Privacy Policy

ResultFlow, Inc. (“ResultFlow”, “we”, “us”) provides a storefront personalization platform for e-commerce merchants: our software observes how shoppers use a merchant’s store, decides in real time which page content will serve each shopper best, and measures the revenue impact against a held-back control group. We operate Muster at mustercommerce.com, the websitesresultflow.ai and resultflow.store, and apps for commerce platforms including BigCommerce, Shopify, WooCommerce, and Adobe Commerce (together, the “Service”). Muster is a ResultFlow product.

This policy explains what we collect, why, and what happens to it. It is written to be read: if anything is unclear, write to privacy [at] mustercommerce [dot] com and a person will answer.

1. Two roles: your data vs. your shoppers’ data

We handle personal information in two distinct capacities:

• As a controller (business) for information about merchants: the store owners and staff who create ResultFlow accounts, install our apps, and use our dashboard.
• As a processor (service provider) for information about shoppers: the visitors on a merchant’s storefront. We process shopper data only on the merchant’s behalf and instructions, to provide the Service to that merchant. The merchant remains the controller of its shoppers’ data and is responsible for its own storefront privacy notice and consent practices.

2. Information we collect about merchants

• Account information. Name of the store, your work email address, and a password (stored only as a modern salted hash that we cannot read), or your Google sign-in identity if you use single sign-on. Team invitations store the invitee’s email.
• Store information from your commerce platform. When you install one of our apps, the platform shares store metadata with us: store name, domain, plan, currency, timezone, country, language, and the store’s administrative contact email.
• Store content. Your product catalog (products, variants, prices, inventory, brands), product reviews, and any store knowledge you provide (FAQs, shipping and returns policies, brand assets) so our widgets and shopper assistant can answer from your own published facts.
• Order records. Order IDs, totals, currency, line items, and fulfillment status, used to attribute revenue and measure lift. See section 4 for what order records deliberately exclude.
• Access credentials. The API tokens your platform issues on install are encrypted at rest (AES-256-GCM) and are purged immediately when you uninstall.
• Connected sources you authorize. If you connect analytics or marketing accounts (for example Google Analytics 4, Google Ads, Meta Ads, or review providers such as Yotpo, Okendo, or PowerReviews), we read only the data those connections permit, solely to power your dashboard and measurement; for GA4 that means day-level aggregates, never event-level records.
• Support communications. Emails you send us and our replies.

3. Information we process about shoppers

ResultFlow is engineered to personalize without identifying anyone. Shopper data in our systems is pseudonymous by design:

• Random identifiers, not identities. Each browser is assigned a randomly generated visitor ID and session ID, created client-side and held in the browser’s local storage. They contain no personal details and are not linked to a name or email.
• Behavioral events. Page, product, and category views, on-site searches, cart additions and removals, checkout progress, purchases, scroll depth and dwell, and device/viewport/locale characteristics.
• Coarse location. Country, region, and timezone are derived from the IP address at the moment of the request, and the IP address itself is then discarded; it is never stored with shopper events.
• Shopper assistant conversations. If a shopper uses the on-store chat assistant, the conversation is stored for 90 days. Before storage, an automatic redactor strips email addresses, phone numbers, names, and street addresses a shopper may have typed.
• Order references. Order records reference a shopper only by the platform’s opaque numeric customer reference (guest checkouts have none).

What we deliberately do not collect about shoppers

Where a merchant enables optional verified shopper sign-in (so a signed-in shopper can ask “where is my order”), authentication is performed against the commerce platform and the answer is drawn from the order records described above.

A masked session-replay capability (recordings of page interactions with all typed input masked, and checkout, payment, and account pages never recorded) exists in the platform, is off by default, and is only enabled for a merchant by agreement. Recordings, where enabled, are kept for 30 days.

4. Our BigCommerce app, specifically

When a merchant installs ResultFlow from the BigCommerce App Marketplace:

• Permissions. The app requests store content access (to place widgets and storefront scripts) and read-only order access (to attribute revenue). It does not request access to BigCommerce customer records.
• What we read. Store settings, the product catalog and brands, and orders (including line items and refunds, initially up to 60 days of history) via BigCommerce’s APIs, plus a webhook notification when a new order is created.
• What we place on the storefront. Registered scripts for measurement and personalization, each declared under BigCommerce’s script consent categories (essential, functional, analytics) so the store’s cookie-consent settings govern them. Shopper events are collected via BigCommerce’s Open Data Layer only after the applicable consent is granted; buffered events are dropped if consent is declined, and stored events are erased if consent is withdrawn mid-session.
• On uninstall, our widgets and scripts are removed from the store, access tokens are purged immediately, and the store’s data is queued for deletion and erased from our systems within 30 days (see section 8).

