Privacy policy

This policy explains what personal data CommerceGears collects through commercegears.com, including our Magento 2 extension store, our Composer repository and our modules’ licence check, why we collect it, who we share it with and what your rights are.

Who we are

SoftAware Commerce Ltd, trading as CommerceGears, a private limited company registered in England and Wales and based in Hertfordshire, United Kingdom, is the controller of the personal data described here. Company number 12866059. Registered office: 48 Roundmoor Drive, Cheshunt, Waltham Cross, EN8 9HE, United Kingdom. For anything about your data, email info@commercegears.com.

What we collect, why, and on what basis

Data	What we use it for	Lawful basis
Enquiry form: your name, email address, message and, if you provide them, your company, store URL, platform and the kind of help you need	To read your enquiry, reply to it and, if you wish, prepare a proposal	Taking steps at your request before entering into a contract, and our legitimate interest in responding to people who contact us
Emails you send us directly, and our replies	To correspond with you	The same as for the enquiry form
Account details: name, email address, password (stored only as a secure hash)	Your account, signing in, sending your licences, invoices and order emails	Contract
Phone number on your account, if you add one in Account Information (optional)	Contacting you about your orders, licences or support requests when email is not enough	Contract; our legitimate interest in helping our customers
“Get notified” requests: your email address and the module you want to hear about	Sending you one email when that module goes on sale	Consent, which you can withdraw at any time
Billing details: name, billing address, and if you give them, company, VAT number and telephone number	Taking orders, issuing invoices, tax and accounting records	Contract; legal obligation
Orders, invoices, refunds and licences (modules, platform, update period, linked production domain)	Delivering modules and updates, renewals, refunds	Contract; legal obligation
Composer keys and downloads: public key, time, IP address, module and version of each download	Delivering modules, keeping the repository secure, detecting keys that are shared or misused	Contract; legitimate interests (security)
Licence check from your Magento installation: public key, domain, a random installation ID, Magento edition and version, names and versions of the CommerceGears modules installed, IP address	Confirming licences, linking a licence to its production domain, telling you about licence problems in your admin	Contract; legitimate interests (protecting our software)
Error reports from your Magento installation (CommerceGears Core 2.1 and later, on unless you switch them off; by default only critical errors): the type, level and message of errors raised in CommerceGears code, up to 20 lines of the stack trace (file names, line numbers and function names, no values), where the error happened (storefront, admin, cron, API or command line), when and how often; the store’s domain, the random installation ID of the licence check, your public key, the Magento edition and version, the PHP version, the deployment mode and the versions of the CommerceGears modules installed. Error messages that contain personal data are not sent.	Finding and fixing faults in our modules, and contacting you about a fault that affects your store	Legitimate interests (supporting and improving the software you use)
Support tickets: your messages, the files you attach, and our replies	Answering your questions and fixing problems	Contract
Live chat: what you write in the chat; your name and email address if you leave a message for us; your order number, email address and postcode if you ask about an order; if you are signed in, your customer number and email address (passed to the chat as a short-lived signed token); a reference to your basket; the page you are on and your browser’s time zone; any rating you give an answer	Answering you in the chat (first by our AI assistant, then by our team if needed), checking that an order is yours before showing its details, and linking an order you place after a chat to that conversation	Legitimate interests (answering people who contact us); contract where you ask about an order
Advertising measurement, only if you accept marketing cookies: Google Ads cookies, the fact that you came to our site from one of our Google ads, and for purchases the order number, order value, currency and the modules bought; with enhanced conversions also a hashed (SHA-256) form of your email address, name, phone number and billing address	Measuring which of our Google ads lead to purchases	Your consent, which you can withdraw at any time
Technical data: IP address, browser, pages requested and their time, in our web server logs	Running the site securely, preventing abuse, fixing faults	Legitimate interests (security)
A temporary count of enquiry form submissions, linked to a hashed form of your IP address	To limit spam sent through the enquiry form	Our legitimate interest in protecting the form from abuse

If you become a client, we will also hold the information needed to deliver the work and to meet our legal obligations, such as contract and invoicing records. That is covered by our agreement with you.

We do not collect any of the personal data of your own store’s customers through our modules: the licence check sends no customer, order or product data.

The emails we send are about your enquiry, your account, orders, licences and support tickets. We do not send newsletters or marketing emails, and we do not add you to a marketing list because you sent an enquiry. We advertise our modules with Google Ads and, only if you accept marketing cookies, measure which ads lead to a purchase (see Advertising and conversion measurement). We do not sell your data to anyone.

