Effective Date: June 17, 2026
Last Updated: June 17, 2026
Reclaim is a Shopify application developed and operated by CGN Media Group LLC ("we," "us," or "our"). Our registered address is 5036 3rd Ave S, St Petersburg FL 33707. You can reach our privacy team at chad@tide-flow.com.
Reclaim is an autonomous customer-support agent for Shopify merchants. When an inbound support ticket arrives — a "where is my order" (WISMO) question, a return, exchange, cancellation, address change, or product question — Reclaim triages it, grounds its reply in the customer's real order plus fulfillment and tracking data, and proposes a guardrailed resolution (issue a refund, start a return, edit the shipping address, cancel the order, or take no action). It operates on an autonomy ladder — shadow, assisted, or autonomous — and escalates to a human when a proposed action would exceed the merchant's guardrail thresholds. This policy explains how Reclaim collects, uses, stores, and protects personal data in the course of providing that service.
This policy applies to:
Reclaim accesses data through the Shopify Admin API when a merchant installs the app and when a support ticket is triaged. We request only the data strictly necessary to resolve a ticket. All scopes are read-only. We do not perform bulk exports, engage in marketing or advertising, build independent customer profiles, or sell any data to third parties.
What we collect: The inbound support message (channel, sender name, sender email, subject, and body) as it enters Reclaim's inbox. This text frequently contains the customer's name, the order they are writing about, and the nature of their request.
Why: The ticket is the input to the entire workflow. Reclaim triages it into a structured intent (WISMO / return / exchange / cancel / address change / product question) with a confidence score, sentiment, and urgency; without it, there is no resolution to propose.
Where stored: Ticket.subject, Ticket.body, and inside Ticket.contextSnapshot.
What we access: Customer name, email address, and shipping address for the customer tied to a ticket.
Why: The customer's name and email are used to (1) match the ticket to the right customer and order, and (2) personalize and address the AI-drafted reply. The shipping address is used to answer address-change and WISMO questions accurately and to ground an address-edit proposal. We do not use this data for marketing, retargeting, or any purpose outside resolving the ticket.
Scope used: read_customers (Protected Customer Data).
Data minimization: Only the single customer tied to a ticket is read. No customer list exports, no marketing segmentation.
What we access: The order tied to a ticket (order name/number, line items, financial and fulfillment status, shipping address) and its fulfillment/tracking data (carrier, tracking number, tracking status).
Why: To ground every reply in the customer's real order rather than a guess — answering "where is my order" with the actual shipment state, confirming what was purchased before proposing a return or exchange, and checking guardrail thresholds before proposing any resolution. This is order and fulfillment data tied to the active ticket.
Scopes used: read_orders and read_fulfillments (Protected Customer Data).
Data minimization: Only the order(s) on the active ticket are read; no bulk order export, no marketing use.
What we store: For every ticket processed, Reclaim writes a Ticket record to our database. This includes:
fromName, fromEmail, subject, body).orderName / orderId).intent, confidence, sentiment, urgency, parsed entities, the AI-drafted reply (draftReply), and the proposedAction (issue_refund / start_return / edit_shipping_address / cancel_order / none).contextSnapshot field: a JSON record of exactly what the model saw — the ticket, the order, the merchant's guardrails, and the customer block — stored for reproducibility and audit.Why: The ticket log is the merchant's reproducible record of every triage — supporting dispute resolution ("what did we tell the customer, and on what basis?") and calibrating triage accuracy on the merchant's own tickets over time.
Retention: PII fields (fromName, fromEmail, subject, body, draftReply, parsed entities, and the customer/ticket/order blocks of contextSnapshot) are anonymized on a customers/redact webhook (see Section 6) and purged with all shop data on shop/redact. A scheduled retention purge of old resolved tickets is applied in production.
What we store: For every action that is executed or escalated, Reclaim writes an ActionLog row: the order name, the customer display name, the intent, the action type and params, the result, and the policy reason.
