Privacy Policy

2. Roles and Scope

There are three parties whose data is relevant to this policy:

• End customer.A consumer who clicks a Mavira referral link and may or may not place an order on the Merchant's Shopify store. The App's interaction with this person is limited to (a) a single first-party browser cookie carrying a pseudonymous referral code, set only where consent permits (see Section 4), and (b) limited per-order data observed after the order is placed (see Section 3.1).
• Merchant. The owner of the Shopify store that has installed the App and has, or intends to enter, a referral partnership with Mavira. The Merchant approves the Shopify-managed subscription and is the party billed for commissions.
• Mavira AI LLC. The App developer and the operator of the referral platform.

Roles under applicable data protection laws (e.g., GDPR, UK GDPR):

• For the mavira_refcookie that Mavira places via the App's theme extension, Mavira acts as the data controller.
• For the per-order data we receive from Shopify on the Merchant's behalf, Mavira acts as a data processor and the Merchant acts as the data controller.
• For Merchant business data (contact details, subscription metadata, and the commission ledger described in Section 3.2), Mavira acts as a data controller with respect to its own commercial relationship with the Merchant.

3. What Data We Collect

This section enumerates every category of data the App collects, stores, or processes. For the purposes of transparency required by Shopify's app developer privacy requirements, this covers data collected (a) through Shopify's APIs, (b) directly from the Merchant, and (c) directly from end customers of the Merchant.

3.1 End-customer data

The App collects only the following data about end customers, and only in connection with a "qualifying purchase." A qualifying purchase is one made by a visitor who arrived at the Merchant's Shopify store via a link from the Mavira website, identified via URL parameters set by Mavira at the time of referral.

Cookie data (set in the end customer's browser):

Per-order data (collected after a qualifying purchase, from Shopify):

Customer-data-request payloads (handled in transit only, not stored):

Where Shopify delivers a customers/data_request webhook, the payload itself may include an end customer's email address as provided by Shopify. That email transits our infrastructure only for the purpose of acknowledging the webhook, locating matching records, and forwarding those records to Mavira's operations team for delivery to the Merchant; it is not written to our database. See Section 10 for the full webhook handling description.

3.2 Merchant business data

Distinct from end-customer data, the App also stores the following Merchant business data — collected either from the Merchant directly during onboarding or from Shopify in connection with the App installation and the recurring app subscription described in our Terms of Service:

Partner record (one row per Merchant):

Commission ledger (one row per attributed order):

A uniqueness constraint on (partner, Shopify order ID) ensures that no Merchant can be billed more than once for the same order through the App.

Commission-credit ledger (one row per un-recoverable over-charge):

Because Shopify does not permit reversing a usage record once submitted, where an order shrinks below the amount already charged for it (for example, a partial refund, a downward order edit, or a cancellation of an already-billed order), the App records the difference as an internal partner creditand applies it against the Merchant's future commission charges (see Section 4.2 and our Terms of Service). Each credit row contains only an internal partner reference, the originating Shopify order identifier, the currency, the credit amount and how much of it has been consumed, the reason for the credit, an idempotency key preventing duplicate credits, and timestamps. It contains no end-customer data beyond the order identifier and order amounts already described above.

Merchant-level commission aggregate (one row per Merchant per currency):

This aggregate contains no shop identifier, no end-customer data, and no per-order detail.

Shopify OAuth session tokensare held by the standard Shopify session-storage adapter, backed by our Postgres database on Supabase (in a database schema separate from the App's business data), for the purpose of authenticating App requests to the Shopify API. They are deleted when the App is uninstalled.

4. How We Collect Data

4.1 Referral cookie

When a visitor arrives at a Merchant's Shopify store via a Mavira referral URL (which carries a query parameter identifying the referral), a theme app extension that Merchants install into their storefront reads that parameter, validates it, and stores a 90-day first-party cookie named mavira_refin the visitor's browser. While the cookie is present, the extension carries the referral code through the Shopify cart and onto the resulting order via Shopify cart attributes and a hidden line-item property, so the referral code survives Shopify checkout and ends up on the order.

The App is designed to respect end-visitor privacy decisions. It integrates with Shopify's Customer Privacy API to read buyer consent signals, and it sets the mavira_ref cookie only where the applicable consent signal permits it. Where consent is required and not given, no cookie is set and no attribution occurs.