The enquiry form

When you send the form on our contact page, your enquiry is stored in this website’s database, where it is visible only to authorised users of the site’s admin area, and a copy is sent by email to our team. Your name, email address and message are required. Company, store URL, platform and the kind of help you need are optional.

The form itself does not use a third-party captcha, sets no cookies of its own and sends your details only to us. To stop automated spam it uses a hidden field, a timing check and a limit on how many messages can be sent from one IP address in a short period. That limit relies on a temporary counter that expires after about an hour. Your IP address is not saved with your enquiry.

Please do not include sensitive personal information, passwords or your customers’ data in an enquiry.

Live chat

The chat on our pages is Arasta, a live chat service that CommerceGears runs itself on a separate server (app.arasta.io), hosted by Contabo GmbH in the European Union. Its small loader script is fetched from that server on every page, so it receives your IP address and browser details in the same way as any website you load content from. Nothing else is sent until you open the chat.

When you open the chat, our AI assistant answers first, and a member of our team can join the conversation at any time; a notice in the chat says so while the AI is answering. The assistant answers from our own published information and, once you have proved that an order is yours, from that order. To show order details it asks for the order number and email address and sends a one-time code to that email; the code itself is not stored.

The chat keeps a visitor token and whether the chat window is open in your browser’s local storage, so the conversation continues from page to page. Your IP address is used briefly to limit abuse. Please do not send card details or passwords in the chat.

To run the chat we use these service providers: Anthropic, whose AI model receives the conversation to write the assistant’s answers; Voyage AI, which turns your questions and our published information into search data so the assistant can find the right answer; Twilio SendGrid for the emails the chat sends (one-time codes, replies to messages you leave); Cloudflare, which sits in front of the chat server; and Contabo, which hosts the chat server and its database in the European Union. Your conversations are not used to train AI models: we do not train models on them, Anthropic does not use data sent through its commercial API for training, and training is switched off in our Voyage AI account.

Conversations are deleted automatically once they have been inactive for longer than our retention period, which is at most 24 months. One-time codes expire after 10 minutes and the record of the page you are on after 30 minutes. Deleted data can remain in backups for up to 14 days.

Signing in with Google, Facebook or X

You can create an account or sign in with your Google, Facebook or X account instead of a password. When you choose one, you are sent to that provider’s own page, and with your permission it sends us your name, an identifier for your account with that provider and, where the provider shares it, your email address. We use this to create or find your account here and to sign you in; the lawful basis is contract. We do not receive your password for that provider, we do not post anything for you and we do not load the providers’ scripts on our pages. The provider handles the sign-in under its own privacy policy. You can disconnect a provider in your account at any time.

Release notifications (“Get notified”)

Some modules are listed on our coming soon page before they go on sale. If you click “Get notified” on one of them and enter your email address, we store that address with the name of the module. If you are signed in, we use the email address of your account instead of asking for one. When the module goes on sale we send you one email with a link to its page, and that is all: we do not add your address to a newsletter or use it for anything else, and you do not need an account.

Every email has a link that removes your address straight away, and you can also ask us to remove it. To stop automated sign-ups, the form uses a hidden field and a limit on how many sign-ups can be made from one IP address in an hour. That limit relies on a temporary counter that expires after about an hour; your IP address is not saved with your request.

Google Analytics

We use Google Analytics 4 to understand how our site is used: which pages are visited, how visitors arrive, and roughly where they are and which device and browser they use.

Before you make a choice in our cookie banner, Google’s tag runs in a restricted mode (Google Consent Mode): it sets no cookies, stores nothing in your browser and does not identify you, and only tells Google that a page was viewed and that consent has not been given. Google uses such signals, without identifying anyone, to estimate the overall number of visits and purchases. If you reject analytics cookies, this stays so for as long as your choice applies.

Only if you accept analytics cookies does Google Analytics set its cookies (listed in our cookie policy) and send usage data about your visit, including your IP address, to Google. When you place an order and have also accepted marketing cookies, we send Google Analytics the order number, value, currency and the modules bought, and a hashed (SHA-256) form of your email address, name, phone number and billing address so that the purchase can be matched to an ad you clicked (Google calls this “user-provided data collection”; see Advertising and conversion measurement). Google provides Google Analytics to us as a processor. Google Analytics 4 does not log or store IP addresses.

