CommerceX Privacy & Compliance

Welcome to CommerceX, an enterprise-grade modular e-commerce framework and headless commerce engine engineered by BERALYTICS SYSTEMS ("we," "our," or "us"). This Privacy and Compliance Policy outlines how our framework handles customer transaction data, merchant storefront operations, payment orchestration, and platform telemetry in accordance with applicable laws, including the Digital Personal Data Protection Act, 2023 (DPDP Act) and global PCI-DSS standards.

1. Data Processing Architecture

CommerceX operates as a decoupled, headless, API-first architecture designed with privacy-by-design and data sovereignty principles:

• Storefront & Customer Information: Customer contact details, shipping addresses, and order histories are handled with strict tenant isolation, cryptographic encryption at rest, and role-based access control.
• Zero-Raw Card Storage: Payment transactions are handled exclusively through PCI-DSS Level 1 tokenized gateways. CommerceX never stores, logs, or transmits raw credit/debit card numbers or CVVs on application servers.
• Session & Cart Synchronization: Cart state and checkout telemetry utilize ephemeral, tamper-proof tokens with strict TTL limits to guarantee transactional integrity without invasive subscriber tracking.

2. Security & Compliance Controls

All traffic traversing CommerceX API endpoints is protected by TLS 1.3 transport encryption. Embedded transactional stores implement automated cryptographic audit trails for order mutations, catalog revisions, and administrative access.

3. Contact & Inquiries

If you have questions, data subject access requests, or regulatory inquiries regarding the CommerceX framework, please reach out to our team: