It is not a plan, nor an add-on. It is how Embaixadorz is built — and what you can hold us to.
Commitments
What holds for every store, from day one.
moneyWe never intermediate, hold or process payments. The payment link is generated with the details the ambassador registered; the money goes from your account to theirs.
data per storeEvery database query is filtered by your store. One merchant never sees another's data — and an ambassador never sees any store other than their own.
consentEvery ambassador accepts the use of their data at sign-up, with a stated purpose. Exports of personal data are logged.
clean exitUninstalled the app? Your store's data is deleted. Before that, you export whatever you want.
no passwordsThe dashboard opens inside your platform's admin, with its session. The ambassador signs in through a link of their own. We don't keep anyone's password.
In the code
For those who want to check.
headersContent-Security-Policy with a per-request nonce, HSTS with preload, nosniff, Referrer-Policy no-referrer, Permissions-Policy denying camera, microphone and geolocation.
surfaceA route that does not exist answers an identical 404. Methods not accepted, 405. Nothing internal in robots or sitemap.
secretsKeys stay out of the code and out of the logs. A public error message never reveals infrastructure.
limitsPublic routes (sign-up, sign-in) have per-IP rate limiting and bot protection.
dependenciesZero frameworks on the site. Every dependency is attack surface — it only gets in with a written justification.