The lawful basis is your consent, which you can withdraw at any time with the Cookie settings link at the bottom of every page.

Advertising and conversion measurement (Google Ads)

We advertise our modules with Google Ads, a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”). To know which of our ads lead to purchases, and to pay only for advertising that works, we measure conversions. We do this only if you accept marketing cookies in our cookie banner.

Cookies. With your consent, Google’s tag sets the cookies _gcl_au (to link conversions to ads) and, if you arrived by clicking one of our Google ads, _gcl_aw (which stores the click identifier). Both are kept for 90 days. Without your consent they are not set.

Purchases. When you complete an order, we send Google the order number, the order value without tax, the currency and the modules bought (product code, name, price and quantity). Google Ads receives this through our Google Analytics account (we import the purchase from Google Analytics; no separate Google Ads conversion code runs on our pages). Free orders are not reported.

Enhanced conversions. So that a purchase can be matched to an ad click even when cookies are not available, we also send Google a hashed form (SHA-256, a one-way code calculated before anything is sent) of the email address, name, phone number and billing address of the order. Google uses this only to match the purchase to signed-in Google accounts that saw or clicked our ads, and then deletes it as described in its terms. Google processes this data for us as a processor under the Google Ads Data Processing Terms.

Lawful basis. Your consent (marketing cookies) for the cookies and for the purchase and enhanced conversion data. You can withdraw it at any time with the Cookie settings link at the bottom of every page; this does not affect measurement that happened before you withdrew it.

Transfers. Google may process this data in the United States. Transfers from the UK are covered by the UK Extension to the EU-US Data Privacy Framework and, where needed, the International Data Transfer Addendum; for visitors in the EU/EEA by the EU-US Data Privacy Framework (Google LLC is certified) and the EU standard contractual clauses.

More information: Google’s privacy policy and how Google uses information from sites that use its services.

Error reports from our modules

From CommerceGears Core 2.1, our modules report serious errors that happen in their own code to us, so that we can fix faults before they cause you trouble. Errors of Magento itself or of other vendors’ modules are never reported.

• Your choice: error reports are on by default and a notice in your Magento admin explains them. You can switch them off at any time in Stores > Configuration > CommerceGears > General; nothing is stored or sent while they are off.
• Which errors: by default only critical errors. The setting Minimum Level to Report can include all errors.
• No personal data: an error message that contains personal data, such as an e-mail address, a phone or card number, an IP address or web address parameters, is not sent; only the type of error and where it happened are reported.
• See what is sent: CommerceGears > Error Reports in your admin shows every report with the exact data sent.
• How: once an hour from Magento’s cron job, signed with your licence key (the key itself is never sent). Reports are stored in your own database first and deleted there 30 days after sending.
• Why we may process them: our legitimate interest in supporting and improving the software you licensed from us, which is also in your interest. We have balanced this against your interests: the reports are limited to technical data about our own code, messages with personal data are not sent, you can see everything that is sent, and you can switch it off.

Payments

Free modules involve no payment and no payment provider.

For paid modules we use Stripe Managed Payments: Stripe is the merchant of record, the seller to you for the payment. Stripe calculates, collects and pays VAT or sales tax, handles fraud prevention, disputes and support for the transaction, and applies refunds and consumer cooling-off rules. At checkout, Stripe’s Link may act as merchant of record and offers order management and transaction support at link.com.

You pay on Stripe’s own hosted checkout page (checkout.stripe.com), not on our site. There Stripe collects your email address, name, billing address and country (needed for tax), your card or other payment method details and, if you give them, your phone number and a business tax ID. For this payment, tax and fraud data Stripe is an independent controller under its own privacy policy (for Link: link.com/privacy).

From Stripe we receive the payment result, the amount and currency, the tax amount, the payment method type and, for cards, the card brand and last four digits, and Stripe’s customer and payment references. We never see your full card details.

Who we share data with

We do not sell personal data or share it for anyone else’s marketing. We use a small number of service providers, who process personal data for us under contract and only on our instructions:

• Stripe: payments for paid modules, as merchant of record (see Payments); for that payment data Stripe is an independent controller rather than our processor.
• Twilio SendGrid: delivering the emails we send (enquiry notifications, order confirmations, password resets, support ticket replies and release notifications).
• Google: Google Analytics and Google Ads conversion measurement, only with your consent (see Google Analytics and Advertising and conversion measurement).
• Cloudflare: the network in front of our site and repository, which protects it against attacks and abuse.
• Live chat providers: Anthropic, Voyage AI and the other providers named under Live chat, for the chat that we run ourselves (Arasta).
• OVHcloud (our hosting provider): the server that runs the website and store, the Composer repository and the licence server, and the database where enquiries are stored, in a data centre in the United Kingdom.

