Privacy Policy
Effective date: July 28, 2026
Real Numbers (“Real Numbers,” “we,” “us”) provides retention analytics for Shopify merchants. This policy explains what data we collect, how we use it, and the choices you have. It covers both our website at realnumbers.ai and the Real Numbers application that merchants install on their Shopify stores.
Two kinds of data, two roles
Merchant account data. When you install Real Numbers or contact us, we collect business contact information (name, email, store domain) as a data controller. We use it to operate your account, deliver reports, and provide support.
Store data processed on your behalf.When a merchant connects their Shopify store, we process order, product, and customer data from that store as a data processor, on the merchant’s instructions, solely to produce their analytics. The merchant remains the controller of their customers’ data.
What we collect from a connected store
- Orders — order totals, discounts, refunds, timestamps, fulfillment status, sales channel, and marketing attribution parameters (UTM tags, discount codes).
- Products — titles, types, vendors, and tags, used to categorize purchases.
- Customer purchase history — how many orders a customer has placed and when, so we can compute cohort retention and repeat purchase behavior.
Our Shopify integration is read-only. We never request permission to modify anything in a merchant’s store, and we never collect payment card data, full addresses, or phone numbers.
How we protect customer data
Real Numbers was designed so that analytics never require plaintext personal data:
- Customer emails are never stored in plaintext.We store a one-way SHA-256 hash for analytics (so we can recognize a returning customer without knowing who they are) and an AES-256-GCM encrypted copy that can only be decrypted by an explicit, merchant-initiated action (for example, exporting a segment to the merchant’s own email platform). Every decryption is recorded in an audit log.
- Store access tokens are encrypted at rest with AES-256-GCM.
- Each merchant’s data is isolatedat the database layer with row-level security — one store can never see another store’s data.
- All data is encrypted in transit (TLS) and at rest, and every incoming webhook from Shopify is cryptographically verified before it is processed.
- We do not use advertising trackers or sell data to anyone, ever.
Service providers
We use a small set of infrastructure providers to run Real Numbers:
- Vercel — application hosting
- Supabase — database hosting (United States)
- Anthropic — generates report narratives from pre-aggregated metrics only; raw customer records are never sent to it
- Google Workspace — business email
Each provider processes data only as needed to provide their service to us and is bound by its own data protection commitments.
Data retention and deletion
We retain store data for as long as the merchant’s account is active. When a merchant uninstalls Real Numbers, we revoke our access immediately and delete the store’s data in accordance with Shopify’s data deletion requirements. We honor Shopify’s GDPR webhooks: customer data requests, customer data erasure, and full store erasure are processed automatically.
Your rights
Depending on where you live, you may have rights to access, correct, delete, or export personal data we hold about you. If you are a merchant, contact us directly. If you are a customer of a store that uses Real Numbers, please contact that store — as the data controller, they can instruct us to act on your request, and we will.
Changes to this policy
If we make material changes, we will notify merchants by email before the changes take effect. The effective date at the top of this page always reflects the current version.
Contact
Questions about privacy or data handling: support@realnumbers.ai. We read every message.