TOTEM Privacy Policy

Last updated: May 12, 2026 Effective date: May 12, 2026

This privacy policy describes how TOTEM ("we", "us", "our"), operated by Brandon Montero and his affiliates, collects, uses, and shares information when you install and use the TOTEM Shopify app (the "Service").

By installing TOTEM, you agree to the practices described here. If you do not agree, do not install the app.

1. Who this policy covers

TOTEM serves Shopify merchants (the "Merchant", "you"). This policy describes what we do with information about the Merchant, the Merchant's store, and the Merchant's customers. It does not describe what AI agents or third-party platforms do with information once it leaves TOTEM. Agents act on behalf of their own users, who have their own relationships with the agent platform.

2. Information we collect

We collect three categories of information.

2a. Merchant account information When you install TOTEM, Shopify provides us with:

• Your shop domain (e.g. yourstore.myshopify.com)
• An OAuth access token scoped to the permissions you approve
• The list of scopes you granted

We store the access token encrypted at rest using AES-256-GCM. We use it solely to make API calls to your store on your behalf.

2b. Store catalog and configuration data With the scopes you grant, we read:

• Products, variants, prices, descriptions, images, and tags
• Inventory levels per variant and per location
• Shipping zones and rates
• Business information (name, address, hours, policies) from your shop settings
• Order metadata (only when an agent creates a draft order through TOTEM)

We cache product and business data in Cloudflare KV to serve agent requests with low latency. Inventory data is fetched live from Shopify on every agent request and is not cached.

2c. Agent telemetry Every agent interaction with your TOTEM endpoint produces a telemetry record:

• Which MCP tool was called
• The query or parameters sent (e.g. the search text an agent used)
• Whether the call succeeded
• Latency
• Any errors
• A best-effort identification of which agent platform made the call (parsed from request headers)

We store this telemetry in Neon Postgres. It powers your analytics dashboard.

We do NOT collect:

• Your customers' names, email addresses, phone numbers, payment information, or shipping addresses except where they appear in a draft order an agent created through TOTEM. In those cases, we pass that information to Shopify for checkout and do not retain it.
• Payment card data. TOTEM never touches payment information. All payments process through Shopify Checkout.
• Browsing behavior of your customers. TOTEM does not run scripts on your storefront and does not see your human shoppers' activity.

3. How we use information

We use the information we collect to:

• Operate the Service (serve agent requests, sync your catalog, render your dashboard)
• Improve the Service (analyze which MCP tools and queries are common across merchants, in aggregated and de-identified form)
• Communicate with you (transactional emails about your account, important Service updates)
• Comply with legal obligations

4. How we share information

We share information only as described below.

4a. With agents that query your endpoint. When an AI agent calls your TOTEM endpoint, we respond with the product, inventory, or business data the agent requested, on your behalf. This is the core function of the Service.

4b. With service providers we use to operate TOTEM. We use:

• Shopify (your store data is read from Shopify under the scopes you grant)
• Cloudflare (Workers compute, KV cache, DNS)
• Vercel (hosts the merchant dashboard and marketing site)
• Neon (Postgres database for merchant config and telemetry)
• Resend (transactional email)
• Sentry (error monitoring)
• PostHog (product analytics, dashboard usage)

Each of these providers has its own privacy commitments. We do not share Merchant data beyond what is necessary for these providers to deliver their service to us.

4c. Aggregated, de-identified data. We may publish or share aggregated insights derived from telemetry (e.g. "the most common product search across all TOTEM stores in Q3"). These insights never identify individual Merchants or stores and never include raw query text that could re-identify a Merchant.

4d. As required by law. We may disclose information to comply with legal process, enforce our terms, or protect rights and safety. We will notify you when legally permitted before disclosure.

4e. In a corporate transaction. If TOTEM is acquired, merged, or sells substantially all its assets, Merchant information may transfer to the acquirer. We will notify you if this occurs and the acquirer will be bound by terms no less protective than this policy.

We do not sell Merchant data. We do not use Merchant data to train AI models.

5. Data retention

• Merchant account information: retained for the lifetime of your installation. Deleted within 30 days of uninstall.
• Store catalog cache: purged within 30 days of uninstall.
• Agent telemetry: retained for 90 days, then aggregated and the raw rows deleted.
• Backups: all data may persist in encrypted backups for up to 60 days after deletion before being permanently removed.

You can request earlier deletion at any time by emailing support@totemtool.xyz.

6. Your rights

You have the right to:

• Access the information we hold about your store
• Correct inaccurate information
• Delete your information (subject to legal retention requirements)
• Export your telemetry data in a portable format
• Object to certain processing

To exercise any of these rights, email support@totemtool.xyz. We respond within 30 days.

If you are located in the European Economic Area, the United Kingdom, or California, you have additional rights under GDPR, UK GDPR, and CCPA respectively. We honor those rights for all Merchants regardless of jurisdiction.

7. Security

We protect Merchant information using:

• AES-256-GCM encryption for OAuth tokens at rest
• TLS 1.2 or higher for all data in transit
• Scoped, rotating credentials for internal services
• HMAC validation on every Shopify webhook
• Cloudflare's edge security (DDoS protection, rate limiting, bot defense)

No system is perfectly secure. If we discover a breach affecting your information, we will notify you within 72 hours of discovery.

8. International data transfers

TOTEM is operated from the United States. Our infrastructure providers operate globally. By using TOTEM, you consent to the transfer of information to the United States and other countries where our providers operate. Where required, we rely on appropriate safeguards (such as Standard Contractual Clauses) for cross-border transfers.

9. Children's privacy

TOTEM is a business-to-business product. It is not directed to anyone under 18. We do not knowingly collect information from minors.

10. Changes to this policy

We may update this policy. If we make material changes, we will notify you by email and post the new effective date at the top of this page at least 14 days before the change takes effect. Continued use of the Service after the effective date constitutes acceptance of the updated policy.

11. Contact

Questions, requests, or concerns:

TOTEM Email: support@totemtool.xyz