We may also share data with our professional advisers (such as our accountants) and with authorities where the law requires it, or where that is necessary to establish or defend a legal claim.

Our site links to other websites, including our LinkedIn page. Those sites have their own privacy notices and we are not responsible for how they handle your data.

International transfers

Some of these providers, or their sub-processors, process data outside the UK and the European Economic Area, for example in the United States. Where that happens, the transfer is protected by safeguards recognised under UK and EU data protection law, such as adequacy regulations or decisions (including the EU-US Data Privacy Framework and its UK Extension) or the EU standard contractual clauses with the UK International Data Transfer Addendum.

How long we keep data

• Enquiries and related emails: while the conversation is active and for a reasonable period afterwards, in case you come back to us, and then deleted. If an enquiry leads to a contract, the correspondence becomes part of our client records. You can ask us to delete your enquiry at any time; we will unless we have a legal reason to keep it, and we will tell you if that is the case.
• Orders, invoices and refunds: six years after the end of the financial year they belong to, as UK tax and company law requires.
• Client and accounting records: for as long as the law requires.
• Your account and licences: until you ask us to close your account. Licences stay on your account so that you keep access to the versions you are entitled to.
• Composer download and licence check records: up to two years.
• Error reports: up to 12 months after the error was last reported, then deleted.
• Live chat conversations: deleted automatically after our retention period of inactivity, at most 24 months (see Live chat).
• Support tickets: while your account exists, and up to two years after the last message.
• Phone number on your account: until you remove it from Account Information or close your account.
• Release notification requests: until the module goes on sale and we have sent you the email, then up to 12 months so that we do not email you twice, and then deleted. If a module has not gone on sale within two years of your request, we delete the request. You can remove your address at any time with the link in the email.
• Web server logs: 14 days.
• Google Analytics data: for the retention period set in Google Analytics (at most 14 months), then deleted automatically by Google.
• Google Ads cookies (_gcl_au, _gcl_aw): 90 days in your browser.
• Google Ads conversion data: for the periods set out in Google’s terms; we keep no copy of the hashed data.

Cookies

We use the cookies (and similar browser storage) that the site needs to work and, only with your consent, Google Analytics cookies and Google Ads conversion cookies. We do not use social media cookies. Each cookie, who sets it and for how long is listed in our cookie policy.

Security

The site is served only over HTTPS and sits behind Cloudflare’s security services. Passwords are stored as secure hashes, and of each Composer private key we keep only a fingerprint, so that we could not show it to anyone even if asked. Access to enquiries and customer data is limited to the people at CommerceGears who need it to reply to you, run the store and give support. No system is perfectly secure, so if we ever become aware of a breach that is likely to affect your rights, we will tell you and the regulator as the law requires.

Your rights

Under UK data protection law (the UK GDPR and the Data Protection Act 2018) you have the right to:

• ask for a copy of the personal data we hold about you;
• have inaccurate data corrected (you can change most of your account details yourself in My account);
• have your data deleted, unless we must keep it, for example invoices for tax purposes;
• restrict or object to our use of your data where we rely on legitimate interests;
• receive the data you gave us in a portable format.

We do not make decisions about you by automated means, and we do not carry out profiling.

To use any of these rights, or to close your account, email info@commercegears.com. There is no charge. We may need to confirm your identity, and we answer within one month. If you are not happy with how we handle your data, you can complain to the Information Commissioner’s Office at ico.org.uk or on 0303 123 1113, although we would appreciate the chance to put things right first.

Children

This website is aimed at businesses and developers. It is not intended for children and we do not knowingly collect personal data from them. If you believe a child has sent us personal data, contact us and we will delete it.

If you are a client: your customers’ data

When we build or support a client’s store, we may have access to personal data about that store’s customers, for example orders and accounts in a Magento or Shopify admin. In that situation the client is the data controller and SoftAware Commerce Ltd acts as a data processor. We process that data only on the client’s instructions and under a written contract that includes the data processing terms required by UK GDPR. This policy does not cover that data. Customers of a store we work on should read that store’s own privacy notice.

Changes to this policy

If we change how we use personal data, we will update this page and the date shown on it.