Auraflow is the customer intelligence layer for Shopify stores. We classify each visitor by intent in real time, fire personalised interventions matched to how they are deciding, and let the merchant operate the whole thing in plain English.
We do this in a way that respects the visitor's privacy at the architecture level, and we charge for the work we do, not for permission to read the merchant's own data.
This document is the version of Auraflow we keep coming back to when we're deciding what to ship and what to leave on the table.
What we do
Auraflow sits inside a Shopify store and produces three things the merchant didn't have access to before.
Live intent intelligence. Every visitor whose consent allows it is observed in real time and classified across five archetypes: Researcher, Comparison Shopper, Hesitant Abandoner, Price Checker, Impulse Buyer. The classification happens server-side, pseudonymously and without third-party cookies.
Smart Capture. Auraflow surfaces the right capture moment for each archetype, written in the merchant's brand voice: an email capture for the Researcher, a value nudge for the Price Checker, reassurance for the Hesitant Abandoner. Not a blanket "wait, 10% off". A specific moment for a specific visitor.
An agent layer. The merchant types in plain English. The agent picks the right tools, asks for approval where it should, and runs them across Klaviyo, HubSpot, GA4 (on Pro and Agency), and Shopify. The merchant's session holds the identity. The agent never operates with privileges the merchant doesn't have.
What we won't build
We've made a few choices early that close certain doors deliberately. Naming them matters more than naming the features we ship, because the doors we close are the shape of what's left.
We won't make a discount code the default answer to hesitation. A hesitant shopper gets reassurance, not a discount, unless the merchant chooses to offer one, and the merchant's AI can create a code only with the merchant's approval. A discount buys the order in front of you. It doesn't earn the customer.
We won't pool merchant data into a shared model. Each merchant gets a model trained only on their own store's traffic. A supplement brand's price checker behaves differently from a luxury watch brand's price checker. Pooling them produces a model that's bad at both.
We won't be an OpenAI wrapper. The merchant can bring their own AI key (Claude, ChatGPT, Gemini, Kimi). Keys are encrypted at rest and calls are made server-side; with their own key, usage bills to their provider account. We never train on their prompts.
We won't treat compliance as a marketing checkbox. We built the architecture to help merchants meet their GDPR and CCPA obligations. There isn't a separate "GDPR mode": the same consent gate runs for every visitor. Shopify's customer privacy settings, Global Privacy Control and Do Not Track are honoured at the tag, and when consent is withheld the tracker creates no visitor record and sends no signals.
What we commit to
These are commitments we will not negotiate as we grow. They are written into the architecture, not the marketing.
Isolation is tested, not asserted
An automated isolation suite runs on every change and blocks release if a query loses its tenant filter. It checks the query each request issues, not the answer it returns, because a request can fail for the wrong reason and still look correct from outside.
Your integration tokens are encrypted at rest
Integration secrets and AI keys are encrypted at rest, and the calls that use them are made server-side. PII is masked in logs.
Your storefront tracker is hash-pinned
If anyone changes a single byte of the tracker script, the browser refuses to run it. The trust chain is verifiable end to end.
You opt in to everything, never out
We don't ship features that change merchant data behaviour without an explicit opt-in. Every default is set to the conservative position. You move the slider when you're ready, not before.
With your own key, your AI bill is between you and your provider
We charge for the platform we build. When you bring your own key, usage bills to your provider account, and you pay your provider direct.
We don't sell, lease or pool your customer data
Not now. Not later. Not in any form. The architecture isn't designed for it: each store's shoppers train that store's model, and nothing is pooled across stores. If you connect Meta or Google, hashed identifiers go to them for audience matching.
What we're building toward
A Shopify store should know its high-intent visitor before they reach the cart. The merchant should be able to act on that knowledge from one place, in one sentence, without leaking data to four different vendors. The visitor should never feel surveilled, and the merchant should never feel surveilled by their tools.
That's the version of the product we're building. We're a long way from done.
The version we've built so far is the foundation: classification, Smart Capture, the agent layer, and the integrations. The version we're building toward is one in which the merchant's entire customer relationship runs through a single intelligence layer that respects both sides of the storefront.
Who we are
Auraflow is built by Kosmatic Solutions Inc. We're pre-launch as of mid-2026, with a small team. We don't have the customer numbers other tools advertise. We're not pretending to. We're building the architecture first, because retrofitting it later is expensive.
We write down what we believe, then we ship the code that proves it. When the two don't match, we change the code.
Auraflow is on the Shopify App Store. Email reaches the team directly at support@kosmatic.com. We answer.
We don't run an automated AI support chatbot. We don't run a sales team. We run a product team, a few channels of operator conversation, and the conversation closes the loop on what we build next.
The shape of the product is the shape of what we're willing to commit to. This is the shape.
The Auraflow Team