Why: To maintain an auditable record of what the agent did (or proposed and escalated), and why, against the merchant's guardrail policy.
Retention: The customer display name on related ActionLog rows is scrubbed when a customers/redact webhook is processed; operational fields (intent, action type, result, policy reason) are retained. All ActionLog rows are deleted on shop/redact.
What we store: The merchant's ShopSettings (autonomy mode — shadow / assisted / autonomous) and GuardrailPolicy (per-shop thresholds that govern when an action may be proposed, executed, or must be escalated to a human). These contain no end-customer PII.
Why: To persist the merchant's configuration and the rules that bound the agent's behavior between sessions.
Retention: Deleted on shop/redact.
What we store: The Shopify access token issued after OAuth (in the Session table), the shop domain, and — if Shopify provides them during the OAuth handshake — the merchant account owner's first name, last name, email, and locale.
Why: The access token is required to call the Shopify Admin API on the merchant's behalf.
Retention: Deleted when the app is uninstalled (app/uninstalled webhook) and on shop/redact.
We use the data described above exclusively to:
1. Triage tickets — classify the intent, confidence, sentiment, and urgency of each inbound support message.
2. Ground the reply — read the customer's real order, fulfillment, and tracking data so the drafted reply is factually accurate.
3. Propose a guardrailed resolution — suggest issuing a refund, starting a return, editing the shipping address, cancelling the order, or taking no action, bounded by the merchant's guardrail policy and autonomy mode, escalating to a human past the thresholds.
4. Log tickets and actions — maintain an auditable record for merchants to review, and to calibrate triage accuracy on the merchant's own tickets.
We do not use your data to:
> Note on order actions: In this release, Reclaim's scopes are read-only. Proposed resolutions are surfaced to the merchant (or executed within guardrails as audit-logged decisions) but order mutations are stubbed pending a future write-scoped release. Reclaim does not charge customers, move money, or write to orders in this release.
Reclaim relies on the following subprocessors, each of whom may receive personal data in order to provide the service:
Role: AI inference engine (ticket triage only).
Data received: When a live ANTHROPIC_API_KEY is configured, the ticket text (which may contain the customer's name), the related order and fulfillment data, and the merchant's guardrails are transmitted to the Anthropic API to triage the ticket and draft a grounded reply. When no API key is configured, triage runs on a fully local deterministic mock and no data leaves the app.
Location: United States.
Training opt-out: Anthropic does not use API inputs or outputs to train its models. This is a commitment in Anthropic's API Terms of Service and applies to all API customers, including Reclaim. Merchants can verify this at [https://www.anthropic.com/legal/privacy](https://www.anthropic.com/legal/privacy). Reclaim does not opt into any model training program.
Role: Application hosting and managed Postgres database.
Data received: All data stored in the production database, including Ticket records (with customer PII and contextSnapshot), ActionLog, Session, ShopSettings, and GuardrailPolicy records.
Location: United States (default — Render, Oregon, per render.yaml). Merchants requiring EU data residency should contact us before installation.
Role: Delivery of customers/data_request data exports.
Data received: The data-export JSON for a customer, when SMTP_URL is configured. If no SMTP provider is configured, exports are logged to the server console (no third party receives them).
Location: [Provider region].
Role: OAuth session broker and API platform.
Data received: The Shopify OAuth flow transmits the app access token and shop domain. Shopify also transmits GDPR webhook payloads to Reclaim.
Location: Canada / United States.
Shopify's privacy practices are governed by [Shopify's Privacy Policy](https://www.shopify.com/legal/privacy).