Global Privacy Control (GPC) overrides everything. If the visitor's browser sends a Global Privacy Control signal (navigator.globalPrivacyControl), the App treats this as a definitive instruction not to track: it does not set the mavira_ref cookie, deletes any existing mavira_ref cookie, and stops carrying the referral code through the cart and onto the order for that page view. A GPC signal takes precedence over all other consent signals — including an explicit grant communicated through the Customer Privacy API — and is not re-enabled if consent is later granted during the session.

Where no consent framework is detected on the storefront (specifically, where the Customer Privacy API does not load within a short timeout) and no GPC signal is present, the App sets the cookie. This is a deliberate design choice so that attribution continues to function for Merchants that have not deployed a consent surface; the App does not itself determine the visitor's jurisdiction or whether a consent framework is legally required there. The Merchant is responsible for deploying and correctly configuring a consent-management framework on its storefront (including via Shopify's Customer Privacy API) so that the applicable consent signal is presented to the App in accordance with the laws of its customers' jurisdictions. Mavira honors whatever consent signal the storefront surfaces (and always honors GPC), but it relies on the Merchant to put the correct consent infrastructure in place; see Section 11.3 and our Terms of Service for the allocation of responsibility between Mavira and the Merchant in this respect.

Visitors who arrive at the Merchant's storefront through any other channel are not tracked by the App in any way.

4.2 Order data

After a qualifying purchase is completed, the App identifies and records the order through the following complementary mechanisms:

• Primary path (real-time webhook).The App subscribes to Shopify's orders/create webhook. When the webhook fires for a paid order, the App inspects the order for a Mavira referral code and, if found, records the order in our database and (where the Merchant is past their trial — see Section 7) submits the corresponding usage record to Shopify.
• Safety-net polling. A periodic background poll (approximately every 5 minutes per shop) queries the Shopify Admin API for recently paid orders. This serves as a backstop if a webhook is delivered late, dropped, or otherwise missed.
• Dashboard-load poll.When a Merchant opens the App's embedded dashboard, the App may run the same recent-orders query as the safety-net poll, throttled to at most once every approximately 5 minutes per shop. This is an additional trigger for the same query against the same data; it does not collect any new category of data.

Either path may detect a given order first; a database uniqueness constraint ensures that no order is recorded more than once. Orders without a Mavira referral are disregarded and not stored.

An order's commission is a live figure, not a one-time snapshot. After an order is first recorded, the App keeps the commission reconciled to the order's current state. The App subscribes to Shopify's orders/updated, refunds/create, and orders/cancelled webhooks; when an order is edited, partially or fully refunded, or cancelled, the App re-reads the order's current subtotal from Shopify and recomputes the commission accordingly. This can reduce the commission (a partial refund or downward edit) or increase it (an upward edit), and may result in an additional charge or in an internal credit applied against future charges, as described in our Terms of Service. No new category of end-customer data is collected in the course of this reconciliation.

All incoming Shopify webhook payloads — including but not limited to those described in this policy — are verified using Shopify's HMAC-signature mechanism before any processing. Requests with an invalid signature are rejected.

4.3 Storefront enablement check

Separately from the end-customer data described above, and in order to detect a configuration problem rather than to collect any end-customer data, the App performs an automated daily check of whether the App's referral tracker is actually switched on in the Merchant's storefront theme. Enabling the tracker is a step the Merchant completes during onboarding by self-attestation (the Merchant confirms that it has switched the theme app embed on); this check verifies that attestation on an ongoing basis, because a tracker that has been switched off silently stops all referral attribution for the Merchant.

Once per day, for each Merchant whose subscription is in a trial or active state, the App makes a single unauthenticated HTTP request to the Merchant's own public storefront homepage and inspects the returned page to determine whether the tracker asset is present. The request follows ordinary redirects and identifies itself with a descriptive User-Agent (MaviraTrackerCheck/1.0 (+https://www.maviraai.com)).

