ManyMuse

Privacy Policy

Last updated: October 30, 2026

ManyMuse (“ManyMuse”, the “Service”) is an operations platform for merchants who sell online. It connects a merchant’s existing services — such as their storefront, marketplace and advertising accounts, warehouses and shipping providers — and shows that merchant their orders, stock, suppliers and customers in one place: sending orders to the right warehouse, answering customers, handling returns, reordering stock, and what their business actually earned. This policy explains what data we handle, why, and how we protect it.

Who we are

The Service is operated by Going Marketplaces B.V. (“we”, “us”), the data controller responsible for this policy:

  • Controller: Going Marketplaces B.V.
  • Registered address: De Nieuwe Erven 3, Unit 10942, 5431NV Cuijk, Netherlands
  • Contact: merlijn@commo-dore.com
  • VAT: NL860870170B01
  • Chamber of Commerce (KvK): 77005848

Who this policy is for

ManyMuse is a business-to-business tool used by a merchant (the “workspace”) and its agents. We process end-customer data on behalf of that workspace, as a data processor, under the workspace’s instructions. Each workspace controls its own data and its relationship with its customers.

Data we handle

  • Account data — the email address and role of each agent who signs in.
  • Data imported from connected services, only for the workspace that connected them: order and fulfillment details, product and inventory data, customer contact details (name, email, shipping address), and support conversations. This is imported from services the workspace explicitly connects — currently Amazon (Selling Partner API), Shopify, Etsy, bol.com, ChannelDock, SendCloud, ShipStation and PostNL — and support email the workspace forwards to its ManyMuse support address.
  • Data from the ManyMuse app on the Shopify App Store — orders and customer details (name, email, phone, shipping address) from a store that installed it. Used only to show that store’s orders and run its returns inside Shopify admin (customer service and store management). It is never used for customer segments or email-marketing exports, it is never sent to an AI service, and the App Store app cannot link a store to a ManyMuse web workspace. When a store uninstalls the app, ManyMuse stops reading it; Shopify’s deletion request for the store, sent 48 hours later, deletes that store’s orders, customers and returns and its access token, and a customer’s deletion request erases that customer’s details.
  • Amazon advertising data, only if the workspace connects its own Amazon Ads account (Amazon Ads API): for each day, the advertising spend, impressions and clicks of each campaign and each advertised product; for each advertised product, the sales Amazon attributes to it and the resulting advertising cost of sale (ACoS) and return on ad spend; and the name, marketplace, currency and time zone of each advertising profile the account can access. If the workspace uploads an Amazon advertising report instead, we keep that file and the figures read from it. These are the merchant’s own campaign figures; they contain no personal data about shoppers.
  • Operational records — an append-only event log of meaningful actions (for audit), and settings the workspace configures.

How we use data

Solely to provide the service to the workspace that owns it: resolving a customer’s identity across their connected services, displaying their history to agents, operating support workflows (such as returns), and reporting the workspace’s own profit and loss — including placing advertising cost in the month it was incurred and against the products it was spent on. We do not sell data, and we do not use one workspace’s data to serve another. Any AI-assisted features operate only within the workspace’s own data.

How we store and protect it

  • Data is isolated per workspace and access is enforced at the database level (row-level security).
  • Integration credentials are stored encrypted in a dedicated secrets vault, never exposed to the browser.
  • Access is limited to the workspace’s authenticated agents and to cross-customer admin reads that are audited.

Amazon advertising data

Amazon advertising data is read from an advertiser’s account only after that advertiser authorises ManyMuse through Amazon’s own consent screen, and only to show that advertiser their own business. It is never shared with, exported to, or made available to any third party; it is never pooled across advertisers, used to benchmark one advertiser against another, or combined into an aggregated or anonymised data product. Disconnecting the Amazon Ads account in ManyMuse deletes the stored authorisation and stops every further read. When Amazon or the advertiser instructs us to delete Amazon advertising data, we delete it within the period Amazon’s data protection terms require (currently 72 hours from Amazon’s notice).

Sub-processors

These are the providers that process data on our behalf in order to run the Service. Each is bound by data-processing terms, and each was assessed against data-security standards at least as strict as our own before we shared any data with it. This list is complete and is kept current here rather than supplied on request.

  • Vercel — application hosting and edge network. Deployed in the EU (Frankfurt).
  • Supabase — managed PostgreSQL database, authentication, and the encrypted secrets vault.
  • Amazon Web Services — receiving the support email a workspace forwards to us (Amazon SES, Stockholm); our encrypted off-site copy of the database backup (Amazon S3, Ireland); and, when a workspace moves its support history from another helpdesk, temporary storage of that export (Amazon S3), deleted by the import job.
  • Anthropic — AI model provider, for optional AI-assisted features: customer support: drafting, translating and scoring replies, and categorising, summarising and searching conversations (a reply draft receives the customer’s name, their order numbers, dates, items, status and tracking, and the city, postcode and country of their shipping address, never the street address or phone number, and never an Amazon buyer’s name or address fetched through Amazon’s restricted-data process); listing and brand drafting, whose input can include search terms from the seller’s Amazon Brand Analytics reports that the seller chose as target keywords; product research; product research for a business’s own brands, whose input can include search terms and figures from its own Amazon Brand Analytics reports; analysing product and device photos a workspace supplies; reading the products, quantities, prices and supplier details in purchase orders, invoices and packing lists a workspace uploads; drafting push notification copy from a goal the sender types and the audience’s name and size, never individual customer data; and keeping a workspace’s internal knowledge base from its own notes. Contractually barred from using the data to train models.
  • OpenAI — text embeddings, used for search and retrieval within a workspace’s own data; speech-to-text for dictation; drafting help articles from a workspace’s own support replies, with customer names and contact details removed; drafting a brand’s marketing emails from its own product facts, voice notes and anonymised customer phrases; and generating product and brand images.
  • Google — generating product and brand images (Gemini models).
  • Replicate — upscaling generated images.
  • Resend — transactional email delivery (for example, sending a return label to a customer).
  • Klaviyo and Mailchimp — email marketing platforms a workspace can export customer segments to. Only email addresses with recorded email-marketing consent are sent, and each export is recorded with what left and what was withheld.