We do not use any analytics or error-monitoring subprocessors that receive customer PII at this time. If we add such services, we will update this section and notify merchants.
| Data | Retention Period | Deletion / Anonymization Trigger |
|---|---|---|
| Ticket PII (fromName, fromEmail, subject, body, draftReply, entities, snapshot customer/ticket/order blocks) | Until redaction or shop purge; scheduled purge of old resolved tickets in production | customers/redact (anonymize) or shop/redact (delete) |
| Ticket operational fields (intent, confidence, sentiment, urgency, proposed action) | Retained for the audit trail / metrics | shop/redact |
| ActionLog (customer display name + operational fields) | Display name scrubbed on redaction; operational fields retained | customers/redact (scrub name) or shop/redact (delete) |
| GuardrailPolicy (no PII) | Until shop redaction | shop/redact |
| ShopSettings (no PII) | Until shop redaction | shop/redact |
| Session (access token, optional merchant name/email) | Until app uninstalled | app/uninstalled, then shop/redact |
When a merchant uninstalls Reclaim, session data is deleted via the app/uninstalled webhook. All remaining shop data — including all Ticket and ActionLog records — is permanently deleted on the shop/redact webhook, which Shopify sends 48 hours after uninstall.
Reclaim implements all three Shopify-required GDPR compliance webhooks as real data operations (verified in app/lib/compliance.server.ts and wired in app/routes/webhooks.tsx):
customers/data_request — Right of Access
When a Shopify merchant or customer submits a data access request through Shopify, Shopify sends this webhook to Reclaim. We assemble a structured JSON export of every Ticket record associated with that customer (matched by email, or by the customer block in the contextSnapshot) — including the customer name/email, the ticket status, and the context snapshot the model saw — and deliver it to the configured compliance contact (via SMTP, or logged to the server console if no SMTP provider is set), within Shopify's 30-day window. We do not include other customers' PII in the export.
customers/redact — Right to Erasure
When Shopify instructs Reclaim to erase a customer's data (typically 10 days after an erasure request), we locate all Ticket records for that customer and anonymize the PII: fromName, fromEmail, subject, body, draftReply, and parsed entities are replaced with [redacted], and the customer/ticket/order blocks of the contextSnapshot are redacted. We also scrub the customer display name on related ActionLog rows. The non-PII operational fields (intent, resolution status) are retained. We respond within Shopify's required window.
shop/redact — Merchant Erasure
When a merchant uninstalls Reclaim and 48 hours elapse, Shopify sends a shop/redact webhook. We permanently delete all ActionLog, Ticket, GuardrailPolicy, ShopSettings, and Session records associated with that shop. This is fully implemented and operational.
Merchants may also submit privacy requests directly by emailing chad@tide-flow.com. We will:
We do not sell personal data. End customers on a merchant's Shopify store do not have a direct relationship with Reclaim — their rights are exercised through the merchant, who can submit a customers/redact request via Shopify's admin or directly to us at chad@tide-flow.com.
If you are located in the European Economic Area, the United Kingdom, or Switzerland, the following applies.
Legal bases for processing:
| Processing activity | Legal basis |
|---|---|
| Triaging tickets, reading the related order/fulfillment data, and proposing resolutions | Legitimate interests of the merchant (Article 6(1)(f)) — resolving customer support is a core business operation; processing is proportionate and customer data is not used for any secondary purpose |
| Storing the Ticket log, ActionLog, and contextSnapshot for audit | Legitimate interests of the merchant (Article 6(1)(f)) — merchants have a legitimate interest in an auditable record of support actions taken on their behalf |
| Responding to GDPR data-subject access and erasure requests | Legal obligation (Article 6(1)(c)) |
| Deleting data on app uninstall | Legitimate interests / contractual necessity |
Data Controller / Data Processor distinction: In relation to end-customer data, Reclaim acts as a data processor on behalf of the merchant (the data controller). The merchant's Shopify store collects and controls the customer and order data; Reclaim processes it solely to resolve support tickets as configured by the merchant. Merchants should ensure their own privacy policy discloses the use of AI-powered support tools.
International transfers: Data is processed in the United States by Reclaim and its subprocessors (Anthropic, hosting provider). Transfers from the EEA to the United States are conducted under the European Commission's Standard Contractual Clauses (SCCs) where required. Merchants requiring additional safeguards should contact us at chad@tide-flow.com.
