Last updated 21 July 2026
On this page
This Privacy Policy explains what data Cervello collects from merchants who use our AI-powered business advisor platform, why we collect it, and how it's handled. It applies whether you connect a Shopify store, import data via CSV, or otherwise use Cervello.
When you sign up, we collect the email address and password you provide (your password is hashed and managed by our authentication provider — we never see or store it in plain text).
If you connect a Shopify store, we store your store's domain and an access token that lets us read store-level data on your behalf via the Shopify Admin API, under four requested permission scopes: read_orders, read_products, read_analytics, and read_customers. In practice, order and product requests are restricted at the API level to only the fields we use — order date, total, payment status, and line items; product title, price, image, and inventory — and never include a shopper's name, email, or address, even though the underlying Shopify record contains them. The customer scope is used solely to read each customer's lifetime order count (nothing else) in order to compute one aggregate percentage: how many of your customers are repeat buyers. If you instead import data by uploading a CSV file, we store the sales, traffic, and product figures contained in that file.
From either source, we derive and store aggregate business metrics: revenue and order totals over time, traffic by channel, top-selling products, average order value, and a returning-customer rate. These are store-level numbers, not individual transaction or shopper records.
If you subscribe to a paid plan, our payment processor (Stripe) handles your card details directly — we never receive or store your full card number. We store a reference to your Stripe customer and subscription records so we can manage your plan.
Cervello is designed to work from store-level aggregates, not individual customer records. We do not request, read, or store your shoppers' names, email addresses, phone numbers, or shipping addresses. Where we read Shopify's customer data at all, it's limited to a single number per customer — their lifetime order count — used only to compute an aggregate returning-customer rate for your store.
All processing exists for one purpose: helping you understand your own store. Specifically, we use store data to:
We do not use your data to advertise to you or your shoppers, to personalize any individual shopper's experience, or to build shopper profiles. We do not sell your data or share it with data brokers.
Cervello relies on the following third-party services to operate. Each processes data only as needed to provide its service to us:
We retain your account and store data for as long as your account is active. If you uninstall Cervello from your Shopify store, Shopify notifies us and we erase the associated store and analytics records. You can request deletion of your account and all associated data at any time by contacting us — see Contact below.
We use industry-standard practices to protect your data, including encrypted connections (HTTPS) for all traffic and access tokens stored server-side rather than exposed to the browser. No method of transmission or storage is 100% secure, but we work to protect your information using commercially reasonable safeguards.
Cervello is a business tool intended for merchants and is not directed at children. We do not knowingly collect data from anyone under 16.
As a merchant, depending on where you're located, you may have rights consistent with GDPR, UK GDPR, and CCPA-style frameworks to access, correct, export, or delete the personal data we hold about you. To exercise any of these rights, contact us using the details below and we'll respond promptly.
If one of your customers contacts you asking to access or delete their data, we don't hold an identifiable record to act on directly — as explained above, we only ever process an aggregate count, never a named record. Shopify's own mandatory compliance webhooks (customer data requests, customer redaction, and shop redaction) are wired up on our end so that uninstalling or triggering one of these requests through Shopify automatically reaches us. For the full breakdown of our role as a data processor on your behalf, see our Data Processing Agreement.
We may update this policy from time to time. We'll notify you of material changes by email or in-app notice before they take effect.
Questions about this policy, or want to exercise a data right? Reach us at jesse@cervelloadvisors.com.