AdMuse Privacy Policy
Effective Date: June 26, 2026
Last Updated: June 26, 2026
1. Who We Are
AdMuse is a Shopify application developed and operated by CGN Media Group LLC ("we," "us," or "our"). Our registered address is 5036 3rd Ave S, St Petersburg FL 33707. You can reach our privacy team at chad@tide-flow.com.
AdMuse is a voice-of-customer ad-creative engine for Shopify merchants. It reads a merchant's product data and the product's own customer reviews (stored as review metaobjects), mines recurring purchase motivations and objections from that review text, clusters them into ranked ad angles, and generates Meta/Google ad copy grounded in real customer language. AdMuse is read-only on the store — it never writes back to products. This policy explains how AdMuse collects, uses, stores, and protects data in the course of providing that service.
The most important fact in this policy: AdMuse requests only the read_products and read_metaobjects API scopes. It does not access, store, or process any end-customer personal data — no customer names, emails, phone numbers, addresses, orders, or customer identifiers. It reads the merchant's own product data and product reviews, and it treats review text as anonymous content (no reviewer names, emails, or order references are read or stored).
This policy applies to:
- Merchants who install AdMuse on their Shopify store.
Because AdMuse never touches end-customer data, there is no end-customer category of data subject for this app.
2. What Data We Collect and Why
AdMuse accesses data through the Shopify Admin API when a merchant installs the app and when a product is mined. We request only the data strictly necessary to mine voice-of-customer themes and generate ad creative. We do not perform customer exports, engage in marketing or advertising to consumers, build customer profiles, or sell any data to third parties.
2.1 Product Data (the product we generate for)
What we access: Product title, vendor, product type, tags, and the product description (descriptionHtml), for the products in the merchant's catalog.
Why: Product fields identify the item and provide the existing brand/marketing copy AdMuse uses to keep generated ad copy on-brand and contextually accurate.
Scope used: read_products
Data minimization: AdMuse reads product objects only. It never queries customers, orders, returns, fulfillments, or draft orders.
2.2 Product Review Text (the voice-of-customer corpus)
What we access: The merchant's product review metaobjects (the data an installed review app such as Judge.me or Loox writes) — the review rating and review body text, plus any refund/return signal flagged on the review. AdMuse reads this as anonymous text.
Why: Customer review language is the raw material AdMuse mines for motivations, objections, and quotable phrases — the basis of every ad angle.
Scope used: read_metaobjects
Data minimization & anonymity: AdMuse reads the review text and rating only. It does not read or store reviewer names, emails, order numbers, or any identifier that could tie a review to a specific person. Reviews are processed strictly as anonymous content.
2.3 Mined Angles & Generated Ads (the working library)
What we store: For each product the merchant works on, AdMuse stores:
- A
MinedAnglerecord per generated angle — the product reference and title, the angle id/type/title, the rationale, the verbatim anchor quote the angle is built on, a 0–100 strength score, 5-star-support and refund-signal counts, and a JSON snapshot of the mined VoC object (brand voice, motivations, objections, top quotes, stats) so creative generation can run without re-mining. - A
GeneratedAdrecord per generated creative set — the product reference and title, the angle it targets, the ad platform, the Meta primary text, 5 headlines, 2 descriptions, and the policy pre-check result (pass/flags/notes).
Why: These records are the merchant's working library — the ranked angles and generated ad copy they return to, export, and reuse. The anchor quote stored on an angle is a short, anonymous snippet of public review text the merchant chose to build creative on.
PII note: None of this is customer data. It is the merchant's own product-derived ad material and AdMuse's analysis of anonymous review text.
2.4 Settings / Configuration Data
What we store: The merchant's AdMuse configuration in a ShopSettings record: the brand-voice instructions used to keep generated ad copy on-brand, and the default ad platform (Meta/Google) the creative is framed for.
Why: Persists the merchant's preferences between sessions and drives the tone of generated ad copy.
2.5 Session Data
What we store: The Shopify offline access token issued to AdMuse after OAuth (stored in the Session table) and the merchant's shop domain. The Session table may also store the merchant account owner's first name, last name, email, locale, and account-owner flag if Shopify includes them on the session during the OAuth handshake. This is merchant/staff account data, not end-customer data.
Why: The access token is required to call the Shopify Admin API on the merchant's behalf.
3. What We Do NOT Collect
To be explicit, AdMuse does not collect, access, store, or transmit any of the following:
- Customer names, emails, phone numbers, or addresses
- Reviewer identities tied to review text (reviews are read as anonymous text only)
- Orders, line items, transactions, or payment data
- Returns or fulfillments
- Draft orders
- Any customer identifier or customer profile
AdMuse does not request the API scopes that would expose this data (read_customers, read_orders, read_returns, read_fulfillments, read_draft_orders, etc.). As a result it is exempt from Shopify's Protected Customer Data (PCD) review (see DATA-ACCESS-AND-PCD.md).
