Privacy Policy
Shaw is an AI operations console for e-commerce businesses, operated by Coral Sourcing LLC ("we", "us"). This policy explains what data Shaw collects, how we use it, who we share it with, and the choices you have. It covers the Shaw console at app.shaw.ai, this website at shaw.ai, and the connections Shaw makes to third-party platforms on a business's behalf.
1. Who is responsible for your data
Shaw is used by businesses ("customers"), each with one or more store accounts and the people they invite ("users").
- For users' account information (such as name and email address), Coral Sourcing LLC is the controller.
- For data that Shaw reads from a customer's connected platforms, and for the content users create in Shaw, we act on the customer's behalf, as a processor or service provider. The customer decides which platforms to connect and who can see the data.
If you are a shopper at a store that uses Shaw and want to exercise rights over your data, contact that store first. We will help the store respond.
2. Data we collect
Account information
Your name and email address, your role in each store account you belong to, and the invitations you send or receive. When you sign in, we record the session's IP address, browser user agent, and timestamps.
Content you create in Shaw
Your messages to Shaw's AI assistant and its replies, files you upload, and what Shaw produces for you: reports, drafts, saved notes and memory, scheduled automations, and the approvals you give or decline. We also keep an audit log of actions taken in each store account.
Connection credentials
When a store admin connects a platform, Shaw stores the access token, refresh token, or API key that platform issues, along with the scopes granted, the account selected, the platform's ID for the person who approved access (for example their Meta user ID or Google account email address), and who connected it in Shaw and when.
Technical data
Our hosting provider, Cloudflare, processes request metadata such as IP addresses, request paths, and error logs to deliver and secure the service. Shaw does not use advertising or third-party analytics trackers.
3. Data from connected platforms
Shaw reads data from a platform only after a store admin connects it, and only within the access that admin grants. Shaw's scheduled sync reads and stores the data below in that store's own database. When a user asks a question or a scheduled report runs, Shaw may also read other data live from the connected platform, within the same granted access. The results can appear in the conversation and in reports, and are stored with them.
| Platform | What the sync stores |
|---|---|
| Shopify | Orders with totals, status, sales channel, tags, and the customer ID, but not customers' names, email addresses, postal addresses, or phone numbers. Also line items (product, variant, SKU, quantities, prices), refunds, and the shop's name, currency, and time zone. |
| Meta (Facebook and Instagram ads) | Daily ad-level results for the connected ad account: spend, impressions, clicks, purchases, and other conversion counts, with campaign, ad set, and ad names and IDs, and the ad account's name, currency, and time zone. |
| Google Ads | Daily campaign results: spend, impressions, clicks, conversions, and conversion value, with campaign names and IDs. |
| Google Search Console | Daily clicks, impressions, and average position for the site, by search query and by page. |
| Microsoft Advertising | Daily campaign results: spend, impressions, clicks, conversions, and revenue, with campaign names and IDs. |
| Bing Webmaster Tools | Clicks, impressions, and position for the site, by search query and by page. |
| TikTok Ads | Daily campaign results: spend, impressions, clicks, payments completed, and their value, with campaign names and IDs. |
| Klaviyo | Email campaign and flow results (recipients, deliveries, opens, clicks, orders, revenue, unsubscribes) and the newsletter list's size. Shaw's sync does not store subscriber profiles. |
| Trybe (creator content) | The store's creator campaigns and content: campaign names and status, the creators assigned and their display names, deliverables and their status, and links to the content they submit, for use in reporting and in the ads the store runs. |
Shaw does not access the personal profiles, posts, messages, or friends of people on Facebook, Instagram, or TikTok. Shaw's sync only reads, and never changes anything on a connected platform. Shaw can also make changes for a user, such as publishing an approved draft, but only with the access the store granted and only after a user approves each change in Shaw.
The permissions Shaw requests from each platform are read-only wherever the platform offers a read-only option: Shopify (read_orders, read_all_orders, read_products, read_inventory, read_locations, read_customers, read_discounts, read_price_rules, read_reports), Meta (ads_read), Klaviyo (accounts:read, campaigns:read, flows:read, lists:read, metrics:read), TikTok (ad account, ads, and reporting read access), Bing Webmaster Tools (webmaster.read), and Google (see section 4). Microsoft Advertising offers only one permission (msads.manage); Shaw uses it to read reports and account details. Trybe connects with an API key that the store creates in Trybe and can revoke there at any time.
