Mavira AI LLC
Effective Date: 2026-10-31
Last Updated: 2026-10-31
This Cookie Policy explains how Mavira AI LLC ("Mavira," "we," "our," or "us") uses cookies and similar tracking technologies on our website at mavira.io and maviraai.com and our Shopify App (collectively, the "Services").
On our website, non-essential cookies are currently limited to analytics, and we set these only after you give consent through our cookie banner or preference center. You can change or withdraw your consent at any time using the "Cookie Settings" link in our footer. Strictly necessary cookies, which are required for the Services to function, do not require consent under applicable law.
If you decline analytics cookies, or have not yet made a choice, Google Analytics does not load, and we still count visits to our website in aggregate using a cookieless mode that stores nothing on your device. See "Cookieless Analytics" below.
The mavira_ref referral-attribution cookie that our Shopify App sets on a partner's storefront is not a strictly necessary cookie. It is consent-gated: in the European Economic Area, the United Kingdom and Switzerland, and wherever your region cannot be determined, it is set only after you accept marketing cookies on that storefront; elsewhere, it follows the storefront's privacy settings, read through Shopify's Customer Privacy API, and is not set if you decline. It is never set where that API is unavailable or where your browser sends a Global Privacy Control signal. Because it is set on the partner's site rather than ours, it is governed by that storefront's consent surface rather than by our cookie banner. See "Partner Site Tracking" below.
Cookies are small text files that are placed on your device (computer, smartphone, tablet, etc.) when you visit a website. Cookies allow the website to recognize your device and remember information about your visit, such as your preferred settings and login information.
Cookies can store various types of information, including:
In addition to cookies, we use other browser storage mechanisms that function similarly:
HTML5 local storage that persists on your device until cleared. We use it to store small pieces of state such as anonymous identifiers used to associate uploads across sessions, wishlist items you save from the product carousels in our blog articles, a record of your cookie consent choices, and, if you accept analytics cookies, the state our product-analytics provider (PostHog) needs to recognize your browser.
Persists only for the duration of a browser tab. We use it to cache recommendations and pass results between components within a single session, and, if you accept analytics cookies, to hold PostHog's state for the current tab and the page you started signing up from.
We do not currently use third-party tracking pixels.
Throughout this policy, we refer to all these technologies collectively as "cookies" for simplicity, unless we need to distinguish between them.
Below is a complete list of cookies and similar storage we currently use.
| Name | Type | Provider | Purpose | Duration |
|---|---|---|---|---|
| sb-*-auth-token (and chunked variants) | Cookie Necessary | Supabase | User authentication and session | Session / persistent (set by Supabase) |
| _ga, _ga_<MEASUREMENT_ID> | Cookie Analytics | Google Analytics | Distinguishes users for analytics (set only after you consent) | Up to 2 years |
| ph_<PROJECT_KEY>_posthog | Cookie Analytics | PostHog | Holds a random identifier for your browser and the ID of your current visit, so we can count returning visitors and group the pages you view into visits. It is not linked to your account, name, or email (set only after you consent) | 1 year, or until you withdraw consent |
| ph_<PROJECT_KEY>_posthog (and other keys beginning ph_) | localStorage and sessionStorage Analytics | PostHog | Holds the same random identifier and visit ID, plus PostHog's settings for our website (set only after you consent) | localStorage: until you withdraw consent or clear it. sessionStorage: until you close the tab |
| mavira_ph_consent | localStorage Analytics | Mavira AI | Tells PostHog that you accepted analytics cookies, so that it uses cookies from the start of your next visit instead of starting in cookieless mode. Set only after you accept, and deleted if you decline or withdraw consent | Until you withdraw consent or clear it |
| mavira_consent | localStorage Necessary | Mavira AI | Records your cookie consent choices, the version of the banner you responded to, and, if you accepted analytics cookies while your browser was sending a Global Privacy Control signal, that you did so | Until you clear it |
| mavira_terms_accepted | localStorage Necessary | Mavira AI | Legacy flag from an earlier banner that recorded only acceptance of our terms. We no longer set it; where it is still present we read it once and delete it, then ask you for consent again | Deleted on your next visit |
| anonymous_user_id | localStorage Functional | Mavira AI | Anonymous identifier used with click-tracking before sign-in | Until you clear it |
| mavira_temp_user_id | localStorage Functional | Mavira AI | Anonymous identifier used to associate image uploads before sign-in (cleared on logout) | Until logout or you clear it |
| blog_wishlist | localStorage Functional | Mavira AI | Stores wishlist items added from the product carousels in our blog articles. This storage is used whether or not you are signed in, and is separate from the wishlist saved to your account | Until you clear it |
| mavira_signup_source | sessionStorage Analytics | Mavira AI | Remembers which of our pages you started signing up from, so we can see which pages lead to sign-ups (set only after you consent) | Deleted when you finish signing up or close the tab |
| currentImageAesthetics | sessionStorage Functional | Mavira AI | Passes upload analysis results between components | Cleared when modal closes |
| aesthetic_recommendations_v8_* | sessionStorage Functional | Mavira AI | Caches your personalized recommendations within your browsing session. The key includes your user ID and the size, price and gender preferences the recommendations were built from, so that changing a preference discards the cache | Cleared at end of session |
| Name | Type | Provider | Purpose | Duration |
|---|---|---|---|---|
| mavira_ref | Cookie Attribution — consent-gated, not strictly necessary | Mavira AI | Referral attribution from a Mavira referral link to a partner store. In the EEA, the UK and Switzerland, and where your region cannot be determined, set only after you accept marketing cookies on the partner's storefront; elsewhere, set according to the storefront's privacy settings (read through Shopify's Customer Privacy API) unless you decline. Never set where that API is unavailable. A Global Privacy Control signal from your browser overrides every other signal: no cookie is set, any existing mavira_ref cookie is deleted, and no attribution occurs. | 90 days |
In the names above, <MEASUREMENT_ID> and <PROJECT_KEY> stand for the public identifiers of our Google Analytics property and our PostHog project.