4. How We Use Your Data
We use the data described above exclusively to:
1. Mine voice-of-customer themes — extract recurring purchase motivations, objections, and quotable phrases from the product's anonymous review text.
2. Generate ranked ad angles — cluster mined themes into distinct angles (problem-solution, social-proof, objection-crusher, identity, gifting), scored by 5-star vs refund signal and anchored to verbatim quotes.
3. Generate ad copy — produce Meta/Google primary text, headlines, and descriptions per angle in the merchant's brand voice, with a built-in ad policy pre-check.
4. Run the performance feedback loop — when a merchant pastes back ad-performance metrics, explain why the winner won and propose the next batch.
5. Maintain the library and activity log — save every mined angle and generated ad set for the merchant to review, reuse, and export.
We do not use your data to advertise to consumers, build profiles, sell to third parties, or train AI models (see Section 5).
5. Subprocessors and Data Transfers
AdMuse relies on the following subprocessors:
5.1 Anthropic PBC
Role: AI inference engine (the voice-of-customer miner, angle generator, and ad-copy generator), used when a live Anthropic API key is configured.
Data received: Product copy (title and description), anonymous product review text, the brand voice string, and the chosen ad platform. No customer personal data is transmitted — AdMuse holds none, and review text is anonymized before it ever reaches the model.
Location: United States.
Training opt-out: Anthropic does not use API inputs or outputs to train their models. This is a commitment in Anthropic's API terms and applies to all API customers, including AdMuse. Merchants can verify this at https://www.anthropic.com/legal/privacy. AdMuse does not opt into any model training program.
5.2 Hosting and Database Provider
Role: Application hosting and managed Postgres database.
Data received: All data stored in the production database — MinedAngle, GeneratedAd, ShopSettings, and Session records. No customer personal data is present.
Location: United States (default). The current production provider is Render (or equivalent managed cloud provider) and is disclosed on our website at [URL].
5.3 Shopify
Role: OAuth session broker and API platform.
Data received: The Shopify OAuth flow transmits the app access token and shop domain. Shopify also transmits webhook payloads (including the GDPR webhooks) to AdMuse.
Location: Canada / United States.
We do not use any analytics, error-monitoring, or email subprocessors that receive personal data at this time. If we add such services, we will update this section.
6. Data Retention and Deletion
| Data | Retention Period | Deletion Trigger |
|---|---|---|
MinedAngle (mined ad angles + VoC snapshot) | While the app is installed | shop/redact webhook (within 48 hours of uninstall) |
GeneratedAd (generated ad-creative library) | While the app is installed | shop/redact webhook |
ShopSettings (brand voice, ad platform) | While the app is installed | shop/redact webhook |
Session (Shopify access token, optional staff name/email) | Until app uninstalled | app/uninstalled webhook, and shop/redact |
When a merchant uninstalls AdMuse, the session is deleted via the app/uninstalled webhook. All remaining shop data — every GeneratedAd, MinedAngle, ShopSettings, and Session row for that shop — is permanently deleted when Shopify sends the shop/redact webhook (typically 48 hours after uninstall). This is fully implemented in app/lib/compliance.server.ts → handleShopRedact.
7. Your Rights
7.1 GDPR Webhooks (Shopify-Mediated)
AdMuse implements all three Shopify-required GDPR compliance webhooks. Because AdMuse stores no end-customer personal data, two of them are no-data attestations:
customers/data_request — Right of Access
When Shopify sends this webhook, AdMuse returns a structured attestation stating that it processes product data and anonymous review text only and holds no customer personal data. There are no customer records to export, because none exist. (Implemented in handleCustomersDataRequest.)
customers/redact — Right to Erasure
When Shopify sends this webhook, AdMuse returns a structured "0 records redacted" attestation. There is no customer PII to erase. (Implemented in handleCustomersRedact.)
shop/redact — Merchant Erasure
When a merchant uninstalls AdMuse and Shopify sends shop/redact, AdMuse permanently deletes all GeneratedAd, MinedAngle, ShopSettings, and Session records for that shop and logs the per-table delete counts. This is the only privacy webhook that performs data deletion, because the only persisted data is the merchant's own product-derived ad material. (Implemented in handleShopRedact.)
All three webhooks are HMAC-verified by authenticate.webhook() before any handler runs.
7.2 Direct Rights Requests (Merchants)
Merchants may submit privacy requests directly by emailing chad@tide-flow.com. We will:
- Access requests: Provide a machine-readable export of all data we hold for your shop (mined angles, generated ads, settings) within 30 days.
