copy in a portable format, to object to or restrict some processing, and to complain to your data protection authority. To use any of these rights, write to privacy@hawkeyed.io. We’ll answer within one month, and may need to confirm that the request comes from you.

Much of it you can do yourself: change your name and preferences in Settings, delete chats and memories, turn emails off, or uninstall Hawkeyed to delete everything.

We don’t sell personal information or share it for cross-context behavioural advertising, as those terms are used in California law.

11. If you shop at a store that uses Hawkeyed

The store you bought from decides how your data is used, and Hawkeyed processes it on the store’s behalf. To access, correct or delete your data, contact the store directly. If you contact us, we’ll pass your request to the store and help it respond. When a store deletes your customer record in BigCommerce, it’s marked deleted in Hawkeyed’s copy too.

12. Cookies and storage

The app uses two cookies, both needed to keep you signed in, and stores a few preferences in your browser. This website sets none. The cookie policy lists each one with its purpose and lifetime.

13. Children

Hawkeyed is a tool for businesses and isn’t meant for children. We don’t knowingly collect personal data from children as users of the app.

14. Changes to this policy

We’ll post any change here and update the date at the top. If a change materially affects how we handle your data, we’ll tell you in the app or by email before it takes effect.

15. Contact

Privacy questions and requests: privacy@hawkeyed.io. Security issues: security@hawkeyed.io. Anything else: hello@hawkeyed.io.