SETROASFLOW — PRIVACY ARCHITECTURE

Version: Draft — 25 August 2026

1. ARCHITECTURE

Merchant website → SetRoasFlow client/plugin/app → Cloudflare edge → consent decision → processing/storage → configured destinations.

The client reads available merchant CMP/privacy signals and sends a tri-state signal:

true = affirmative consent;

false = explicit refusal;

null = no signal.

EU/EEA/UK/Switzerland: no affirmative signal means no identified-data processing beyond the documented edge handling.

USA/other: opt-out model with GPC and applicable privacy strings.

3. EDGE HANDLING

A browser cannot necessarily determine its legal jurisdiction. The current architecture therefore receives the request at the first-party edge and may discard or anonymize data there when the applicable consent state does not permit further processing.

For EU users without an affirmative consent signal, personal data may technically transit to the Cloudflare first-party edge before being discarded or anonymized.

[LEGAL REVIEW REQUIRED: assess the legal characterization and disclosure of this ephemeral transit.]

4. IDENTITY

Email, phone, external IDs and advanced matching fields are hashed before advertising egress. Clear email is retained in CDP only where consent permits and is not stored under applicable US opt-out handling.

5. COOKIES

_srf is HMAC-signed, Secure, HttpOnly and SameSite=Lax. Audience cookies contain short signed segment identifiers and have a 30-day lifetime.

6. ATTRIBUTION LOCAL STORAGE

The snippet stores first- and last-touch attribution information in _srf_ft and _srf_lt without a current consent gate.

[LEGAL REVIEW REQUIRED: determine ePrivacy requirements for this storage.]

7. CDP

Profiles may include identity hashes, consent-gated email, LTV, order metrics, visit/order dates, repeat-buyer status, event counts and derived scores.

8. OPERATOR ACCESS

Authorized SetRoasFlow personnel have technically possible administrative access to production data stores for operations, debugging and support. This is organizationally and contractually restricted; no technical impossibility is claimed.

9. AI

AI features receive merchant-entered free text, segment rules, truncated platform error text and aggregate statistics. The Service is designed not to submit end-customer personal data to AI features; merchant-provided free text is forwarded as typed.

10. DESTINATIONS

Advertising, analytics, CRM, AI and Merchant-controlled warehouse destinations receive data according to configuration and consent/privacy state.