Where your data goes.

Reach into your systems

None. No retailer-portal credentials, no retailer-account access, nothing read from your systems, and no portal-data connector. Retail Reason does not automate actions in retailer systems.

What is sent

A request can include your question or draft, supplied context, selected references, and relevant conversation excerpts. Website file work may send selected uploads, extracted findings, generated files, and review evidence to OpenAI. Connected-client session continuity remains limited to three recent question or draft excerpts of 300 characters each. An automated second-pass answer review checks the response; no person sits between the question and the delivered answer.

Who processes it

Cloudflare hosts the service and stores website messages and files. OpenAI generates and checks answers, analyzes files, and creates results in isolated containers with networking disabled. Optional assistant providers handle their own client conversations. The subprocessor register describes these roles and the separate identity, billing, and email providers.

What Retail Reason retains

Website chat content and files are stored separately from the operational query log. Saved conversations expire 12 months after their last update; temporary conversations stay out of history and expire 24 hours after their last update. Reading does not extend expiry. You can delete sooner. Content becomes inaccessible through the product when deleted or expired; stored-file cleanup is queued and failures are retried. Provider and recovery copies have separate retention rules. Retail Reason stores no raw prompt, pasted context, or answer in its D1 query log. Up to three 300-character session excerpts expire 24 hours after the latest session write; the pasted-context field is not kept in session state. Ordinary resolved operational metadata is generally removed after 90 days. Invitation, recovery, and ordinary security or administration records may be retained for about 365 days. Necessary commercial, legal, billing, tax, refund, and approval evidence is generally retained for 7 years. Account and workspace configuration is designed to remain recoverable for 30 days after access ends. Unresolved obligations, legal holds, provider copies, and managed recovery residue follow different periods described in Privacy.

Provider use and retention

Retail Reason does not train its own models on customer content. OpenAI states that API content is not used for model training unless the customer organization affirmatively opts in. Retail Reason has disabled optional sharing of API feedback, evaluation data, and inputs and outputs. Retail Reason sets store: false and explicit-only prompt caching: only an eligible static Service-instruction and skill-workflow prefix may be cached, with the API’s currently supported minimum cache lifetime of 30 minutes; the question, context, session excerpts, per-request references, and review material follow the cache boundary. OpenAI states encrypted cache state may remain eligible for reuse for up to 24 hours under current controls, separately from abuse-monitoring logs that may contain prompts and responses for up to 30 days, with safety or legal exceptions. We do not claim zero data retention or modified abuse monitoring. File work also creates provider files and containers; Retail Reason requests their deletion after a job and retries failed cleanup. These requests do not prove immediate deletion from every recovery copy.

Identity and access

Website chat uses Retail Reason account sign-in. Claude hosted and ChatGPT connections use account sign-in. Claude Code and Codex CLI use per-person, per-account access keys that are displayed once, hashed at rest, expire after 180 days, and can be revoked immediately. Product access is determined by Retail Reason’s account, role, workspace, billing, and revocation records.

Account isolation

Each request is bound to one account and an authorized workspace. Cross-account, archived, invalid, and inaccessible workspace identifiers receive the same non-enumerating response. Client guests can access exactly one workspace and cannot see account-wide information. Other account members, including administrators, cannot open your website chats or files through the product. Authorized operational or legal access follows the Privacy Policy. Downloads let you choose what to share; chat has no public sharing link.

Compliance artifacts

No SOC 2 report. No penetration-test report. Send vulnerability disclosures to matt@retailreason.com with the subject “Security Report”; reporting guidance is in security.txt.

Who holds production access

One person, Matt Drake, the operator.

Everything an approver asks, in intake-form order, is on the vendor facts page. The named vendors and what each processes are on subprocessors.

← Back to Retail Reason