Shopify
Shaw's sync stores the Shopify customer ID on each order, but not the customer's name or contact details. When a user asks, Shaw's assistant can look up a customer record live, within the store's granted access, for example to answer a support question; the result is kept only in that conversation.
Shaw subscribes to Shopify's mandatory privacy webhooks and honors them:
- Customer data request (
customers/data_request): we tell the store what Shaw holds about that shopper, so the store can answer them. - Customer erasure (
customers/redact): Shaw removes the shopper's customer ID from its synced orders as soon as the request arrives, and deletes anything else we hold about that shopper within 30 days. - Shop erasure (
shop/redact, sent 48 hours after a store uninstalls Shaw): Shaw deletes the store's synced Shopify data and its Shopify connection as soon as the request arrives.
When a store uninstalls Shaw, Shaw deletes its Shopify access token right away.
Meta
We use data received from Meta's platform only to provide Shaw's reporting and approved actions to the business that connected it. We do not sell it, license it, or use it for advertising, we do not share it with data brokers, and we do not combine it with other data to build profiles of people. Shaw reads ad account performance (the ads_read permission) and the Meta user ID of the person who connected the account.
When someone removes Shaw in their Facebook settings, Meta tells us and Shaw deletes its Meta connection right away. When Meta sends us a data deletion request, Shaw also deletes the connection right away, returns a confirmation code, and deletes the Meta data synced through that connection within 30 days. See Data deletion.
TikTok
Shaw reads ad performance for the TikTok advertiser accounts a store admin authorizes, through TikTok's API for Business. It does not access TikTok users' profiles, videos, or messages. We use this data only to show the store its own results, and we delete it as described in section 9.
Microsoft
Shaw reads campaign reports from Microsoft Advertising and search performance from Bing Webmaster Tools for the accounts and sites a store admin selects. We use this data only to show the store its own results.
Klaviyo
Shaw reads campaign, flow, list, and metric results from the Klaviyo account a store admin connects. Shaw's sync stores totals, not subscriber profiles.
Trybe
Shaw reads the store's creator campaigns and content from Trybe using an API key that a store admin creates in Trybe. Creator display names and the content they submit are used only for the store's reporting and the ads it runs. Shaw encrypts the API key and deletes it when the store disconnects Trybe.
4. Google user data
When a store admin connects Google, Shaw requests these permissions:
- Google Ads (
https://www.googleapis.com/auth/adwords): to read the campaign reports listed above for the Google Ads accounts the admin selects. - Search Console (
https://www.googleapis.com/auth/webmasters.readonly): read-only access to the search analytics listed above for the sites the admin selects. - Basic identity (
openid,email): the Google account email address of the person who connected, so Shaw can show which Google account a connection uses.
We use this data only to show the store's own performance in Shaw: in reports, in dashboards, and in answers from Shaw's AI assistant to that store's users. Shaw encrypts the Google tokens it stores. When the store disconnects Google in Shaw, Shaw revokes its access with Google and deletes the tokens; the synced Google data is deleted as described in section 9. You can also remove Shaw's access at myaccount.google.com/connections.
Shaw's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
In particular:
- We use Google user data only to provide and improve the user-facing features of Shaw described above.
- We transfer Google user data to others only as needed to provide those features (for example, to the AI model provider that generates an answer the user asked for), to comply with applicable law, or as part of a merger, acquisition, or sale of assets, with notice to users.
- We do not use or transfer Google user data for serving advertisements, including retargeting, personalized, or interest-based advertising.
- We do not sell Google user data, and we do not use it to determine creditworthiness or for lending.
- No person at Coral Sourcing LLC reads Google user data unless the user has given us permission for specific data, it is needed for security purposes such as investigating abuse, it is needed to comply with applicable law, or the data is aggregated and anonymized for internal operations.
- We do not use Google user data to develop, improve, or train generalized AI or machine-learning models.
5. How we use data
- To provide Shaw: syncing connected platforms, answering questions, producing reports and drafts, running scheduled automations, and carrying out actions users approve.
