Information we collect
We collect account information such as names, email addresses, company details, workspace membership, authentication identifiers, and support communications.
When merchants use Throttle, we process commerce data such as customers, carts, orders, subscriptions, payment status, fulfillment information, webhook configuration, application settings, and related metadata.
We also collect technical information such as IP address, device and browser details, log data, API request metadata, and usage information needed to secure, operate, and improve the service.
Payment and provider data
Throttle connects merchants to payment providers and payment orchestration services. We do not sell payment data. Sensitive payment credentials are handled according to the connector flow and are not intentionally logged. Where possible, Throttle stores non-secret connection metadata rather than raw provider secrets.
Payment card data and payment method details may be processed by our payment infrastructure providers and the merchant's selected payment providers, including Stripe when a merchant connects Stripe through Throttle.
How we use information
We use information to provide and secure Throttle, process merchant requests, support checkout and payment workflows, deliver notifications and webhooks, troubleshoot issues, prevent abuse, comply with law, and communicate about the service.
How we share information
We share information with service providers that help us operate Throttle, including infrastructure, authentication, payment orchestration, payment processing, analytics, support, email, and monitoring providers.
AI assistants. Merchants may connect Throttle to third-party AI assistants (for example ChatGPT, Claude) through our MCP server. When you authorize such a connection, the tools you invoke there read the commerce records in your workspace — orders, customers, payments, invoices, quotes, subscriptions, webhook deliveries and analytics derived from them — and return only the fields needed to answer your request. Each tool on our MCP server returns a fixed set of fields chosen for its purpose. Text a shopper can enter is not among them: names, email addresses, phone numbers, company names, any part of an address other than the country, and the item names, SKUs and descriptions a buyer can type on a quote request. Nor are the merchant's own customer identifiers, or free-text fields such as notes, comments, reasons and metadata. File downloads and exports are not available. The connection is scoped by the OAuth permissions you approve, is limited to the workspace and environment you selected, and can be revoked at any time from your dashboard. We do not receive your conversation history from the assistant, and the assistant provider's own privacy policy governs how it handles what it shows you.
Automation platforms. Merchants may also connect Throttle to automation platforms (for example Zapier) through our OAuth connectors, to move their own records into other tools they choose. An automation connection reads and writes the records its approved permissions allow, and receives the events it subscribes to. A shopper's personal data — names, email addresses, phone numbers and addresses — is included only if you grant the permission to read customers' personal data on the consent screen; without it, those fields are withheld as they are for AI assistants, and the connection cannot subscribe to event notifications, because those carry the full record. The connection is limited to the workspace and environment you selected and can be revoked at any time from your dashboard. The automation platform's own terms and privacy policy govern what it does with the data it receives, including where it sends it.
We may disclose information if required by law, to protect rights and safety, or in connection with a business transaction such as a merger, acquisition, financing, or sale of assets.
Data retention
We retain information for as long as needed to provide Throttle, comply with legal and accounting obligations, resolve disputes, enforce agreements, and maintain security and audit records. Specifically:
Commerce records. Orders, customers, payments, invoices, quotes, subscriptions, events and audit logs are kept while the merchant's workspace is active.
Operational logs. These are deleted automatically: webhook delivery records, tax-provider call logs and sent, failed or cancelled scheduled emails after 90 days; in-app notifications after 30 days; expired checkout cart sessions 7 days after they expire; and disconnected BigCommerce store connections 90 days after disconnection.
After a workspace closes. When a workspace is closed, or on a verified deletion request, we delete or anonymize its records within 30 days, except records we must keep under tax, accounting or other legal obligations, which we keep for up to 7 years. Copies held in backups are removed as those backups expire.
Security
We use administrative, technical, and organizational safeguards designed to protect information. No system is perfectly secure, but we work to limit access, separate test and live environments, and protect credentials and operational data.
Your choices
You may contact us to request access, correction, deletion, or export of personal information where applicable. Some information may be retained when required for security, legal, tax, audit, or service-continuity reasons.
International use
Throttle is operated from the United States. If you use the service from another jurisdiction, your information may be processed in the United States or other locations where our providers operate.
Changes to this policy
We may update this Privacy Policy from time to time. If we make material changes, we will update the effective date and provide additional notice when appropriate.
Contact
Questions about this Privacy Policy can be sent to support@usethrottle.dev or through the contact page.