- Erasure requests: Delete your shop's data within 30 days (or immediately on uninstall via the webhook process).
- Correction / portability: Provide or correct your data in a portable format on request.
We do not sell personal data. Because AdMuse does not collect end-customer data, end customers on a merchant's store have no AdMuse-held data; their rights under the merchant's store are exercised through the merchant and Shopify.
8. GDPR
If you are a merchant located in the European Economic Area, the United Kingdom, or Switzerland, the following applies.
Scope: AdMuse processes the merchant's own product data, anonymous product review text, and the merchant/staff account data on the Shopify session. It does not process end-customer personal data.
Legal bases for processing:
| Processing activity | Legal basis |
|---|---|
| Mining product review text and generating ad creative | Performance of a contract with the merchant (Article 6(1)(b)) / legitimate interests (Article 6(1)(f)) |
| Storing mined angles and generated ads for reuse | Legitimate interests of the merchant (Article 6(1)(f)) |
| Responding to data-subject and erasure requests | Legal obligation (Article 6(1)(c)) |
Controller / Processor: AdMuse processes the merchant's product data and anonymous review text as a processor acting on the merchant's instructions; the merchant is the controller of their product content. AdMuse does not act as a processor of end-customer data, because it does not process any.
International transfers: Data is processed in the United States by AdMuse and its subprocessors (Anthropic, hosting provider). Where required, transfers from the EEA/UK to the United States are conducted under the European Commission's Standard Contractual Clauses (SCCs). Merchants requiring specific data-residency arrangements should contact us at chad@tide-flow.com.
9. CCPA (California)
AdMuse does not collect personal information from California consumers (end customers). It processes the merchant's product data, anonymous review text, and the merchant's own account data on the Shopify session.
- Right to Know / Delete: Merchants may request disclosure or deletion of the data we hold for their shop by emailing chad@tide-flow.com.
- No sale: AdMuse does not sell, rent, or trade any data.
- Non-discrimination: We will not discriminate against you for exercising your rights.
| CCPA Category | Collected? |
|---|---|
| Identifiers (customer name, email, customer ID) | No |
| Commercial information (orders, purchases, returns) | No |
| Internet/network activity | No |
| Geolocation | No |
| Merchant account identifiers (on Shopify session) | Yes — merchant/staff, not consumer |
10. Security
Encryption in transit: All communications between AdMuse, the Shopify Admin API, and the Anthropic API use HTTPS with TLS 1.2 or higher. HTTP is rejected at the application layer and HSTS is enforced in production.
Encryption at rest: The production database is a managed Postgres instance with encryption at rest enabled (standard on managed providers such as Render). Because no customer PII is stored, the data-at-rest risk surface is limited to the merchant's own product-derived ad material and the Shopify access token.
Least-privilege access: The application's database user has only the permissions necessary to read and write its own tables. The Session table (which holds the access token) is access-controlled to the app database user; no shared superuser credential is used by the application.
API secret management: The Anthropic API key and the Shopify API secret are stored as server-side environment variables. They are never transmitted to the browser, never included in client-side code or loader responses, and never committed to source control.
Incident response: We maintain an incident-response process covering detection, containment (credential and API-key rotation, Shopify secret revocation which invalidates access tokens), merchant notification within 72 hours per GDPR where applicable, and post-incident review.
11. Not Advertising or Legal Advice
AdMuse generates ad copy and creative suggestions and runs a best-effort ad policy pre-check (Meta/Google), but its output is a tool, not a guarantee of platform approval or legal compliance. The merchant remains responsible for the claims and creative they publish, and for meeting the policies of the ad platforms they run on. The policy pre-check surfaces commonly-flagged issues but is not a substitute for the ad networks' own review.
12. Children's Data
AdMuse is a B2B tool for Shopify merchants and is not directed at children. It does not collect personal data from individuals under 13.
13. Changes to This Policy
We may update this Privacy Policy from time to time. When we make material changes, we will update the "Last Updated" date, post a notice in the AdMuse app dashboard for at least 30 days, and, for material changes to data processing, notify merchants by email. Continued use after the effective date constitutes acceptance. If you object to a change, you may uninstall the app, at which point your data is deleted per Section 6.
14. Contact Us
For privacy questions or data access/deletion requests:
CGN Media Group LLC
5036 3rd Ave S, St Petersburg FL 33707
Email: chad@tide-flow.com
Website: [URL]
For GDPR-specific inquiries, email chad@tide-flow.com with "Privacy Request" in the subject line. We aim to respond within 5 business days and to meet all statutory deadlines.
*AdMuse is a Shopify app and is not affiliated with or endorsed by Shopify Inc. Shopify's own privacy practices are governed by Shopify's Privacy Policy at shopify.com/legal/privacy.*