That is the complete list. Each is bound by a data processing agreement, and personal data leaving the EU is covered by Standard Contractual Clauses, an adequacy decision, or the EU–US Data Privacy Framework.

What we share, and with whom

Beyond the sub-processors above, we share workspace data with nobody. Specifically: we do not share it with advertising networks or data brokers, we do not share one workspace’s data with another workspace, and we do not aggregate data across workspaces to produce or sell insights to anyone. We do not sell data.

The services a workspace connects — Amazon (including Amazon Ads), Shopify, Etsy, bol.com, ChannelDock, SendCloud, ShipStation, PostNL, Xero — are a different relationship: the workspace chooses them, holds its own account with each, and authorises us to read from and write to that account on its behalf. We act on the workspace’s instruction there; we do not disclose one connected service’s data to another except where doing so is what the workspace asked for (for example, generating a shipping label for an order).

Amazon Brand Analytics data

When a seller connects their Amazon account and approves Brand Analytics, ManyMuse reads these reports from that seller’s own account, every week, and keeps them so the seller can see how their search performance changes over time:

  • Search query performance: the searches that showed the seller’s products, how many times each was searched, and the impressions, clicks, cart adds and purchases each search led to, with the seller’s share of each and the median prices Amazon reports.
  • Search catalogue performance: the same search figures totalled per product, with search-driven sales, conversion and delivery-speed breakdowns.
  • Marketplace search terms: Amazon’s marketplace-wide list of search terms, each with its department, its search frequency rank and the three most-clicked products with their titles, click share and conversion share.
  • Sales and traffic: page views, sessions, units ordered, sales, Buy Box share and conversion for each of the seller’s products.
  • Products bought together: which other products Amazon shoppers bought with each of the seller’s products, with Amazon’s rank and percentage.
  • Repeat purchases: orders, unique customers, the share of repeat customers and repeat purchase revenue for each of the seller’s products.

We also keep a record of each report we request (when, for which period, and what Amazon answered), the report files exactly as Amazon delivered them, and what we calculate from them for that seller: the weekly actions we suggest, the search volume estimates we fit from the seller’s own figures, which weekly actions the seller dismissed or snoozed, and why, the actions a seller plans from them with the numbers before and after, the products a seller looks up across all of Amazon, with the searches where each is among the three most-clicked, and the word families a seller tracks, with the weekly Amazon search rank of every search containing them, for the larger of those searches the three most-clicked products with their titles and click and conversion shares, and the weekly trend summaries we prepare for that seller. For the products named on those searches we also keep Amazon’s own main image, title and brand, so a seller can see what they are looking at, and — once Amazon approves the role that allows it — the prices Amazon returns for those products, each with the date it was fetched. These reports are aggregate figures: they contain no shopper’s name, address, email or order.

This data is used only to show that seller their own business. It is never shared with, sold to or made available to any third party, never used to benchmark one seller against another, and never combined into an aggregated or anonymised data product. The one exception to keeping each workspace’s figures separate is between workspaces owned by the same business, at that owner’s request. Of Amazon’s marketplace-wide search report we keep only the part that concerns the seller’s own searches, products and competitors and the searches containing the words the seller tracks. The original report files and everything calculated from them are kept only while the seller’s Amazon connection is authorised. When the seller disconnects Amazon or withdraws our access, or Amazon instructs us to, we delete all of it within 72 hours, keeping only a record of when and how much was deleted.

Amazon buyer addresses

For an Amazon order the seller ships themselves, ManyMuse fetches the buyer’s name and delivery address only when the seller sends that order to their warehouse, one order at a time, through Amazon’s restricted-data process. The address is stored apart from the order, encrypted at rest (AES-256), readable only by our server, and used only to ship that order: it goes to the seller’s own warehouse or shipping service for that order and never to an AI provider. The buyer’s phone number is not stored. It is deleted 30 days after the order ships, or 60 days after it was fetched if the order never ships, by a daily job that checks afterwards that none remain. We never fetch buyer details for orders Amazon fulfils.

Retention and deletion

We retain workspace data for as long as the workspace maintains its account, and delete or anonymize it on request or on account closure, subject to legal retention requirements. A workspace can request export or deletion of its data, including erasure of a specific customer’s records.

Your rights

Depending on your jurisdiction (including under the GDPR), individuals may have rights to access, correct, delete, or restrict processing of their personal data. Because we act as a processor for the workspace, we will direct such requests to the relevant workspace and assist them in responding.

Contact

Questions about this policy or your data, or to reach the data controller (Going Marketplaces B.V.): merlijn@commo-dore.com. For general product support: support@manymuse.com.

Privacy Policy — ManyMuse · ManyMuse