Privacy Policy

By the Numbers is a Shopify analytics and segmentation app operated by Unsupervised LLC ("we", "us"). This policy covers the data we collect and process through the By the Numbers app and through bythenumbersapp.com, why we collect it, who we share it with, and the choices you have.

Information we collect

From your Shopify store

When you install By the Numbers, Shopify grants us access to your store data through Shopify's OAuth flow. This includes order history, customer records (name, email, shipping and billing address, phone number if provided), products, refunds, and discount codes. We use this data to generate the reports, segments, cohorts, RFM scores, and forecasts the app is built to produce. We never see or store your Shopify password, and we do not store payment card details — billing runs through the Shopify Billing API.

Information you provide directly

Account and contact details you give us — for example your name and email when you sign up, message support, or use the Pulse and copilot chat features — are stored so we can operate your account and respond to you.

Automatically collected data

Like most websites, bythenumbersapp.com collects standard usage data (pages visited, referrer, device and browser type, IP address) via server logs and cookies. See our Cookie Policy for the specific trackers we use and how to manage them.

How we use your data

We use the data above to operate and improve the dashboard, generate the analytics and forecasting reports you request, sync segments to the ad and email platforms you connect, provide support, and administer billing through Shopify. We do not use your Shopify customer data to advertise to your customers on our own behalf, and we do not sell your data.

Who we share data with

We share data only with the platforms required to run the product, and only for platforms you explicitly connect. Disconnecting an integration stops the sync going forward.

Shopify

Shopify is the platform of record for your store and handles billing for your subscription through the Shopify Billing API.

Klaviyo

If you connect Klaviyo, segment membership and the underlying customer profile fields needed to build that segment (name, email, and behavioral attributes such as RFM tier or lifetime value) are pushed to your Klaviyo account via the Klaviyo Profiles API, refreshed regularly. Only customers who accepted email marketing in Shopify are uploaded.

Google Ads and Google Analytics (Google user data)

If you connect a Google account, we access it through Google's OAuth consent screen and use it in the following limited ways:

• Reporting data we pull in: Google Ads spend, ROAS, and CPA, and Google Analytics sessions, conversions, and campaign/cost-per-click performance for your connected account and property. This is aggregate performance data, displayed alongside your Shopify metrics inside your By the Numbers dashboard.
• Audience data we push out: if you choose to sync a segment, we upload hashed customer contact information (email and/or phone, hashed before it leaves our servers) to Google Ads to create or update a Customer Match audience.
• Conversion events we send: if you use das Pixel, purchase events from your store are sent server-to-server to Google Ads through the Google Ads Conversion API (Enhanced Conversions). This payload includes hashed customer identifiers (email, phone, first name, last name), raw country and postal codes, ad click identifiers (such as GCLID, GBRAID, or WBRAID), and transaction details, so your campaigns get credit for conversions browser-based tracking misses.

We do not access Gmail, Drive, Contacts, Calendar, or any other personal Google account data, and we do not request scopes beyond Google Ads and Google Analytics reporting, conversion, and audience management. We do not use Google user data for any purpose other than providing this functionality to you, we do not sell it, and our access complies with Google's API Services User Data Policy.

Meta Ads

If you connect Meta, segments sync to Meta Ads Manager as Custom Audiences. If you use das Pixel, purchase events are also sent server-to-server to Meta's Conversions API. To match conversions, this payload includes customer identifiers (email, phone number, first name, last name, city, state, postal code, country, and Shopify customer ID) hashed before transmission. It also includes unhashed browser identifiers (client IP address, browser user agent, ad click ID, and Meta browser cookies such as _fbp and _fbc) and transaction amounts.

TikTok Ads

If you connect TikTok, segments sync to TikTok Ads Manager as custom audiences, using SHA-256 hashed email addresses. If you use das Pixel, purchase events are also sent server-to-server to TikTok through the Events API. This includes hashed customer identifiers (email, phone, and Shopify customer ID), unhashed client IP address, browser user agent, ad click ID (ttclid), and cookie identifiers.

