Privacy notice
CoreTrex, LLC operates CorePilot, an analytics service for merchants and their authorized teams. This notice covers CorePilot and data received from connected commerce and advertising platforms.
Information we process
When you create an account, we process your email address, name, optional profile photo, access assignments and sign-in activity. Authentication is provided by Amazon Cognito. We do not store your password in the CorePilot application database.
When you authorize a channel, we process its account identifiers, authorization credentials, products, order and sales information, and advertising reports as needed for your selected features. Shopify order responses include order identifiers, dates, line items, quantities and amounts. Our current Shopify order importer does not request customers’ names, email addresses, phone numbers or street addresses. It processes orders in memory and stores daily product totals. Shopify Analytics provides aggregate reports, including customer and session metrics where authorized.
Privacy requests sent by Shopify may include customer identifiers and contact information needed to identify the request. We encrypt these request payloads and restrict access to administrators handling the request.
How we use information
We use connected data to produce your reports, maintain integrations, provide requested support, enforce access controls, and protect the service. We process merchant customer data on the merchant’s instructions. We do not use that data to make decisions about an individual’s eligibility or legal rights, or for CoreTrex’s independent targeted advertising. CorePilot does not sell or rent connected customer data.
Who can access it
Client users can access their assigned account. Team members can access assigned clients. Authorized CoreTrex administrators can access client workspaces for administration and support. AWS provides hosting, authentication and transactional email infrastructure; the current hosting region is US East (N. Virginia). Connected platforms receive the authorized API requests needed to provide integrations. We may disclose information when legally required, subject to applicable safeguards.
Retention and deletion
Connected reports are retained for historical analytics while needed to provide the service. Disconnecting removes stored connector credentials; channel reports are scheduled for removal after 90 days. Connections already disconnected when the retention policy is introduced receive a 90-day grace period. Reconnecting before removal preserves history. Archiving pauses access and synchronization; it does not delete reports.
Authorized deletion and applicable Shopify privacy requests can require earlier removal. Access audit records and minimal completed privacy-request records are retained for 180 days. Received customer request payloads are removed when the request is fulfilled. Backups expire separately and are not used for ordinary reporting. Deletion decisions must be reapplied before restored backups are made available. Certain records may be retained where required by law or to resolve a documented security matter.
Your choices and requests
Disconnect channels through My Account → Connections. For access, correction, deletion or a restriction on processing, contact data@coretrex.com. Store customers should also contact the merchant, who controls the underlying store data. We verify identity and authority before acting on shared-account information. See our data deletion instructions.
Security and service storage
CorePilot uses HTTPS, encrypted connector credentials, server-side access checks and security activity records. No security measure eliminates every risk. Essential cookies keep you signed in; browser storage remembers dashboard preferences. We do not place advertising trackers in the CorePilot dashboard.
Contact and changes
CoreTrex, LLC · 5506 W Walsh Ln #202, Rogers, AR 72758 · data@coretrex.com. We update this notice when data practices change and provide notice of material changes as required. Updated September 17, 2026.