Privacy Policy

Who this policy covers

• Merchants: brands that install Outfluence on their Shopify store, and their staff who use it.
• Merchants’ customers: people who buy from a store that uses Outfluence. The store decides to use Outfluence and is responsible for its customer data; we process that data on the store’s behalf, as its service provider (a “processor” under the GDPR).
• Website visitors to outfluence.co, including people who request access to the beta.

Information we collect

From Shopify, when a store installs Outfluence

• Store details: the store’s name, domain and Shopify ID.
• Staff who open the app: name and email, so we can show who started research.
• Customer records: name, email, phone number, billing and shipping addresses, when they became a customer, number of orders and total spent, and other fields the store keeps on the customer.
• Order records: products, quantities, prices, discounts, addresses, and payment and fulfillment status. We never receive full card numbers; Shopify doesn’t share them with apps.

Research about the store’s customers

For each new customer, Outfluence looks for public and licensed information to build a profile for the store. Depending on what turns up, a profile can include:

• Professional information: job title, employer, industry, career and education history.
• Public social media accounts, follower counts and a public profile photo.
• Whether they have a Wikipedia article or another public profile.
• An estimated home value for their address, from property records.
• Estimates drawn from the above: an age range, gender (only when a source states it), an estimated net worth range, whether they’re a notable customer such as a creator, executive or founder, and whether an order looks like a business purchase.
• A short written summary, with the sources each finding came from.

This research uses:

• Public web pages and search results, including public search snippets for LinkedIn profiles. We never log in to websites or access content behind a login, and we never use breached or stolen data.
• Public structured data from Wikipedia (Wikidata).
• The data providers listed below, which supply professional, social and property records.

What we don’t research or record: health, religion, ethnicity, sexual orientation, political views, union membership, criminal history, or information about children. Research instructions exclude these, and profiles are written without them.

From merchants

• Slack connection details if the store connects Slack: workspace and channel names, and an access token.
• Settings, such as plan choices and limits for extra customers.
• Billing status from Shopify. Payments are handled entirely by Shopify; we never see payment card details.

From website visitors

• Beta requests: the email, store URLs and order volume you enter, the page you were on, your IP address and browser type (to prevent spam).
• Emails you send us.

outfluence.co doesn’t use advertising or analytics cookies.

How we use information

• To provide Outfluence to the store: research, customer profiles, alerts, analytics and support.
• To help the store thank customers with surprise packages: suggesting a gift from the store’s catalog, writing a note, creating a one-time discount code and a $0 order for the store to fulfil, and, when the store chooses, emailing the customer a thank-you on the store’s behalf (see below).
• To bill through Shopify and count usage against the store’s plan.
• To keep the service secure, prevent abuse, and fix problems.
• To understand what research costs and how well it works, in aggregate.
• To meet legal obligations.

What we never do: sell personal information; use it for advertising; share one store’s customer data with another store; or use it to train AI models. Each store’s data is kept separate and is used only to provide Outfluence to that store.

Profiles are for the store’s customer relationships, such as recognising notable customers and tailoring service. Our Terms of Service forbid using Outfluence to decide anyone’s eligibility for credit, employment, insurance or housing, or for any other decision with legal or similarly significant effects.

Thank-you emails we send for stores

A store can have Outfluence email a customer a thank-you with their gift and one-time code. These emails come from the store’s name at send.outfluence.co, are delivered by Amazon Web Services, and replies go to the store. We send them only to customers who agreed to receive marketing email from the store in Shopify, and every email has a one-click unsubscribe link. To deliver them we use the customer’s name, email address, the gift and the code, and we record whether each email was delivered, opened or clicked so the store can see how its thank-you landed. When someone unsubscribes, or an email bounces or is marked as spam, we keep a hashed (unreadable) form of the address so we never email it again for that store.

Data providers and service providers

We share personal information only with the companies below, and only what each needs to do its job for us. Each processes it only to provide its service to us, under a data processing agreement or equivalent terms that restrict how it may be used. Each provider’s name links to its own privacy policy.

We may also disclose information if the law requires it, to protect people’s rights and safety, or as part of a merger or acquisition, in which case this policy continues to apply to it.

How long we keep information

• Store, customer, order and research data: while the store has Outfluence installed.
• Results from data providers are saved for up to 12 months so a customer isn’t looked up twice, then looked up again or deleted. Profile photos and profile card images are kept for up to 12 months.
• When a store uninstalls Outfluence, Shopify notifies us 48 hours later and we delete all of that store’s data.
• When a store’s customer asks to be deleted, Shopify notifies us and we delete that customer’s records, orders, research, saved lookups and images. We keep billing records of what research cost, which contain only IDs and amounts.
• Service logs: 30 days. Beta requests: until access is offered or you ask us to delete them.
• Thank-you email records (sent, delivered, opened, clicked): with the surprise package, while the store has Outfluence installed. Unsubscribes: as a hashed address, for as long as needed to honour them.

Security

Data is encrypted in transit and at rest, stored in Amazon Web Services in the United States, and accessible only to the systems that need it and a small number of authorised people. Credentials are kept in a managed secrets store. No system is perfectly secure, but we work to protect the information we hold and will notify affected stores of a breach as the law requires.

Your rights and choices

If you’re a customer of a store that uses Outfluence

The store controls your data, so the quickest route is to contact the store. You can also email us at hello@outfluence.co and we’ll work with the store to help. Depending on where you live, you may have the right to:

• know what information is held about you and get a copy;
• correct inaccurate information;
• have it deleted;
• object to profiling, or restrict how it’s used;
• opt out of the sale or sharing of personal information (we don’t sell or share it for advertising);
• stop thank-you emails sent through Outfluence, with the unsubscribe link in any of them.

We respond within the time the law requires and won’t treat you differently for using these rights. If you’re in the EU or UK and unhappy with how your data is handled, you can complain to your data protection authority.

If you’re a merchant

You can see and manage research in the app, and uninstalling deletes your store’s data as described above. You’re responsible for telling your customers how you use their data, including that you use service providers like Outfluence to learn about them, in your own privacy policy.

California

In the last 12 months we have collected the categories of information described above (identifiers, commercial information, professional information, inferences, and internet activity for website visitors) from the sources above, for the purposes above. We act as a service provider to stores for their customers’ data. We don’t sell personal information or share it for cross-context behavioural advertising, and we don’t knowingly collect information about anyone under 16.

International transfers

Outfluence stores and processes data in the United States. Where data comes from the EU, UK or another place with transfer rules, we rely on the safeguards those laws provide for, such as standard contractual clauses.

Children

Outfluence is a business tool and isn’t directed to children. We don’t knowingly research or collect information about anyone under 16, and research instructions exclude information about children.

Changes to this policy

We’ll post any changes here and update the date at the top. If a change is significant, we’ll tell merchants in the app or by email before it takes effect.

Contact us

Non Zero Sum Technologies LLC, operator of Outfluence. Email hello@outfluence.co with any question or request about privacy.