Data Protection contact: CGN Media Group LLC handles data protection matters at chad@tide-flow.com. If you have unresolved concerns, you have the right to lodge a complaint with your local supervisory authority (e.g., the ICO in the UK, or your national data protection authority in the EU).
If you are a California resident, you have the following rights under the CCPA:
To submit a CCPA rights request, email chad@tide-flow.com with "CCPA Request" in the subject line. We will respond within 45 days.
Categories of personal information collected:
| CCPA Category | Examples | Collected? |
|---|---|---|
| Identifiers | Customer name, email, shipping address, Shopify order reference | Yes — on the Ticket row and in contextSnapshot; anonymized on customers/redact |
| Commercial information | The order tied to the ticket, line items, fulfillment/tracking status | Yes — within the ticket and action log |
| Internet/network activity | Not collected | No |
| Geolocation | Not collected | No |
| Inferences | Triage intent, confidence, sentiment, urgency, proposed action | Yes — non-PII operational fields retained for metrics |
Business purposes for collection: Ticket triage, grounding replies in real order data, proposing guardrailed resolutions, audit logging, merchant metrics. No advertising, no sale, no third-party sharing beyond disclosed subprocessors.
We take the following measures to protect personal data:
Encryption in transit: All communications between Reclaim, the Shopify Admin API, and the Anthropic API use HTTPS with TLS 1.2 or higher. HTTP connections are rejected in production and HSTS is enforced.
Encryption at rest: The production database is a managed Postgres instance with encryption at rest enabled. We verify this in the provider console before any production deployment. Database backups are encrypted.
Least-privilege access: The application's database user has only the permissions necessary to read and write its own tables — no superuser or administrative credentials. Direct database access by engineers requires per-person credentials and MFA.
API secret management: The Anthropic API key, Shopify API secret, and database connection string are stored as server-side environment variables / secrets. They are never transmitted to the browser, never included in client-side code, and never committed to source control.
Audit logging: Every compliance operation (data export, redaction, shop purge) writes an audit line. Direct database access by staff is logged with timestamp, identity, and reason.
Incident response: We maintain a written incident response plan covering detection, containment (credential rotation, token revocation), merchant notification within 72 hours per GDPR, and post-incident review.
Reclaim is a support-automation tool for Shopify merchants. We do not knowingly collect personal data from individuals under the age of 13, and the service is not directed at children. If we become aware that we have inadvertently collected data from a child under 13, we will delete it promptly.
Reclaim is operated from the United States. If you are accessing the service from outside the United States, your data will be transferred to and processed in the United States, where data protection laws may differ from those in your country. We rely on Shopify's Partner Program terms and, for EEA/UK transfers, Standard Contractual Clauses to legitimize these transfers. Merchants who require specific data residency arrangements should contact us before installing the app.
We may update this Privacy Policy from time to time to reflect changes in the service, legal requirements, or our data practices. When we make material changes, we will:
1. Update the "Last Updated" date at the top of this policy.
2. Post a notice in the Reclaim app dashboard for at least 30 days before the changes take effect.
3. For changes that materially affect how we process end-customer PII, notify merchants by email at least 30 days in advance.
Continued use of Reclaim after the effective date of a revised policy constitutes acceptance of the updated terms. If you object to any change, you may uninstall the app before the effective date, at which point all your data will be deleted per the retention schedule in Section 5.
For any privacy-related questions, data access or deletion requests, or concerns about how Reclaim handles personal data, contact us at:
CGN Media Group LLC
5036 3rd Ave S, St Petersburg FL 33707
Email: chad@tide-flow.com
For GDPR-specific inquiries or to exercise your rights as a data subject, please email chad@tide-flow.com with "Privacy Request" in the subject line. We aim to respond within 5 business days of receipt and to fulfill all statutory deadlines.
*Reclaim is a Shopify app and is not affiliated with or endorsed by Shopify Inc. Shopify's own privacy practices are governed by Shopify's Privacy Policy at shopify.com/legal/privacy.*