- To send sign-in links, invitations, and messages about the service.
- To keep Shaw secure: authenticating users, enforcing each store account's permissions, preventing abuse, and investigating incidents.
- To support users and fix problems they report.
- To comply with the law and enforce our Terms of Service.
We do not sell personal information or share it for cross-context behavioral advertising. We do not use customer data to train AI models.
6. AI processing
To answer a request, Shaw sends the user's message, the conversation so far, and the store data relevant to the request to an AI model, which returns the reply. By default the model runs on Cloudflare Workers AI. A customer may instead choose models from other providers, such as OpenAI, Anthropic, Google, xAI, DeepSeek, Moonshot AI, Perplexity, or OpenRouter. The provider processes the data to generate the response, under its terms for API customers. Shaw does not use customer data, or data from connected platforms, to train AI models.
AI output can be wrong. Shaw shows its work and asks for approval before it changes anything on a connected platform.
7. How we share data
- Service providers. Cloudflare hosts Shaw, stores its data, delivers its email, and runs its default AI models. The AI model providers a customer selects process requests as described above.
- Connected platforms. When a user approves an action, Shaw sends the needed data to the platform it acts on, for example a draft published to the store's Shopify or Klaviyo account.
- Within a customer. A store account's data is visible to the users that store has invited, according to their role.
- Legal reasons. If the law requires it, or to protect the rights, safety, or property of our users, the public, or Coral Sourcing LLC.
- Business transfers. As part of a merger, acquisition, or sale of assets, subject to this policy, with notice to users.
8. Storage and security
- Shaw runs on Cloudflare's platform. Data is stored in Cloudflare R2, D1, and Durable Objects, which Cloudflare encrypts at rest, and travels over HTTPS.
- Each store account is isolated. Its data is kept in its own storage location and database, and on every request Shaw checks that the user belongs to the store account they are trying to open.
- Tokens and keys for connected platforms are also encrypted by Shaw with AES-256-GCM, using a key held separately from the data. Each encrypted value is bound to its store account, record, and field, so it can't be decrypted if copied elsewhere.
- Users sign in with single-use email links, and each user's role in a store account limits what they can do there.
- Shaw requests read-only access wherever a platform offers it, and requires a person's approval before any change to a connected platform.
No system is perfectly secure. If we learn of a security incident that affects your data, we will notify affected customers as the law requires.
9. Retention and deletion
- We keep account information while the user's account exists.
- We keep a store account's content and synced data while the customer uses Shaw. The sync keeps up to two years of history.
- When a store admin disconnects a platform, Shaw deletes that platform's stored credentials right away.
- When a customer asks, or when a customer stops using Shaw, we delete that store account's synced data, content, and credentials within 30 days, unless the law requires us to keep something longer.
- Hosting logs expire on Cloudflare's standard schedule.
See Data deletion for step-by-step instructions.
10. Your rights and choices
Depending on where you live, you may have the right to access, correct, delete, or export your personal data, to object to or restrict its processing, and to withdraw consent. To exercise them, email privacy@shaw.ai. We will verify the request and respond within the time the law requires. You will not be treated differently for exercising these rights. If you are in the European Economic Area or the United Kingdom, you may also complain to your local data protection authority.
You can also revoke Shaw's access to a platform at any time, from Shaw's Integrations page or from the platform's own settings.
11. Cookies
The Shaw console uses a cookie to keep you signed in. Shaw does not use advertising or analytics cookies. This website sets no cookies.
12. International transfers
Cloudflare and AI model providers may process data in countries other than yours, including the United States. Where the law requires it, we rely on appropriate safeguards for these transfers, such as the European Commission's Standard Contractual Clauses.
13. Children
Shaw is a tool for businesses and is not directed to children. We do not knowingly collect personal information from anyone under 16.
14. Changes to this policy
We will post any changes on this page and update the effective date. If a change is material, we will notify customers by email or in Shaw before it takes effect.
15. Contact us
Coral Sourcing LLC
1090 Center Drive, Park City, UT 84098, USA
Phone: +1 330-400-3366
Privacy questions and requests: privacy@shaw.ai
Support: support@shaw.ai