Privacy Policy

2. Roles and Scope

There are three parties whose data is relevant to this policy:

• End customer. A consumer who clicks a Mavira referral link and may or may not place an order on the Merchant's Shopify store. The App's interaction with this person is limited to (a) a single first-party browser cookie carrying a pseudonymous referral code, set only where consent permits (see Section 4), and (b) limited per-order data observed after the order is placed (see Section 3.1).
• Merchant. The owner of the Shopify store that has installed the App and has, or intends to enter, a referral partnership with Mavira. The Merchant approves the Shopify-managed subscription and is the party billed for commissions.
• Mavira AI LLC. The App developer and the operator of the referral platform.

Roles under applicable data protection laws (e.g., GDPR, UK GDPR):

• For the mavira_ref cookie that Mavira places via the App's theme extension, Mavira acts as the data controller.
• For the per-order data we receive from Shopify on the Merchant's behalf, Mavira acts as a data processor and the Merchant acts as the data controller.
• For Merchant business data (contact details, subscription metadata, and the commission ledger described in Section 3.2), Mavira acts as a data controller with respect to its own commercial relationship with the Merchant.

3. What Data We Collect

This section enumerates every category of data the App collects, stores, or processes. For the purposes of transparency required by Shopify's app developer privacy requirements, this covers data collected (a) through Shopify's APIs, (b) directly from the Merchant, and (c) directly from end customers of the Merchant.

3.1 End-customer data

The App collects only the following data about end customers, and only in connection with a "qualifying purchase." A qualifying purchase is one made by a visitor who arrived at the Merchant's Shopify store via a link from the Mavira website, identified via URL parameters set by Mavira at the time of referral.

Cookie data (set in the end customer's browser):

Per-order data (collected after a qualifying purchase, from Shopify):

Customer-data-request payloads (handled in transit only, not stored):

Where Shopify delivers a customers/data_request webhook, the payload itself may include an end customer's email address as provided by Shopify. That email transits our infrastructure only for the purpose of acknowledging the webhook, locating matching records, and forwarding those records to Mavira's operations team for delivery to the Merchant; it is not written to our database. See Section 10 for the full webhook handling description.

3.2 Merchant business data

Distinct from end-customer data, the App also holds the following Merchant business data, which is collected from the Merchant as part of the referral partnership, set by Mavira when it connects the Merchant's Shopify store to the App, or received from Shopify in connection with the App installation and the recurring app subscription described in our Terms of Service:

Partner profile (one per Merchant):

Mavira keeps a profile of each referral partner as part of the referral partnership, outside the App. The App reads the following from it, and does not change or delete it:

The App creates a partner profile itself only for a Shopify App Store reviewer's test store, when the reviewer enters the access code provided for the review.

Commission account (one per Merchant):

Shopify installation (one per Merchant's Shopify store):

Commission ledger (one row per attributed order):

A uniqueness constraint on (Shopify installation, Shopify order ID) ensures that no Merchant can be billed more than once for the same order through the App.

When an order's identifiers are erased (Sections 7 and 10), its commission row is kept but de-identified: the Shopify order identifier and order name are removed, as is any Shopify error text recorded with a failed charge (which can quote them), and a timestamp records when this happened. The amounts, rate, currency, status, dates, usage-record identifier and referral code remain, as a financial record (Section 7.2).

Commission-credit ledger (one row per un-recoverable over-charge):

Because Shopify does not permit reversing a usage record once submitted, where an order shrinks below the amount already charged for it (for example, a partial refund, a downward order edit, or a cancellation of an already-billed order), the App records the difference as an internal partner credit and applies it against the Merchant's future commission charges (see Section 4.2 and our Terms of Service). Each credit row contains only an internal partner reference, references to the originating commission and its Shopify order identifier, the currency, the credit amount and how much of it has been consumed, the reason for the credit, an idempotency key preventing duplicate credits, and timestamps. It contains no end-customer data beyond the order identifier and order amounts already described above, and the order identifier is removed when that order's identifiers are erased (Sections 7 and 10).

Shopify OAuth session tokens are held by the standard Shopify session-storage adapter, backed by our Postgres database on Supabase (in a database schema separate from the App's business data), for the purpose of authenticating App requests to the Shopify API. They are deleted when the App is uninstalled.

4. How We Collect Data

4.1 Referral cookie

When a visitor arrives at a Merchant's Shopify store via a Mavira referral URL (which carries a query parameter identifying the referral), a theme app extension that Merchants install into their storefront reads that parameter, validates it, and stores a 90-day first-party cookie named mavira_ref in the visitor's browser. While the cookie is present, the extension carries the referral code through the Shopify cart and onto the resulting order via Shopify cart attributes and a hidden line-item property, so the referral code survives Shopify checkout and ends up on the order.