5. How we use information

• To provide the Service: decide and render personalized storefront content in real time.
• To measure honestly: compare served experiences against a held-back control group and report lift.
• To power the merchant dashboard: analytics, shopper journeys, experiment results.
• To answer shoppers’ questions in the on-store assistant from merchant-published facts.
• To operate, secure, and debug the Service, and to meet legal obligations.
• To email merchants transactional messages (verification, password reset, team invites). We never send marketing email to shoppers.

We do not sell personal information, and we do not share it for cross-context behavioral advertising. Shopper data is used only to provide the Service to the merchant whose store it came from, never to build cross-store profiles.

6. AI features and model providers

Parts of the Service use large language models, for example to route and draft shopper assistant replies and to generate content variants from a merchant’s catalog evidence. These calls go through a single internal gateway with strict rules:

• Internal identifiers (tenant, visitor, and session IDs) are never included in what is sent to a model.
• Shopper chat text is scrubbed by the redaction step described above; models receive the scrubbed text plus retrieved facts from the merchant’s own catalog and policies.
• Many assistant answers (order status, store policies, prices, review citations) are composed deterministically and never reach a model at all.
• We do not use merchant or shopper data to train machine-learning models, and we use enterprise model endpoints (Google Cloud Vertex AI, and AWS Bedrock within our own AWS environment) under terms that do not permit the provider to train on the data.

7. Cookies, local storage, and Global Privacy Control

• On BigCommerce storefronts our identifiers live in browser local storage (keys prefixed rf), not cookies, and the scripts that set them are governed by the store’s consent settings as described in section 4.
• We honor the Global Privacy Control (GPC) signal sent by a shopper’s browser.
• Our own dashboard uses strictly necessary session cookies for merchant sign-in. We run no third-party analytics or advertising trackers on our surfaces.

8. Who we share data with (subprocessors)

We share personal information only with the infrastructure providers below, under contracts that limit their use of it to providing their service to us:

We may also disclose information if required by law, or as part of a merger, acquisition, or sale of assets (in which case this policy continues to apply to previously collected data). Aggregated or de-identified statistics that identify no one may be used to operate and improve the Service.

9. How long we keep data

Retention is enforced by an automated daily sweep that deletes expired data rather than archiving it, including object versions and backups within their backstop window.

When a merchant uninstalls our app, platform access tokens are purged immediately and the store’s data (events, orders, sessions, catalog) is deleted from our systems within 30 days. Reinstalling within that window cancels the pending deletion so an accidental uninstall does not destroy a store’s history.

10. Your rights

Depending on where you live (including under the GDPR, UK GDPR, and US state privacy laws such as the CCPA/CPRA), you may have rights to access, correct, delete, export, or restrict the processing of your personal information, and to non-discrimination for exercising them.

• Merchants: contact privacy [at] mustercommerce [dot] com from your account email.
• Shoppers: because we hold shopper data as a processor for the store you visited, the fastest route is to contact that store, and we will fulfill the store’s instruction. You may also contact us directly at privacy [at] mustercommerce [dot] com; tell us the store and, where possible, the approximate dates of your visits, and we will coordinate with the merchant.

We respond to verified requests within the time required by applicable law. On Shopify we additionally handle the platform’s automated data-request and deletion webhooks; on BigCommerce, requests are handled through the contact route above. Deleted data is tombstoned so that later processing cannot resurrect it. If you are in the EEA or UK and believe we have not resolved your concern, you may lodge a complaint with your supervisory authority.

11. Security

• All traffic is served over HTTPS/TLS; platform tokens are encrypted at rest.
• Every tenant’s data is isolated by row-level security enforced in the database itself, failing closed: a query without a proven tenant identity returns nothing.
• Merchant passwords are stored only as salted argon2id hashes.
• Internal access is role-restricted and audited; destructive operations (like erasure approvals) require an operator action that is logged.

No system is perfectly secure; if a breach affects your data we will notify you and the relevant authorities as required by law.

12. International data transfers

Our systems run in the United States. If you access the Service from elsewhere, your information is transferred to and processed in the US. For merchants subject to GDPR/UK GDPR, we enter into data-processing terms incorporating Standard Contractual Clauses on request; contact privacy [at] mustercommerce [dot] com.

13. Children

The Service is a business tool and is not directed to children under 16. We do not knowingly collect personal information from children; if you believe a child has provided us personal information, contact us and we will delete it.

14. Changes to this policy

We will post any changes on this page and update the date above. For material changes affecting merchants, we will also give notice by email or in the dashboard before the change takes effect.

15. Contact

ResultFlow, Inc., resultflow.ai
Privacy requests: privacy [at] mustercommerce [dot] com
General support: support [at] mustercommerce [dot] com, see our Support page