This check is directed only at the Merchant's own publicly available storefront. It does not collect, receive, or store any end-customer data, and it makes no request to any third party (it is therefore not a new sub-processor and does not change where data is processed). The App does not store the storefront's page content, its URL, or any other part of the response; it records only (a) a timestamp of when the check last ran for the store and (b), where the tracker is found to be absent, a timestamp marking when it was first observed to be disabled (cleared once the tracker is seen again or once the Merchant confirms re-enablement). A store that is password-protected, unreachable, or otherwise returns an inconclusive result is never treated as disabled. These two timestamps are Merchant business data and are described in Section 3.2.

Where the check finds the tracker disabled, the App shows the Merchant an in-product prompt to re-enable it, explains that no commissions are recorded while the tracker is switched off, and sends an internal operational alert to Mavira's operations team (see Sections 5 and 9). The allocation of responsibility, as between Mavira and the Merchant, for keeping the tracker enabled is addressed in our Terms of Service.

5. How We Use Your Data

We use the data described in Section 3 for the following purposes, and no others:

• To identify and report qualifying purchases attributed to Mavira referral traffic.
• To provide the Merchant with reporting on attributed sales through the App's embedded admin interface.
• To calculate, and to keep reconciled to each order's current state, the commission amounts owed by the Merchant to Mavira in respect of attributed sales — including recomputing a commission when an order is edited, refunded, or cancelled, and netting any resulting over-charge against the Merchant's future commissions — in accordance with the commission structure approved by the Merchant when subscribing to the App.
• To submit usage records to Shopify so that Shopify bills the Merchant on Mavira's behalf via the Merchant's Shopify-managed recurring app subscription.
• To check, once per day, whether the App's referral tracker remains enabled on the Merchant's storefront, and to prompt the Merchant to re-enable it where it is not, as described in Section 4.3.
• To send operational and transactional emails to the Merchant in connection with the App and the subscription, including (i) cap-raise approval requests, (ii) cap-raise approval confirmations, (iii) trial-ending reminders, (iv) first-commission notices, and (v) confirmations relating to uninstallation and data deletion. These are not marketing emails.
• To send internal operational alerts to Mavira's operations team, including notifications of subscription declines, failures to create a subscription, unknown-partner installs, uninstallations, data-handling failures, detections that a Merchant's storefront tracker has been disabled, and uninstallations that occur while the Merchant still holds an unused commission credit.
• To respond to data-subject and Merchant data requests, including those received via Shopify's mandatory GDPR compliance webhooks (Section 10).
• To comply with legal obligations, enforce our agreements, and protect against fraud, abuse, or unauthorized use of the App.

We do not use the collected data for advertising, third-party marketing, profiling, automated decision-making producing legal or similarly significant effects, or any purpose beyond those listed above.

6. Data Sharing and Disclosure

7. Data Storage, Security, and Retention

7.1 Storage and security

All App business data is stored on Supabase (United States region). Supabase employs industry-standard security practices including encryption in transit (TLS) and at rest. Access to production data is restricted to authorized personnel and to the App itself via a server-side service-role credential. Shopify OAuth tokens are held by the Shopify-recommended session-storage adapter, backed by the same Supabase Postgres project as the business data but kept in a separate database schema; they are deleted on uninstall.

All webhook endpoints validate Shopify's HMAC signature before processing the payload, and reject requests with an invalid signature. Inbound and outbound traffic between the App, Shopify, Supabase, Resend, and the Merchant's browser is transmitted over TLS.

7.2 Retention periods

7.3 Rolling purge and aggregate-then-delete invariant

On a rolling weekly basis, per-order data older than approximately 24 months is purged. Because the purge runs weekly, individual records may persist for up to approximately seven days past the 24-month mark before they are processed.

Every code path that removes per-order data first folds the commission totals into the Merchant-level aggregate described above. That aggregation and the per-order deletion occur in a single database transaction, so the per-order data cannot be deleted without the corresponding commission being preserved in aggregate. The aggregate row contains only Mavira's internal identifier for the Merchant, the summed commission amount, and the currency — no shop domain, no order identifiers, and no end-customer data.

7.4 Deletion on uninstall

If a Merchant uninstalls the App, the following occurs:

• Immediately on receipt of Shopify's app/uninstalledwebhook, the App deletes the Merchant's OAuth session tokens, marks the partner record's subscription status as cancelled (which causes background jobs such as cap-raise checks and trial-ending emails to stop touching that record), schedules per-order data deletion for approximately 36 hours later, and sends an internal notification email to Mavira operations.
• Approximately 36 hours after uninstall, a scheduled deletion job folds the Merchant's per-order data into the Merchant-level aggregate (Section 7.3) and deletes the per-order rows.
• Approximately 48 hours after uninstall, Shopify delivers a shop/redact webhook as a GDPR safety net. On receipt, the App deletes any per-order data that the scheduled 36-hour job has not already removed.