Full details on partner-site tracking are in our App Privacy Policy.
We use the following third-party services that may set or read cookies:
Each of these services has its own privacy policy that governs how they collect, use, and share your information.
If you decline analytics cookies, have not yet made a choice, or your browser sends a Global Privacy Control signal and you have not accepted analytics cookies while it is on, PostHog runs in cookieless mode on our website. In this mode:
We use cookieless mode for aggregate figures, such as how many people visit a page, start an upload, or reach the end of the sign-up flow. It records the same kinds of events as consented analytics, described in Section 2.7 of our Privacy Policy. Google Analytics does not run in cookieless mode: it loads only after you accept analytics cookies. In no mode does our analytics receive your uploaded images, image addresses or file names, or anything our AI infers about the people in your photos.
For clarity:
Unless your browser sends a Global Privacy Control signal (see below), you'll see a cookie banner on your first visit to our website allowing you to accept or reject analytics cookies. You can change or withdraw your consent at any time using the "Cookie Settings" link in our footer. Your choice applies to both Google Analytics and PostHog and takes effect immediately. Declining or withdrawing consent stops Google Analytics and deletes its cookies and the PostHog cookies and storage from your browser, and PostHog then counts your visits in cookieless mode (see "Cookieless Analytics" above). Cookies are tied to the domain that sets them, so your choices on mavira.io and on maviraai.com are stored separately, and you may see the banner again when you first visit the other domain.
We do not present a cookie banner or preference center on a partner's Shopify storefront. The mavira_ref cookie our Shopify App sets there is governed by the consent signal that storefront surfaces through Shopify's Customer Privacy API and by Global Privacy Control — see "How to opt out" under Partner Site Tracking below.
Most web browsers allow you to control cookies through their settings:
Note: Blocking necessary cookies will prevent you from signing in or using account-related features.
In addition to declining analytics cookies through our banner, you can opt out of Google Analytics universally by installing the Google Analytics Opt-out Browser Add-on: tools.google.com/dlpage/gaoptout
You can clear localStorage and sessionStorage data through your browser's developer tools or by clearing site data in your browser's privacy settings.
Some browsers offer a "Do Not Track" (DNT) signal. There is no industry consensus on how to respond to DNT signals, and we do not currently respond to DNT browser signals. We honor opt-out preferences expressed through our cookie consent tool and through Global Privacy Control.
We recognize Global Privacy Control (GPC) signals sent by browsers and browser extensions. If we detect a GPC signal from your browser, we will treat it as a request to opt out of analytics cookies and (where applicable) the sale or sharing of personal information. We do not show you the cookie banner on your first visit, Google Analytics does not load, and PostHog runs in cookieless mode, as it does when you decline analytics cookies.
This also applies if you accepted analytics cookies before your browser began sending the signal. The next time our website loads, we treat your choice as declined and delete the Google Analytics and PostHog cookies and PostHog's storage from your browser. Turning the signal off later does not restore your earlier choice.
If you want analytics while your browser sends the signal, you can choose "Accept All" after opening the "Cookie Settings" link in our footer. The banner tells you about the signal before you choose. An acceptance made this way stands while your browser keeps sending the signal, until you withdraw it, and it applies only to the domain where you made it (mavira.io or maviraai.com).
On partner Shopify storefronts, a GPC signal additionally suppresses referral attribution in full: no mavira_ref cookie is set, any existing one is deleted, and no purchase is attributed to Mavira. A GPC signal overrides any consent granted through that storefront's consent framework.