The App is designed to respect end-visitor privacy decisions. It integrates with Shopify's Customer Privacy API to read buyer consent signals, and it sets the mavira_ref cookie only where the applicable consent signal permits it. Where consent is required and not given, no cookie is set and no attribution occurs.

Global Privacy Control (GPC) overrides everything. If the visitor's browser sends a Global Privacy Control signal (navigator.globalPrivacyControl), the App treats this as a definitive instruction not to track: it does not set the mavira_ref cookie, deletes any existing mavira_ref cookie, and stops carrying the referral code through the cart and onto the order for that page view. A GPC signal takes precedence over all other consent signals — including an explicit grant communicated through the Customer Privacy API — and is not re-enabled if consent is later granted during the session.

Where no consent framework is detected on the storefront (specifically, where the Customer Privacy API does not load within a short timeout) and no GPC signal is present, the App sets the cookie. This is a deliberate design choice so that attribution continues to function for Merchants that have not deployed a consent surface; the App does not itself determine the visitor's jurisdiction or whether a consent framework is legally required there. The Merchant is responsible for deploying and correctly configuring a consent-management framework on its storefront (including via Shopify's Customer Privacy API) so that the applicable consent signal is presented to the App in accordance with the laws of its customers' jurisdictions. Mavira honors whatever consent signal the storefront surfaces (and always honors GPC), but it relies on the Merchant to put the correct consent infrastructure in place; see Section 11.3 and our Terms of Service for the allocation of responsibility between Mavira and the Merchant in this respect.

Visitors who arrive at the Merchant's storefront through any other channel are not tracked by the App in any way.

4.2 Order data

After a qualifying purchase is completed, the App identifies and records the order through the following complementary mechanisms:

• Primary path (real-time webhook). The App subscribes to Shopify's orders/paid webhook, which fires when an order is paid. When it fires, the App inspects the order for a Mavira referral code and, if found, records the order in our database and (where the order was placed after the Merchant's trial ended — see Section 7) submits the corresponding usage record to Shopify.
• Safety-net polling. A periodic background poll (approximately every 5 minutes per shop) queries the Shopify Admin API for recently paid orders. This serves as a backstop if a webhook is delivered late, dropped, or otherwise missed.
• Dashboard-load poll. When a Merchant opens the App's embedded dashboard, the App may run the same recent-orders query as the safety-net poll, throttled to at most once every approximately 5 minutes per shop. This is an additional trigger for the same query against the same data; it does not collect any new category of data.

Either path may detect a given order first; a database uniqueness constraint ensures that no order is recorded more than once. Orders without a Mavira referral are disregarded and not stored.

An order's commission is a live figure, not a one-time snapshot. After an order is first recorded, the App keeps the commission reconciled to the order's current state. The App subscribes to Shopify's orders/updated, refunds/create, and orders/cancelled webhooks; when an order is edited, partially or fully refunded, or cancelled, the App re-reads the order's current subtotal from Shopify and recomputes the commission accordingly. This can reduce the commission (a partial refund or downward edit) or increase it (an upward edit), and may result in an additional charge or in an internal credit applied against future charges, as described in our Terms of Service. No new category of end-customer data is collected in the course of this reconciliation.

All incoming Shopify webhook payloads — including but not limited to those described in this policy — are verified using Shopify's HMAC-signature mechanism before any processing. Requests with an invalid signature are rejected.

4.3 Storefront enablement check

Separately from the end-customer data described above, and in order to detect a configuration problem rather than to collect any end-customer data, the App performs an automated daily check of whether the App's referral tracker is actually switched on in the Merchant's storefront theme. Enabling the tracker is a step the Merchant completes during onboarding by self-attestation (the Merchant confirms that it has switched the theme app embed on); this check verifies that attestation on an ongoing basis, because a tracker that has been switched off silently stops all referral attribution for the Merchant.

Once per day, for each Merchant whose subscription is in a trial or active state, the App makes a single unauthenticated HTTP request to the Merchant's own public storefront homepage and inspects the returned page to determine whether the tracker asset is present. The request follows ordinary redirects and identifies itself with a descriptive User-Agent (MaviraTrackerCheck/1.0 (+https://www.maviraai.com)).

This check is directed only at the Merchant's own publicly available storefront. It does not collect, receive, or store any end-customer data, and it makes no request to any third party (it is therefore not a new sub-processor and does not change where data is processed). The App does not store the storefront's page content, its URL, or any other part of the response; it records only (a) a timestamp of when the check last ran for the store and (b), where the tracker is found to be absent, a timestamp marking when it was first observed to be disabled (cleared once the tracker is seen again or once the Merchant confirms re-enablement). A store that is password-protected, unreachable, or otherwise returns an inconclusive result is never treated as disabled. These two timestamps are Merchant business data and are described in Section 3.2.

