Last updated: 5 October, 2026
This Privacy Policy explains how The Aisles Ltd. (“Cayman Ecommerce”, “we”, “us”) collects, uses, shares and protects personal data when you visit https://www.caymanecommerce.com/, chat with us, request a quote, or use our client portal. We are the data controller for this information under the Cayman Islands Data Protection Act (2021 Revision) (“DPA”). Where we serve clients in the European Union or United Kingdom, we also aim to meet the standards of the GDPR / UK GDPR.
1. Who we are and how to contact us
- Business: The Aisles Ltd., registration no. CR-282372
- Address: George Town, Grand Cayman, Cayman Islands
- Privacy contact: support@caymanecommerce.com · +1 (345) 546-9678
2. The personal data we collect
| Category | What it includes | Where it comes from |
|---|---|---|
| Account & contact | Name, email, phone, company, billing address, password (stored only as a one-way hash), marketing preference, team members you invite and their roles. | You, when you register, update your profile or invite colleagues. |
| Project information | Quote requests (services, budget, timeline, website, product counts, description), project details, status history, and files you upload such as logos, brand assets, content, product data and design feedback. | You and our team, through the client portal. |
| Billing & payments | Estimates, invoices, payment amounts, dates, method, payment reference, the processor’s transaction ID, and — for card payments — only the card brand and last four digits. For bank transfers: the proof of payment you upload. | You, our payment processors and our team. |
| Card details | We never receive or store full card numbers, expiry dates or security codes. You enter them directly on the payment processor’s secure, PCI-DSS compliant page. | Collected only by the payment processor. |
| Communications | Support tickets, direct messages, attachments, live-chat conversations (including with our AI assistant), contact-form messages and emails. If you type a card number into chat, it is automatically masked before it is stored. | You and our team. |
| Security & technical | IP address, sign-in and sign-out times, failed sign-in attempts, two-factor verification events, the page you started a chat from, browser cookies and similar technologies (see section 8). | Your device and our systems, automatically. |
| Analytics (only with consent) | Pages viewed, approximate location, device and browser type, and events such as starting a quote or opening chat, collected by Google Analytics 4 with IP anonymisation. | Your device, only after you click “Accept all” on our cookie banner. |
We do not knowingly collect sensitive personal data (for example health, religion or political opinions) and ask that you do not include it in messages or uploads. Our services are for businesses and are not directed at children under 18.
3. Why we use your data, and our lawful basis
| Purpose | Lawful basis under the DPA |
|---|---|
| Creating and securing your portal account, verifying your email, two-factor sign-in | Performance of a contract; our legitimate interest in keeping accounts secure |
| Preparing quotes and estimates, delivering projects, proofing and approvals | Performance of a contract or steps you ask us to take before entering one |
| Issuing invoices, taking payments, issuing receipts and refunds, keeping accounting records | Performance of a contract; legal obligations |
| Answering questions by chat, ticket, message or email, including with our AI assistant | Performance of a contract; legitimate interest in responding efficiently |
| Showing our team your past projects and purchases when you contact us, and suggesting relevant services | Legitimate interest in giving informed, personalised support |
| Preventing fraud and abuse (rate limits, payment checks, audit logs) | Legitimate interest; legal obligations |
| Marketing emails with tips and offers | Consent — you can withdraw it at any time |
| Website analytics | Consent via our cookie banner |
4. Our AI assistant and automated estimates
Our website chat and portal use an AI assistant powered by Anthropic’s Claude models. When you chat with it, your messages and, if you are signed in, a summary of your account (projects, open invoices, services purchased) are sent to Anthropic to generate a reply. When you request a quote, the details you provide may be sent to Anthropic to draft an itemised estimate.
- AI-drafted estimates are reviewed by a member of our team before they are sent to you, unless we tell you otherwise, and prices are always limited to our published ranges.
- The assistant can only act within your own account and cannot see other clients’ information.
- You can ask to speak to a person at any time by typing “human” or pressing “Talk to a person”.
- No decision with legal or similarly significant effect is made about you solely by automated means; you may object and ask for human review.
