top of page
Syntheum-Agentic-Ecommerce-Agents.png

Privacy Policy

Hero-Bottom-Wave-Gry.png
1. Who this policy is for

Syntheum provides Search & Discovery apps for SFCC and Shopify ("the App") that replaces a merchant's storefront search with AI-powered search and a conversational shopping assistant. This policy explains what personal data the App processes, why, and the choices available.

​

It covers two groups:

  • Merchants - Store owners and their staff who install and use the App.

  • Shoppers - Visitors and customers of a merchant's storefront who use the search widget or whose orders are measured for search attribution.

For shopper data, the merchant is the data controller and Syntheum acts as a data processor on the merchant's behalf. Our processing of shopper data is also governed by our Data Processing Addendum with the merchant.

2. What data we process

2.1 Merchant data (for Shopify)

  • Store identifier and OAuth tokens - your `myshopify.com` domain and the Shopify access/refresh tokens the App uses to call the Shopify Admin API on your behalf.

  • Product catalog data - titles, types, vendors, options, tags, prices, and availability, ingested to build the search index.

  • Account and billing data - your selected plan and app usage counts, used to apply Shopify billing. Charges are processed by Shopify's Billing API; we do not receive or store your payment card details.

  • Configuration - settings such as Sophie's brand-voice text and merchandising rules.

 

​

2.2 Shopper data

  • Search queries - the text a shopper types into the search widget, plus operational signals (result count, search-confidence score, response time, and which widget surface served the result). Conversational queries are sent to our AI sub-processor to generate Sophie's response (see Section 4).

  • Search-to-purchase attribution events - via a Shopify Web Pixel, when a checkout is completed we receive the order identifier, order/line totals, currency, purchased product and variant identifiers, quantities, the storefront consent state, and an internal search identifier ("qid") that links a purchase back to the search that led to it. The order identifier is used only as a de-duplication key.

  • We do not collect shopper direct identifiers. The App does not receive or store customer names, email addresses, phone numbers, or physical addresses. The Web Pixel is built to strip such data and to send only the fields listed above.

3. Why we process it (purposes)

  • Provide the search and assistant service - index the catalog, answer keyword and conversational queries, and return product results.

  • Analytics / attribution - measure which searches lead to purchases and where search under-performs (e.g. zero-result queries), and present these insights to the merchant. This is the sole purpose for which we access protected customer data (customer events).

  • Billing - meter conversational-assistant usage to apply the merchant's Shopify plan.

  • Security and reliability - prevent abuse, debug errors, and operate the service. We process the minimum data needed for these purposes and do not use the data for any other purpose. We do not sell personal data, and we do not use it for advertising or cross-merchant profiling.

4. Sub-processors and disclosures

We share data only with infrastructure providers acting on our instructions:​

Shopper query text sent to the AI sub-processor is used only to generate a response for
that query and is not used by the sub-processor to train its models under the applicable
enterprise/API terms. We do not otherwise disclose personal data except where required by
law or to enforce our agreements.

5. Consent

​The attribution Web Pixel respects the storefront customer-privacy/consent signal: where a shopper has not permitted analytics processing (e.g. under the merchant's consent banner / regional requirements), the pixel does not capture the event. Consent is collected and managed by the merchant through Shopify's customer privacy framework.

6. Data retention

  • Shopper personal data (search queries, attribution/conversion records, and per-order attribution records) is retained for a maximum of 90 days, after which it is automatically deleted.

  • Before deletion, we roll this data up into anonymized, aggregated statistics (monthly counts and sums of search terms, zero-result rates, and attributed conversions/revenue) that contain no query identifier, order identifier, order total, or per-event timestamp. These aggregates are retained to preserve long-term product and search insights and are not personal data.

  • Merchant data is retained for the life of the installation. When the App is uninstalled, or on a verified shop-redaction request, we delete the associated data.

7. Deletion and data subject rights

We support Shopify's mandatory privacy webhooks:

  • "Customers/redact" and "shop/redact" - we delete the corresponding personal data on request.

  • "Customers/data_request" - because we do not store customer direct identifiers, we respond with the categories of data held (as described above).

Merchants and their customers may exercise applicable rights (access, deletion, objection)
by contacting the merchant, who can relay requests to us at [privacy contact]. Because the
merchant is the controller of shopper data, we act on the merchant's verified instructions.

8. Security

All data is encrypted in transit (TLS) and at rest. Access to production systems is
restricted to authorized personnel on a least-privilege basis. See the Data Processing
Addendum for the full description of technical and organizational measures.

9. International transfers

Our infrastructure providers process data on globally distributed infrastructure, including
in the United States. Where required, transfers rely on appropriate safeguards such as the
EU Standard Contractual Clauses (see the Data Processing Addendum).

10. Changes

We may update this policy; material changes will be reflected by the "Last updated" date and,
where appropriate, notified to merchants.

11. Contact

Syntheum AI, Inc., 432 Salem Street, Woburn MA 01801 - privacy@syntheum.ai

Empower Merchants with Ease and Intelligence

Syntheum is the Semantic Merchandising Platform for Agentic Commerce - powering onsite search, conversational shopping, and AI discovery through one merchandising brain your team controls.

bottom of page