Privacy Policy

Effective date: August 5, 2026

1. Introduction

mFact Solutions, Inc., doing business as Cohortive (“Cohortive”, “we”), provides customer analytics and marketing-audience services to ecommerce merchants (“Merchants”). This policy explains what data we process, why, and the rights available to the people the data describes.

2. The people this policy covers

Merchants and their staff — people who create Cohortive accounts. For this data, Cohortive is the data controller.

Merchants’ customers (“Shoppers”) — people who buy from a Merchant’s store. For this data, Cohortive is a processor / service provider acting on the Merchant’s instructions. The Merchant is the controller. Shoppers should direct privacy requests to the store they purchased from; we honor every verified request the Merchant or platform forwards to us (see “Your rights”).

Site visitors — people who browse cohortive.ai. The only data we collect about visitors is the limited usage data described in section 4; for that data, Cohortive is the controller.

3. What we process, and why

From the Merchant’s store platform (with the Merchant’s authorization): orders, customers, and products — including customer name, email, phone, and address. We use this data for exactly two purposes:

• Analytics for the Merchant. Retention, customer lifetime value, at-risk revenue, and purchase-behavior segmentation, computed from the Merchant’s own order history and shown only to that Merchant.
• Merchant-directed marketing audiences. At the Merchant’s explicit direction, we sync audience lists to the Merchant’s own connected marketing platforms (e.g., their Klaviyo account; their Meta or Google ads accounts, where identifiers are SHA-256-hashed before transmission). We enforce customer consent and opt-out signals before any sync.

From Merchant account holders: name, email, and authentication credentials (passwords are stored only as salted hashes), used to operate the account.

We do not sell personal data. We do not use Shopper data to build cross-merchant profiles in identifiable form, or for any purpose other than the two above.

4. Cookies and similar technologies

On this website (cohortive.ai):

• Advertising measurement. We use the Google Ads tag (gtag.js), which sets cookies (such as _gcl_au) to measure whether our own advertising leads to visits and signups. When the tag loads, Google also receives standard usage data such as your IP address and the pages you visit, which Google processes as described in Google’s cookie policy. The tag is configured for measurement only: ad personalization is disabled in its consent settings. You can additionally opt out of Google’s ad personalization at adssettings.google.com.
• Display preferences. Your light/dark theme choice is kept in your browser’s local storage. It never leaves your device.
• Embedded video. Our product demo is embedded from YouTube’s privacy-enhanced domain (youtube-nocookie.com) and loads only if you choose to play it. If you do, YouTube may set its own cookies, governed by Google’s privacy policy.

We run no other analytics or tracking cookies on this site.

In the Cohortive application (app.cohortive.ai): a strictly necessary session cookie keeps Merchant users signed in. It is not used for tracking or advertising.

Your choices. We honor the Global Privacy Control: if your browser sends a GPC signal, the advertising tag is not loaded at all, and we treat the signal as an opt-out of any “sale” or “sharing” of your usage data as those terms are defined in applicable privacy laws. You can also block or delete cookies in your browser settings; this website remains fully usable without them. Cookies play no role in how we process Shopper data — Shopper data reaches us through the Merchant’s store platform, not through tracking technologies.

5. Consent and opt-outs we enforce

• Shoppers’ marketing-consent state recorded in the Merchant’s store platform (email/SMS subscription status) is ingested and enforced: unsubscribed Shoppers are excluded from audience syncs.
• Do-not-sell/share opt-outs recorded by the Merchant are enforced as sync exclusions.
• Deletion and redaction requests (including platform-forwarded requests such as Shopify’s privacy webhooks) are honored on the timelines in section 8.

6. Data sharing

Shopper data is shared only with the platforms the Merchant explicitly connects and directs us to sync to (e.g., Klaviyo, Meta, Google), each acting under the Merchant’s own agreement with that platform. Our infrastructure subprocessors are listed in our Data Processing Agreement, available to Merchants on request. We may retain de-identified, aggregated statistics that identify no person, for benchmarking and service improvement; we do not attempt to re-identify de-identified data.

7. Data security

Each Merchant’s data is stored in an isolated per-merchant database. Data is encrypted in transit (TLS) and at rest; access credentials are additionally encrypted at the application layer. Primary hosting is in the United States. Internal access is limited to personnel who operate the service, under our access-security policy.

8. Data retention and deletion

Shopper data is retained while the Merchant’s subscription is active. If the Merchant uninstalls or terminates, processing halts and data is purged on receipt of the platform’s deletion notice (e.g., Shopify’s shop redaction webhook) or within 30 days, whichever is sooner. Individual Shopper redaction requests are honored within 30 days. Logs recording access to personal data are retained for 90 days.

9. Your rights

Depending on your jurisdiction (GDPR, CCPA/CPRA, and similar laws), you may have rights to access, correct, delete, or port your data, and to opt out of certain processing. Shoppers: contact the store you purchased from; we act on the Merchant’s verified instructions and on platform redaction notices without undue delay. Merchants: contact us directly at the address below. Site visitors: the only data we hold about you is described in section 4, which also covers your opt-out choices.

We do not discriminate against anyone for exercising these rights. We may need to verify your identity before acting on a request, and you may use an authorized agent to submit one on your behalf. If we decline a request, we will explain why, and you can appeal the decision by replying to our response. Marketing email from us always includes an unsubscribe link; opting out of marketing does not stop service messages such as account or security notices.

10. Children’s data

Cohortive is a business tool and is not directed at children. We do not knowingly collect personal information about children; if you believe we hold any, contact us at the address below and we will delete it.

11. Changes to this policy

We will post material changes here with an updated effective date.

12. Contact

For privacy-related inquiries: privacy@cohortive.ai · mFact Solutions, Inc., 660 4th St #130, San Francisco, CA 94107