When a visitor arrives at a partner's Shopify storefront via a Mavira referral link, our Shopify App sets a first-party mavira_ref cookie on the partner's storefront to attribute the visit and any resulting purchase. This cookie is consent-gated and is not treated as strictly necessary.
Our Shopify App reads your consent choice and your region from Shopify's Customer Privacy API, which uses Shopify's own region detection in your browser; your region is not sent to us. In the European Economic Area, the United Kingdom and Switzerland, and wherever Shopify cannot determine your region, the cookie is set only after you accept marketing cookies. Elsewhere, it follows the partner's Shopify privacy settings: it is set unless you decline, or unless the partner has chosen to ask for consent in your region first, in which case it is set only once you accept. If the Customer Privacy API cannot be loaded on the storefront within a short timeout, no cookie is set and nothing is attributed. If you decline, or later withdraw consent, on any page of the storefront, the cookie is deleted, the referral is removed from your cart, and your cart is marked so that the order is not attributed to Mavira. Responsibility for deploying and correctly configuring a consent-management framework on the storefront rests with the partner merchant.
Global Privacy Control overrides every other signal. Where your browser sends a Global Privacy Control (GPC) signal, no mavira_ref cookie is set, any existing mavira_ref cookie is deleted, the referral code is not carried through the cart or onto the order (and your cart is marked so that the order is not attributed), and no attribution occurs — regardless of any consent granted through the Customer Privacy API. This is not re-enabled if consent is later granted during the same session.
If a qualifying purchase is made within 90 days of the most recent referral visit, we record:
We do not collect end-customer names, email addresses, shipping or billing addresses, or payment details through this cookie.
We do not use third-party affiliate networks for partner attribution. The cookie and the order data are processed only by Mavira and by the service providers that run our Shopify App on our behalf (our database, hosting, and email providers, and Shopify), as listed in Section 6.2 of our App Privacy Policy. We do not share this data with any other third party except the specific partner whose store the sale occurred on, and only the order-level fields listed above.
Our Services are not intended for children under 13 (or the applicable age of digital consent in your jurisdiction, which may be as high as 16 in certain EEA member states). We do not knowingly collect personal information from children through cookies or other means.
If you are a parent or guardian and believe we may have collected information from your child, please contact us immediately at team@maviraai.com, and we will delete the information promptly.
We may update this Cookie Policy from time to time to reflect changes in our practices, technologies, or legal requirements. When we make significant changes, we will:
We encourage you to review this Cookie Policy periodically to stay informed about how we use cookies.
Under GDPR and the ePrivacy Directive, we rely on the following legal bases for using cookies and similar storage:
Strictly necessary cookies (authentication) are essential for providing the Services you've requested and are exempt from the consent requirement under ePrivacy rules. Referral attribution is not treated as strictly necessary and does not rely on this basis.
Some functional storage (anonymous identifiers used to associate pre-sign-in activity with your subsequent account) relies on our legitimate interest in providing a coherent user experience. Cookieless analytics (see "Cookieless Analytics" above) relies on our legitimate interest in measuring, in aggregate, how our website is used so that we can fix problems and improve it. It does not store cookies or other data on your device, and it does not read cookies or other storage from your device.
For non-essential cookies, we rely on consent. On our website this means analytics cookies, for which we obtain your explicit consent through our cookie banner before setting them. For the mavira_ref referral-attribution cookie set on a partner's Shopify storefront, we rely, in the European Economic Area, the United Kingdom and Switzerland (and wherever your region cannot be determined), on the consent you give through that storefront's consent banner, communicated through Shopify's Customer Privacy API; elsewhere, the cookie follows the storefront's privacy settings, and you can decline it. We set no cookie and perform no attribution where your browser sends a Global Privacy Control signal (see Partner Site Tracking above).
If you have any questions, concerns, or requests regarding our use of cookies or this Cookie Policy, please contact us:
Mavira AI LLC
Registered Office: 16192 Coastal Highway, Lewes, Delaware 19958, County of Sussex
Website: mavira.io and maviraai.com
Email: team@maviraai.com
Subject Line: Cookie Policy Inquiry
Privacy Contact (Voluntary)
While not required to do so under applicable law, Mavira AI LLC has voluntarily designated a privacy contact to oversee data protection matters:
Aubrey Stevens — aubrey@maviraai.com
GDPR Representative
We value your privacy and your rights as a data subject and have therefore appointed Prighter Group with its local partners as our GDPR representative and your point of contact for the following regions:
Prighter gives you an easy way to exercise your privacy-related rights (e.g. requests to access or erase personal data). If you want to contact us via our representative, Prighter, or make use of your data subject rights, please visit the following website: app.prighter.com/portal/maviraai
For more information about cookies and online privacy, visit:
© 2026 Mavira AI LLC. All rights reserved.