5. Who we share data with
We do not sell personal data. We share it only with service providers who process it on our behalf, under confidentiality and data-protection obligations, and only as needed:
| Recipient | Purpose | Data shared |
|---|---|---|
| Fygaro (card payments) | Processing Visa / Mastercard payments | Amount, currency, payment reference; card details you enter on their page |
| BizPay (card payments, if offered) | Processing card payments | Amount, currency, reference, your name and email |
| WooCommerce payment gateways (if used) | Processing payments through our online checkout | Order amount, name, email, billing details |
| Our bank | Receiving and refunding bank transfers | Payment reference, amount, payer details on the transfer |
| Anthropic (AI assistant) | Generating chat replies, estimates and reply suggestions | Chat messages, quote details, account summary |
| Google Analytics (only with consent) | Understanding how the website is used | Analytics data described in section 2 |
| [hosting provider and country] | Hosting the website, database and files | All data stored in the portal |
| [Email delivery provider] | Sending verification codes, notifications and receipts | Name, email address, message content |
We may also disclose data where required by law, court order or a regulator, to protect our legal rights, or as part of a sale or reorganisation of our business (in which case your data would remain protected by this policy).
6. International transfers
Some providers above store or process data outside the Cayman Islands, including in the United States. In line with the DPA’s eighth principle, we only transfer data where the recipient provides adequate protection — for example through contractual data-protection commitments — or where the transfer is necessary to perform our contract with you.
7. How long we keep your data
| Data | Retention period |
|---|---|
| Portal account, projects, files and messages | While your account is active and for 2 years after our last project together, unless you ask us to delete it sooner |
| Invoices, payments, receipts and refunds | At least 5 years after the end of the financial year they relate to, as required for accounting and tax purposes |
| Live-chat conversations by visitors without an account | Automatically deleted after 12 months |
| Security logs (sign-ins, failed attempts, IP addresses) | Automatically deleted after 24 months; IP addresses are removed from older project history at the same point |
| Abandoned card checkouts | Cancelled automatically after 3 days |
| Marketing preferences | Until you withdraw consent |
8. Cookies and similar technologies
| Name | Purpose | Type / duration |
|---|---|---|
wordpress_logged_in_*, wordpress_sec_*, wordpress_test_cookie | Keep you signed in to the client portal securely | Essential · until you close your browser (sign-in valid up to 2 days), or 14 days if you choose “Keep me signed in” |
cecx_consent | Remembers your cookie choice | Essential · 180 days |
cecp_chat_token (browser local storage) | Lets you continue a chat conversation; only a scrambled (hashed) copy is stored on our server | Essential · until you start a new conversation or clear your browser |
_ga, _ga_* | Google Analytics statistics | Analytics · up to 2 years · only after you accept |
WooCommerce cookies (woocommerce_*, wp_woocommerce_session_*) | Checkout session, if you pay through our online checkout | Essential · up to 2 days |
Payment processors set their own cookies on their payment pages. You can change your choice at any time by clearing the cecx_consent cookie in your browser, which shows the banner again.
9. How we protect your data
- Encrypted connections (HTTPS) across the site and portal.
- Passwords stored only as salted hashes; optional and staff-mandatory two-factor sign-in; automatic lockout after repeated failed attempts.
- Uploaded files kept in a private, non-public folder and served only to your account or authorised staff.
- Payment-provider and AI keys stored encrypted; payment confirmations verified with cryptographic signatures.
- Role-based access for our staff, and an audit log of key actions.
If a personal data breach is likely to prejudice you, we will notify you and the Office of the Ombudsman without undue delay and within 5 days of becoming aware of it, as the DPA requires.
10. Your rights
Under the DPA you have the right to:
- Access the personal data we hold about you and how we use it.
- Correct inaccurate data, or have it blocked, erased or destroyed.
- Stop or restrict processing that causes you unwarranted damage or distress.
- Stop direct marketing at any time — use the unsubscribe link, your portal account settings, or contact us.
- Object to automated decisions and ask for a person to review them.
- Withdraw consent where we rely on it.
- Complain to the Office of the Ombudsman of the Cayman Islands (ombudsman.ky).
How to make a request: signed-in clients can use Account & security → Your data & privacy in the client portal to download a copy of their data or request deletion. You can also email support@caymanecommerce.com. We will confirm your identity and respond within 30 days. Some records (such as invoices and payments) must be kept for legal reasons even if you ask us to delete your account; we will tell you if this applies.
11. Third-party links and client stores
Our website may link to other sites, and payment pages are operated by the processors named above; their own privacy policies apply. Online stores we build for clients are operated by those clients, who are responsible for their own customers’ data and policies.
12. Changes to this policy
We may update this policy as our services or the law change. We will post the new version here with a new “last updated” date and, for significant changes, tell portal users by email. See also our Refund & Returns Policy and Terms of Service.
Questions about this policy? Email us · Manage your data in the client portal