Reddit Ads

If you connect Reddit Ads, segments sync to Reddit Ads as customer lists, using SHA-256 hashed email addresses. If you use das Pixel, purchase events are also sent server-to-server to Reddit's Conversions API with customer identifiers (email, phone number, customer ID, and IP address) hashed before transmission, together with the ad click ID, the shopper's browser user agent, and the Reddit browser cookie identifier.

Microsoft Ads

If you connect Microsoft Advertising, das Pixel can send server-to-server purchase and refund events to Microsoft offline conversions. This includes hashed customer identifiers (email and phone number), the Microsoft click ID (msclkid), and conversion values.

Mailchimp

If you connect Mailchimp, customers who accepted email marketing in Shopify are added to a Mailchimp audience, and consenting customers in each synced segment are placed in a Mailchimp static segment. Each contact carries their email address, name, phone number if provided, and analytics fields (total spent, order count, average order value, lifetime value, and last order date). Customers without email marketing consent are not sent.

Attentive

If you connect Attentive, customer records are sent to Attentive with a custom attribute that shows whether each customer is in the synced segment. Only customers who accepted email or SMS marketing in Shopify are sent. Each record carries their name, Shopify customer ID, and analytics attributes (total sales, order count, last order date, average order value, and lifetime value), with email included only for customers with email marketing consent and phone number included only for customers with SMS marketing consent.

Service providers

We use a cloud infrastructure provider to host the application and database, and a transactional email provider to send account and billing emails. Both process data on our behalf under contract and don't use it for their own purposes. Full detail on how we secure data with these providers is in our Security page.

Data security

Data in transit is encrypted with TLS 1.2 or higher; data at rest is encrypted with AES-256. We process and store data on managed cloud infrastructure in the United States, isolated by tenant. See Security for the full breakdown, including our incident-response and vulnerability-disclosure process.

Data retention

We retain your Shopify store data for as long as the app remains installed on your store. If you uninstall, we retain it for a limited period in case you reinstall or need an export, then delete or anonymize it, except where we're required to keep it longer for legal, tax, or dispute-resolution purposes. You can request earlier deletion at any time — see "Your rights" below.

International data transfers

Your data is processed and stored in the United States. Where a destination platform you've connected (Klaviyo, Mailchimp, Attentive, Meta, Google, TikTok, Reddit, Microsoft) processes data outside the EU, that transfer relies on Standard Contractual Clauses or another safeguard recognized under GDPR, as a condition of our integration with them.

Your rights

Depending on where you live, you may have the right to access, correct, export, restrict, or delete your personal data, and to withdraw consent where processing relies on it. We do not sell personal data for money. Where we share identifiers with advertising platforms as described above (Custom Audiences, Customer Match, das Pixel events), you can ask us to stop that sharing for your store at any time. To exercise any of these rights, email support@bythenumbersapp.com; we respond within 30 days.

GDPR compliance (EU/UK users)

For personal data processed through the By the Numbers app on behalf of a Shopify merchant, we act as a data processor and the merchant is the data controller; our Data Processing Addendum is available on request from support@bythenumbersapp.com. For data we collect directly — your own account details and bythenumbersapp.com visitor data — we act as the data controller.

We rely on the following legal bases to process personal data: performance of a contract (running the app and your subscription), consent (non-essential cookies and marketing), legitimate interests (security, fraud prevention, and improving the service), and legal obligation (tax and accounting records). In addition to the rights listed above, you have the right to object to processing based on legitimate interests, and the right to lodge a complaint with your local data protection supervisory authority at any time.

Children's privacy

By the Numbers is a business tool for Shopify merchants and is not directed at children. We do not knowingly collect personal data from anyone under 16.

Changes to this policy

If we make a material change to this policy, we'll update the date at the top of this page and, where required, notify you directly.

Contact us

Questions about this policy or how we handle your data: email support@bythenumbersapp.com or use our contact form. Security-specific reports go to security@bythenumbersapp.com.