The show is live. Your data stays controlled.

Who operates ShopStream

AMO operates ShopStream and is responsible for this policy. Privacy questions and data requests can be sent to XXX@XXX.COM.

XXX

Information we process

• Shopify store identity, installation session, and access token needed to connect the app to the merchant’s store.
• Broadcast titles, schedules, selected Shopify product and variant identifiers, product display snapshots, and show state.
• For ShopStream-native reservation pages, the shopper’s name, email address and/or phone number, optional note, requested product, variant and quantity, reservation status, consent time, and hold expiry. No payment details are requested or stored.
• To make repeated live-sale reservations a one-tap action, a native reservation page can keep the entered name, contact channel, and consent choice in that browser tab’s session storage. The details are sent to ShopStream only when the shopper reserves an item and can be cleared immediately with the page’s forget control.
• Hashed presenter pairing and refresh credentials, device display name, and LiveKit room identity. Plaintext pairing and refresh credentials are not stored.
• Hashed one-time external operator invitations and session credentials, the assigned Host or Moderator role, operator display name, and access timestamps. Plaintext credentials are not stored; access is limited to one broadcast and revoked when it ends.
• Aggregate viewer concurrency, product-click, successful cart-add, and heart, fire, or clap reaction counts for each broadcast.
• After a successful storefront cart add, its broadcast identifier and live or replay mode replace the previous ShopStream source on the Shopify cart as private attributes. Shopify can carry those attributes into the resulting order; ShopStream does not read them back.
• Presenter audio and video only when the merchant explicitly enables recording for a broadcast. A replay is private until the merchant publishes it.

What we do not build

Shopify-connected cart and reaction experiences remain anonymous to ShopStream: they do not store shopper profiles, names, email addresses, order histories, payment details, or completed-order data, and ShopStream does not read completed orders. A native reservation is the narrow exception described above; it creates neither a customer profile nor an order. Click, cart-add, and reaction events are stored only as aggregate counters. Reactions contain no text. Network addresses used for abuse prevention remain in process memory and are not written to the application database.

Why the information is used

The information above is used to authenticate merchants, prepare and operate broadcasts, pair presenter devices, issue room-scoped media credentials, render live and replay commerce experiences, keep product snapshots synchronized with Shopify, receive and personally confirm native reservation requests, prevent abuse, and diagnose service failures.

Shopify remains the system of record for connected products, carts, checkout, orders, and payments. The native catalog is reservation-only: ShopStream does not operate a separate checkout or take payment.

Service providers and transfers

ShopStream relies on Shopify for commerce and app authentication, LiveKit for real-time media, and infrastructure providers selected by the operator for application and private recording storage. These providers process information only to deliver their respective services and under their own contractual and security obligations.

Retention and deletion

• Merchants can unpublish a replay immediately and permanently delete its recording from the control room.
• Uninstalling ShopStream revokes the stored Shopify session, presenter access, and active show state.
• Shopify’s verified shop/redact request permanently deletes the store’s sessions, broadcasts, product snapshots, presenter credentials, pairing codes, and physical replay files.
• Deleted products remain only as unavailable historical broadcast snapshots until the store-level deletion lifecycle runs; they are excluded from current admin, presenter, storefront, and event reads.
• Native reservation requests are held for 24 hours unless the merchant confirms or declines them. Pending requests then expire. Cancelled and expired reservations are automatically purged after 90 days when that workspace is next accessed.
• One-tap contact details stay on the shopper’s device for the current browser-tab session and can be removed at any time with the page’s “Forget my details on this device” control. ShopStream does not synchronize this browser-only copy across devices.
• A merchant can permanently delete a cancelled or expired reservation and its contact details immediately from the standalone workspace. Confirmed requests are retained only for necessary follow-up and should be cancelled and deleted when no longer needed.

Choices, rights, and questions

Merchants can control recording and replay publication per broadcast, delete individual recordings, or uninstall the app. Depending on applicable law, people may have rights to access, correct, delete, or restrict processing of personal information. Send a request to XXX@XXX.COM with enough context to identify the relevant Shopify store. Never send passwords, access tokens, or pairing codes. For a native reservation, provide the workspace or merchant name and the reserved product instead of a Shopify store when possible.

Policy changes

Material changes will be reflected on this page with a new effective date. Changes do not expand Shopify access scopes without the merchant approval required by Shopify.