How to manage customer data from your own online store without skipping consent
Learn what data an owned online store creates, how seller access is limited, and why consent belongs in customer-data management.
The right approach is not simply collecting contact numbers. Sellers need a clear purpose, store-scoped customer relationships, tenant- and consent-based access, and a path for changing or revoking permission.
The phrase “owning customer data” often mixes identity, order history, shipping details, contact information, service notes, and communication permission. An owned store gives a seller a place to manage that relationship, but it does not remove the need to explain use and limit access.
What data appears around an order?
| Data type | Example use | Boundary to protect |
|---|---|---|
| Account identity | Recognizing a buyer during login or checkout | Do not assume every attribute can be shared with the seller |
| Store relationship | Showing that a buyer transacted with one store | Keep it isolated from another store's relationship |
| Order | Handling products, quantity, price, and status | Use it for fulfillment and relevant support |
| Contact | Contacting the buyer about an order or service | Access follows consent and purpose |
| Notes and segments | Supporting service or internal grouping | Avoid uses outside the explained purpose |
Separate platform identity from the store relationship
A platform may have an identity layer used for login while each store keeps transaction relationships, orders, notes, and segments in its own context. The distinction matters. A seller does not automatically have the right to see a buyer's activity in another store just because the buyer uses the same platform network.
Consent determines what can be done
Consent is not a decorative checkout element. It helps answer whether a seller may use a contact for a particular purpose, when permission was given, and how it can be withdrawn. When the purpose changes, the explanation and basis should be reviewed.
Customer-data principles an UMKM can use
- Collect data needed for the order and promised service.
- Explain the purpose in language the buyer can understand.
- Separate a store's customer relationship from other stores.
- Limit access to contacts without consent according to the required task.
- Keep records of permission changes and buyer requests.
- Delete or restrict use when the purpose and retention period end.
What changes when using a marketplace?
On a marketplace, the seller works inside the platform's rules, interface, and data access. An owned store gives more room to manage pages, a domain, and the customer relationship, but it also leaves the seller responsible for security, privacy policy, and appropriate data use.
Do not treat customer data as a promotion list
Purchase history can support order service, but it is not automatically permission for every kind of promotion. Separate transactional communication from marketing communication. Give buyers a clear choice and respect it.
How does Biome frame customer data?
Biome is designed so store customer and order data can be managed by the seller, with access limited to the relevant store relationship and consent. This is intentionally more careful than an absolute legal-ownership promise. Exact access, export, processing, and policy follow the product implementation and applicable data-protection rules.
Before using customer data
- The purpose of each data type is written down.
- The seller knows who can access it.
- Contacts without consent are not used for marketing.
- There is a support path for changes or withdrawal of permission.
- Order data and marketing data are not combined without a clear reason.
Frequently asked questions
Does an owned store make every customer record the seller's property?
An owned store gives the seller more control over the order relationship, but identity, consent, access, and data-protection duties still need to be separated.
Can a seller see customers from another Biome store?
Not automatically. Customer relationships are limited to the relevant store and access follows the applicable rules and consent.
Can every buyer be added to a marketing list?
No. Transactional and marketing communication have different purposes; marketing must follow consent and the buyer's choices.
Can customer data be exported at any time?
Do not assume that. Export availability and limits follow product implementation, consent, policy, and applicable data-protection rules.