In all cases, per-order data is deleted within thirty (30) days of uninstall, as required by Shopify. The Merchant-level aggregate is retained as described in Section 7.2. Where the Merchant uninstalls while still holding an unused commission credit, the App notifies Mavira's operations team and retains the credit-ledger row (which contains no end-customer identity) so that the credit can be settled out of band or reused if the Merchant reinstalls; that ledger row is removed by the deletion paths described above and in Section 10.

7.5 Breach notification

In the event of a personal data breach affecting Merchant or end-customer data processed through the App, we will notify affected Merchants without undue delay and, where feasible, within seventy-two (72) hours of becoming aware of the breach, in accordance with applicable law.

8. Merchant Data Rights and Deletion Requests

As a Merchant using the App, you have the right to:

• Request a copy of the data we hold associated with your store, including the partner record, per-order data, and commission ledger entries.
• Request correction of any inaccurate data.
• Request deletion of data associated with your store. The deletion timelines described in Section 7.4 apply to deletion requests concerning App data.
• Request restriction of how we process your data, subject to the limits of what is necessary to continue providing the App.
• Object to processing of your data based on Mavira's legitimate interests, where such a right applies under applicable law.

To exercise any of these rights, contact us at team@maviraai.com. We will acknowledge requests within thirty (30) days, and deletion timelines specifically are as described in Section 7.4.

9. Outbound Communications

The App may send the following operational and transactional emails. All such emails are sent via Resend (see Section 6.2) from a single sender, Mavira Referral Tracker <notifications@maviraai.com>. None of these emails is marketing.

To the Merchant (sent to the Merchant business contact email on file):

To Mavira operations (sent to team@maviraai.com):

Transactional email is a required dependency of the App: the App will not start without its email provider configured, and a failed send surfaces as an error rather than being silently dropped. Merchants who notice they are not receiving expected operational emails should contact Mavira support at business@maviraai.com.

10. Shopify Mandatory Compliance Webhooks

In accordance with Shopify's privacy requirements, the App subscribes to and responds to Shopify's three mandatory GDPR compliance webhooks. Each incoming request is verified using Shopify's HMAC signature; requests with an invalid signature are rejected with a 401 response. Requests with a valid signature are acknowledged with a 200 response and processed within 30 days.

The data the App stores is keyed by Shopify order ID and shop identifier (see Section 3). When a compliance webhook references specific orders, the App locates and acts on the matching records in both the per-order data set (sales) and the commission ledger (commissions).

End customers who wish to request access to or deletion of their attribution data outside the Merchant-driven Shopify webhook flow may also email team@maviraai.com directly with their order number, as described in Section 8.

11. GDPR and International Compliance

If you or your customers are located in the European Economic Area (EEA), the United Kingdom, or another jurisdiction with a comprehensive data protection regime, you may have additional rights under the General Data Protection Regulation (GDPR), the UK GDPR, or comparable laws.

12. California Privacy Rights (CCPA / CPRA)

If you or your customers are California residents, you have specific rights under the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA).

13. Children's Privacy

The App is intended solely for use by Shopify Merchants and is not directed at or designed for use by children. We do not knowingly collect any data from children under the age of 13, or under the applicable minimum age in the visitor's jurisdiction (which may be as high as 16 in certain EEA member states). If you believe that a child has provided data through the App, please contact us at team@maviraai.com and we will promptly delete any such data.

14. Changes to This Policy

We may update this Privacy Policy from time to time. For material changes — such as expansions in the types of data we collect, new purposes for which we use data, additions of sub-processors that change where or how data is processed, or changes to the retention periods in Section 7 — we will provide at least thirty (30) days' notice before the updated policy takes effect, via the Shopify App Store, the App interface, and by email to the address associated with the Merchant's Shopify account where practical. For non-material changes (such as clarifications, typographical corrections, or formatting changes), we will update the effective date without advance notice. The updated policy will include a revised effective date, and the prior version will be made available upon request.