Where the check finds the tracker disabled, the App shows the Merchant an in-product prompt to re-enable it, explains that no commissions are recorded while the tracker is switched off, and sends an internal operational alert to Mavira's operations team (see Sections 5 and 9). The allocation of responsibility, as between Mavira and the Merchant, for keeping the tracker enabled is addressed in our Terms of Service.

5. How We Use Your Data

We use the data described in Section 3 for the following purposes, and no others:

• To identify and report qualifying purchases attributed to Mavira referral traffic.
• To provide the Merchant with reporting on attributed sales through the App's embedded admin interface.
• To calculate, and to keep reconciled to each order's current state, the commission amounts owed by the Merchant to Mavira in respect of attributed sales — including recomputing a commission when an order is edited, refunded, or cancelled, and netting any resulting over-charge against the Merchant's future commissions — in accordance with the commission structure approved by the Merchant when subscribing to the App.
• To submit usage records to Shopify so that Shopify bills the Merchant on Mavira's behalf via the Merchant's Shopify-managed recurring app subscription.
• To check, once per day, whether the App's referral tracker remains enabled on the Merchant's storefront, and to prompt the Merchant to re-enable it where it is not, as described in Section 4.3.
• To send operational and transactional emails to the Merchant in connection with the App and the subscription, including (i) cap-raise approval requests, (ii) cap-raise approval confirmations, (iii) trial-ending reminders, (iv) first-commission notices, and (v) confirmations relating to uninstallation and data deletion. These are not marketing emails.
• To send internal operational alerts to Mavira's operations team, including notifications of subscription declines, failures to create a subscription, unknown-partner installs, uninstallations, data-handling failures, detections that a Merchant's storefront tracker has been disabled, and uninstallations that occur while the Merchant still holds an unused commission credit.
• To respond to data-subject and Merchant data requests, including those received via Shopify's mandatory GDPR compliance webhooks (Section 10).
• To comply with legal obligations, enforce our agreements, and protect against fraud, abuse, or unauthorized use of the App.

We do not use the collected data for advertising, third-party marketing, profiling, automated decision-making producing legal or similarly significant effects, or any purpose beyond those listed above.

6. Data Sharing and Disclosure

7. Data Storage, Security, and Retention

7.1 Storage and security

All App business data is stored on Supabase (United States region). Supabase employs industry-standard security practices including encryption in transit (TLS) and at rest. Access to production data is restricted to authorized personnel and to the App itself via a server-side service-role credential. The App's tables are not reachable with the database's public API keys: row-level security is enabled on each of them, and only that server-side credential can read or write them. Shopify OAuth tokens are held by the Shopify-recommended session-storage adapter, backed by the same Supabase Postgres project as the business data but kept in a separate database schema; they are deleted on uninstall.

All webhook endpoints validate Shopify's HMAC signature before processing the payload, and reject requests with an invalid signature. Inbound and outbound traffic between the App, Shopify, Supabase, Resend, and the Merchant's browser is transmitted over TLS.

7.2 Retention periods

7.3 Rolling purge and de-identification

On a rolling weekly basis, the order identifiers (the Shopify order ID and order name, plus any Shopify error text recorded with a failed charge, which can quote them) are removed from the commission and commission-credit records of orders placed more than approximately 24 months earlier, whether or not the App is still installed on the Merchant's store. Because the purge runs weekly, individual records may keep their identifiers for up to approximately seven days past the 24-month mark.

The records themselves are de-identified, not deleted: the financial portion is kept, as described in Sections 3.2 and 7.2, and a timestamp records when the identifiers were removed. This de-identification is the only way the App removes order identifiers, whatever triggers it: the rolling purge, the deletion on uninstall (Section 7.4), and the customers/redact and shop/redact webhooks (Section 10).

7.4 Deletion on uninstall

If a Merchant uninstalls the App, the following occurs:

• Immediately on receipt of Shopify's app/uninstalled webhook, the App deletes the Merchant's OAuth session tokens, marks the Shopify installation's subscription status as cancelled (which causes background jobs such as cap-raise checks, trial-ending emails and the storefront enablement check to stop touching that installation) and clears any pending subscription-approval URL, schedules the removal of the Merchant's order identifiers for approximately 36 hours later, and sends an internal notification email to Mavira operations. A reinstall before then cancels the scheduled removal.
• Approximately 36 hours after uninstall, a scheduled deletion job removes the order identifiers from all of the Merchant's commission and credit records (Section 7.3).
• Approximately 48 hours after uninstall, Shopify delivers a shop/redact webhook as a GDPR safety net. On receipt, the App repeats that removal for any records the scheduled 36-hour job has not already processed.

