Frequently Asked Questions

CRM Sync is a consent-first customer-data and agent-entitlement layer for commerce. It consolidates customer identity, consent, segmentation, and commerce data behind a single, server-side data layer so you configure once and operate across every channel — for both human and AI-agent interactions.

Traditional CRMs assume every interaction has a human on both sides. Agentic protocols — UCP, A2A, and AP2 — break that assumption. CRM Sync is protocol-first: it distinguishes human access from AI-agent access, and it gates, scopes, and cryptographically verifies every agent interaction.

Merchants, businesses, and their authorized administrators — and the agencies and teams who build for them. It runs as a registered application on both the Shopify App Store and the Webflow Marketplace, and supports delegated, revocable access so teams can collaborate and hand off projects without sharing master credentials.

In agent-mediated commerce, an AI agent discovers a merchant's capabilities via protocol endpoints, negotiates on behalf of a customer, and transacts — without a browser. CRM Sync provides the trust, permission, and consent infrastructure that makes those agent interactions safe and auditable.

They are the agentic-commerce protocols CRM Sync is built around. A2A (agent-to-agent) covers an agent's authorized access to read commerce data on a customer's behalf. AP2 covers signed payment mandates that let an agent spend within an explicit cap on an allowed rail. UCP is the unified commerce protocol layer that ties discovery, negotiation, and transaction together.

CRM Sync uses granular entitlements that distinguish human access from agent access. For example, a customer may allow a human marketer to send email campaigns but not authorize an AI agent to make purchases on their behalf. Each agent gets a defined scope, spending limit, and permitted payment rail.

Consent is not a one-time banner click. Every preference — Terms of Service, Privacy, Cookie/Analytics, Marketing, and agent access (A2A/AP2) — is recorded with a timestamp, source, and version as an auditable, revocable, real-time source of truth.

Every state change propagates instantly across all channels and agents. When a customer revokes marketing consent, CRM Sync does not wait for a nightly sync — the consent banner updates, GA4 Consent Mode adjusts, and downstream services honor the change immediately.

Yes. Any authorized agent can be revoked at any time from the Privacy & Permissions panel. Mandates are revoked immediately and the agent's A2A/AP2 access ceases.

Every agent interaction is gated, scoped, and cryptographically verifiable. CRM Sync uses mandate tokens with HMAC signatures, JWT-signed sessions, and explicit boundaries that traditional CRMs never needed — so agent access is provable and bounded.

Secrets are stored server-side on Cloudflare and never exposed to content editors or AI agents. A configuration wizard sets keys that aren't visible in the build step, and short-lived keys are rotated from two locations — Cloudflare and Xano — through an auditable, human-in-the-loop process.

PKCE (Proof Key for Code Exchange) is a login-flow add-on that prevents someone from stealing your login code mid-transit. TLS (Transport Layer Security) is the encryption protecting data between your browser and the server — the 'S' in HTTPS. OIDC (OpenID Connect) lets users sign in with an existing account (like Google or Shopify) without sharing their password.

Through guided setup it connects Shopify, Webflow, Xano, Google Analytics (GA4), Adobe Experience Platform, and email or payment providers — so authorization keys for tools like Adobe, Salesforce, Braze, Attentive, and Klaviyo can be linked to Shopify user data, state, and consent instead of living in disconnected silos.

User profiles and consent records are stored in Xano (the source of truth); configuration, tokens, and OAuth state are kept in Cloudflare KV, encrypted at rest. Passwords are stored only as one-way bcrypt hashes. See the Privacy Policy for the full data map.

It runs on globally distributed Cloudflare edge infrastructure as independently deployable modules, with stage/prod/dev version management and non-destructive deploys that support scheduling and fallback. It's framework-agnostic and supports mobile, browser, game, IoT, app, and point-of-sale channels.

CRM Sync routes payments to the appropriate rail per market — including Stripe, Google Pay, Samsung Pay, Kakao Pay, and the Machine Payments Protocol (MPP) using USDC. Agent payments run on signed AP2 mandates within a spending cap. CRM Sync does not store card numbers; transaction metadata is handled by the relevant provider.

Agent payments require a registered AP2 mandate that binds the agent to a scope, a spending limit, and an allowed rail. Mandate records, history, and permissions are auditable, and any mandate can be revoked immediately by the customer.

Under GDPR, CCPA, and similar laws, customers can access, export, correct, and delete their data, withdraw consent, opt out of sale or sharing, and revoke any AI agent. Most of these are self-service in the Privacy & Permissions panel and take effect immediately; others are handled within 30 days. See the Privacy Policy for details.

No. CRM Sync does not sell personal data and does not share it with advertising networks or data brokers. Data is shared only with the processors required to operate the service (such as Shopify, Xano, Cloudflare, Google, and payment providers), as listed in the Privacy Policy.

Where CRM Sync is currently listed as free on a platform marketplace, no marketplace charges apply. Any paid plans will be introduced through the applicable platform's billing system (for example, Shopify's Billing API) with notice.

CRM Sync is platform-agnostic and supports mobile, browser, game, IoT, app, and point-of-sale, with first-class globalization: multi-market and multi-locale storefronts, localized knowledge-base/FAQ/product content, and machine translation (including edge translation) to reach customers in their own language.