Privacy Policy | CRM Sync
Last updated: 7/12/26.
Who we are
CRM Sync ("the App") is operated by RBF United ("we," "us"). Contact: support@rbfunited.com.
The App connects a Shopify store to the merchant's own Project Broadcast (PB) account to keep customer contact records in sync between the two systems.
What data the App accesses
To provide two-way customer sync, the App is granted these Shopify scopes: read_customers, write_customers. Through these it reads and writes: customer first name, last name, email address, phone number, tags, and SMS/email marketing consent status. The App does not access orders, payment information, products, or any data outside the customer record beyond what is listed here.
How we use the data
Customer data is used solely to mirror the merchant's customer records between Shopify and the merchant's Project Broadcast account, in the direction(s) the merchant configures. We do not sell, rent, or share customer data with any third party, and we do not use it for our own marketing.
How data flows and what we store
When a merchant installs the App, Shopify issues an access token for that store. The App stores only that access token (encrypted at rest in Cloudflare Workers KV) so the merchant's Project Broadcast automations can update Shopify. Customer records themselves pass through the App in transit and are delivered to the merchant's Project Broadcast account; we do not retain copies of customer personal data on our infrastructure.
Sub-processors
- Cloudflare, Inc. — hosts the App's request-handling service and stores the per-store access token. (cloudflare.com/privacypolicy)
- Project Broadcast — the merchant's own messaging platform, which is the destination for synced customer data under the merchant's own agreement with Project Broadcast.
Data retention and deletion
- The stored access token is deleted when the merchant uninstalls the App (via Shopify's
shop/redactwebhook, ~48 hours after uninstall). - On a
customers/redactrequest, we hold no customer PII to delete and confirm receipt. - Merchants may request deletion of any data at any time by emailing support@rbfunited.com.
Merchant and customer rights
Merchants control what syncs and can disconnect at any time by uninstalling the App. Data-subject requests (access, correction, deletion) can be sent to support@rbfunited.com and will be honored within applicable legal timeframes.
Security
Access tokens are stored encrypted and are never exposed to the browser or to Project Broadcast; Project Broadcast reaches Shopify only through our authenticated proxy. All traffic is over HTTPS.
Changes
We may update this policy; the "Last updated" date will change accordingly.
Contact
RBF United — support@rbfunited.com — rbfunited.com