In all cases, order identifiers are removed from the commission and credit records within thirty (30) days of uninstall, as required by Shopify. The de-identified commission and credit records, and the commission account and Shopify installation records, are retained as described in Section 7.2. Where the Merchant uninstalls while still holding an unused commission credit, the App notifies Mavira's operations team and retains the credit (which contains no end-customer identity) so that it can be settled out of band or reused if the Merchant reinstalls; the deletion paths described above and in Section 10 remove its order identifier but keep the credit.

7.5 Breach notification

In the event of a personal data breach affecting Merchant or end-customer data processed through the App, we will notify affected Merchants without undue delay and, where feasible, within seventy-two (72) hours of becoming aware of the breach, in accordance with applicable law.

8. Merchant Data Rights and Deletion Requests

As a Merchant using the App, you have the right to:

• Request a copy of the data we hold associated with your store, including your partner profile, your commission account and Shopify installation records, and your commission ledger entries.
• Request correction of any inaccurate data.
• Request deletion of data associated with your store. We carry out a deletion request once the App is uninstalled from your store (if it is still installed, we will ask you to uninstall it first, because the App cannot operate without these records), and the order identifiers are removed as described in Section 7.4. Records Mavira must keep as financial records (Sections 7.2 and 11.1), namely the commission and credit records, are otherwise retained for the periods in Section 7.2, together with only the details that support them: the store's Shopify shop identifier and domain, the subscription identifiers, the commission rate, the trial end date, the approved billing cap, and the partner's name. Everything else the App holds about your store, including its onboarding and storefront-check records, is deleted (deletion-job coordination records are removed on their own schedule, Section 7.2). Where no financial records exist, the commission account and Shopify installation records are deleted entirely.
• Request restriction of how we process your data, subject to the limits of what is necessary to continue providing the App.
• Object to processing of your data based on Mavira's legitimate interests, where such a right applies under applicable law.

To exercise any of these rights, contact us at team@maviraai.com. We will acknowledge requests within thirty (30) days, and deletion timelines specifically are as described in Section 7.4.

9. Outbound Communications

The App may send the following operational and transactional emails. All such emails are sent via Resend (see Section 6.2) from a single sender, Mavira Referral Tracker <notifications@maviraai.com>. None of these emails is marketing.

To the Merchant (sent to the Merchant business contact email on file):

To Mavira operations (sent to team@maviraai.com):

Transactional email is a required dependency of the App: the App will not start without its email provider configured, and a failed send surfaces as an error rather than being silently dropped. Merchants who notice they are not receiving expected operational emails should contact Mavira support at business@maviraai.com.

10. Shopify Mandatory Compliance Webhooks

In accordance with Shopify's privacy requirements, the App subscribes to and responds to Shopify's three mandatory GDPR compliance webhooks. Each incoming request is verified using Shopify's HMAC signature; requests with an invalid signature are rejected with a 401 response. Requests with a valid signature are acknowledged with a 200 response and processed within 30 days.

The App holds per-order data only in its commission and commission-credit ledgers, keyed by the Merchant's Shopify installation (identified from the webhook's shop identifier, or failing that its shop domain) and the Shopify order ID (see Section 3). When a compliance webhook references specific orders, the App locates and acts on the matching records there.

End customers who wish to request access to or deletion of their attribution data outside the Merchant-driven Shopify webhook flow may also email team@maviraai.com directly with their order number, as described in Section 8.

11. GDPR and International Compliance

If you or your customers are located in the European Economic Area (EEA), the United Kingdom, or another jurisdiction with a comprehensive data protection regime, you may have additional rights under the General Data Protection Regulation (GDPR), the UK GDPR, or comparable laws.

12. California Privacy Rights (CCPA / CPRA)

If you or your customers are California residents, you have specific rights under the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA).

13. Children's Privacy

The App is intended solely for use by Shopify Merchants and is not directed at or designed for use by children. We do not knowingly collect any data from children under the age of 13, or under the applicable minimum age in the visitor's jurisdiction (which may be as high as 16 in certain EEA member states). If you believe that a child has provided data through the App, please contact us at team@maviraai.com and we will promptly delete any such data.

14. Changes to This Policy

We may update this Privacy Policy from time to time. For material changes — such as expansions in the types of data we collect, new purposes for which we use data, additions of sub-processors that change where or how data is processed, or changes to the retention periods in Section 7 — we will provide at least thirty (30) days' notice before the updated policy takes effect, via the Shopify App Store, the App interface, and by email to the address associated with the Merchant's Shopify account where practical. For non-material changes (such as clarifications, typographical corrections, or formatting changes), we will update the effective date without advance notice. The updated policy will include a revised effective date, and the prior version will be made available upon request.