Privacy

What Peakbeat stores, and why

Peakbeat shows a retailer's live order outcomes during peak trading. It keeps as little personal data as that needs, and deletes it on a fixed schedule.

Last updated 13 October 2026.

What we store

• Order data. For each checkout attempt: order number, site, time, amount and currency, outcome, the reason it failed, and the products. This drives the live wall, the desk, the reports and the alerts. They show order numbers and amounts, never customer names or addresses.
• Customer email, in the care queue only. For failed orders sent to care, the customer's email address is kept so care can contact them. Only the care and admin roles can see it. It is deleted after 30 days by default.
• Hashed customer email. Elsewhere, a customer email is kept only as a keyed hash, so a retry can be matched to the failure before it. The hash cannot be turned back into an address. It is kept for 90 days by default.
• Staff names and emails. For each retailer user: email address, display name, role, and when they last signed in. This is used to sign them in and to control what they can see and change.
• Report recipients and alert channels. The email addresses a retailer chooses for its reports, and the Slack or Teams webhook address it chooses for alerts.
• Settings and audit. Each retailer's settings, with their versions, and a log of who changed what and when.
• Mail suppression. Addresses that unsubscribed or hard-bounced are kept, so they are not mailed again.
• Sign-in sessions. A random token in a browser cookie. The database holds only a hash of it.
• Billing. The plan, currency and the Razorpay subscription reference. We do not store card details.

Peakbeat reads orders from the retailer's own Salesforce B2C Commerce instance through its APIs. It does not use a data lake or a storefront script.

How long we keep it

These are the defaults. Where a range is shown, the platform owner can set a different period for a retailer within it. A clean-up job runs nightly at 03:00 UTC and deletes what is past its period.

When a retailer leaves, its data is deleted 30 days after the account is closed, or sooner on request. The deletion removes orders, care contacts, users who belong only to that retailer, settings and sessions. Only the billing record is kept, under a neutral name. In the platform owner's audit log, the email addresses and names of that retailer's people are replaced with "[removed]"; the actions and times stay.

Where it is hosted

Peakbeat runs on servers we own and operate. It does not use a public cloud provider. Retailer data is stored in our own database and is not sent to any analytics or advertising service.

Who else handles data

• Razorpay processes subscription payments. It receives the plan, a retailer reference and the email address of the person who set up billing. It does not receive order data.
• Email (reports, sign-in links, invites) is sent by Peakbeat's own mail server, not a third-party mail service.
• Salesforce Account Manager signs retailer users in. It tells Peakbeat the user's identifier, name and email address. The retailer's own B2C Commerce instance is where order data is read from.
• Slack or Microsoft Teams, only if a retailer adds a webhook. Alerts carry the retailer name, the status and the reasons in words, and a link to the wall. They carry no customer contact details.
• Your browser loads typefaces from Google Fonts on the public pages and the sign-in pages, and a charting library from cdnjs on the desk view. Those providers see the visitor's IP address as with any website.

We use no advertising or tracking cookies. The cookies we set are for sign-in and for remembering the sign-in method in that browser.

Erasure, export and closing an account

A retailer's admins handle these themselves in Settings, under Privacy. Other roles cannot use them.

• Find and erase a customer. An admin searches by the customer's email or by an order number. Peakbeat shows what it holds: the care queue contact, care notes about that customer, and the hashed email on their order attempts. Erasing removes the contact, replaces the notes' text, and clears the hashes; a later read of the same order does not bring them back. Order numbers and amounts stay, as they are not personal data on their own. The web server seals the email it receives to a public key belonging to Peakbeat's worker and stores only that sealed copy. Only the worker, which holds the private master key, can open it and hash it the same way the ledger does; the web server never holds that key. The sealed copy is dropped when the request is erased, finds nothing, fails, or is left unconfirmed for a day.
• A record of each request. Every search, erasure, export and closure request gets a reference number and is recorded with when it was made, by whom, and how many items were found and erased. The admin can download a confirmation as CSV; it carries the reference, the order number if one was searched, and counts, never the customer's email.
• Export. An admin can export the ledger (order number, time, site, status, amount, reason, cause, products), care outcomes and the report send log as CSV files, for a date range and a site. They contain no customer email or contact; report recipients appear only as a count. The files are built by the worker, can be downloaded for 24 hours, and are then deleted. Each export and download is written to the audit log.
• Closing an account. An admin can ask Peakbeat to close the account, with an export offered first. The request goes to the platform owner, who closes it; the data is then deleted 30 days later, as described above.

Anyone else can email admin@gautamlab.com to have personal data deleted or to receive a copy. Say which retailer and which address or order number it concerns. Customer emails held in the care queue are held for the retailer; a request from a customer may need to go to the retailer first.

Contract terms and a data processing agreement are provided on request.