Privacy Policy

2. What Data We Collect

The App collects a limited, specific set of data — and only when a qualifying purchase occurs. A "qualifying purchase" is one made by a visitor who arrived at your Shopify store via a link from the Mavira website, identified via URL parameters set by Mavira at the time of referral. The App does not track, collect, or store any data related to orders from customers who did not originate from a Mavira referral link.

When a qualifying purchase is made, we collect the following data:

3. How We Collect Data

When a visitor arrives at a Merchant's Shopify store via a Mavira referral link, a cookie named mavira_refis set in the visitor's browser to identify them as a Mavira-referred visitor. This cookie persists for 90 daysfrom the date of the visitor's initial referral visit. It is used solely to attribute a subsequent purchase to Mavira's referral traffic. Visitors who arrive through any other channel are not tracked by the App in any way.

The App integrates with Shopify's Customer Privacy API to respect buyer consent signals. The mavira_refcookie is only set where the applicable consent signal permits it, or where no consent framework applies to the visitor's jurisdiction. Merchants are responsible for configuring their storefront's consent settings in accordance with applicable law.

Rather than relying on real-time event webhooks, the App uses a polling mechanism to periodically check for new orders and identify those attributable to Mavira referral traffic. Only orders associated with the mavira_ref cookie are processed. No data is collected or stored for any other orders.

4. How We Use Your Data

The data we collect is used exclusively to:

• Track and report sales conversions attributable to Mavira referral traffic
• Provide Merchants with accurate performance metrics for their Mavira partnership
• Calculate any revenue-sharing or commission amounts, where applicable

We do not use the collected data for advertising, profiling, or any purpose beyond the referral tracking functionality described above.

5. Data Sharing and Disclosure

Merchants can view data about orders attributable to their own store through the App's reporting interface. This is the only routine flow of data back to Merchants, and it is limited to the per-order data described in Section 2 for orders originating from that Merchant's store.

We do not sell or rent your data. We do not share data with any other third parties for advertising, marketing, or any other purpose. We may disclose data if required to do so by law, regulation, or valid legal process (such as a court order or subpoena).

6. Data Storage and Security

All data collected by the App is stored securely on Supabase, a managed cloud database platform. Data is stored in the United States. Supabase employs industry-standard security practices including encryption at rest and in transit. Supabase is our sole third-party sub-processor for App data; no other third parties receive or process order data collected by the App.

Breach Notification: In the event of a personal data breach affecting Merchant data, we will notify affected Merchants without undue delay and, where feasible, within 72 hours of becoming aware of the breach, in accordance with applicable law.

7. How the App Accesses Order Data

The App uses a polling mechanism to access order data from the Shopify API on a periodic basis. This means the App periodically queries the Merchant's store for recent orders and checks whether any are associated with the mavira_ref cookie. Only orders that match a Mavira referral are recorded; all other order data is disregarded and not stored.

This polling approach does not require real-time event hooks and is limited in scope to identifying and recording qualifying conversions as described in this policy.

8. Shopify Mandatory Compliance Webhooks

In accordance with Shopify's privacy requirements, the App subscribes to and responds to Shopify's three mandatory GDPR compliance webhooks. Each incoming request is verified using Shopify's HMAC signature; requests with an invalid signature are rejected with a 401 response. Requests with a valid signature are acknowledged with a 200 response and processed within 30 days.

The data the App stores is keyed by Shopify order ID and shop domain (see Section 2). When a compliance webhook references specific orders, the App locates and acts on the matching records in our database.

End customers who wish to request access to or deletion of their attribution data outside the Merchant-driven Shopify webhook flow may also email team@maviraai.com directly with their order number, as described in Section 9.

9. Merchant Data Rights and Deletion Requests

As a Merchant using our App, you have the right to:

• Request a copy of the data we hold associated with your store
• Request correction of any inaccurate data
• Request deletion of all data associated with your store
• Request restriction of how we process your data

To exercise any of these rights, please send an email to team@maviraai.com. We will acknowledge requests within 30 days; deletion timelines specifically are as described in Section 6.

10. GDPR and International Compliance

If you or your customers are located in the European Economic Area (EEA) or United Kingdom, you may have additional rights under the General Data Protection Regulation (GDPR) or UK GDPR.

Our processing of end-customer personal data is limited to a pseudonymous cookie identifier and per-order data associated with referral-attributed purchases. We do not collect directly identifying information about end customers. Our role under GDPR differs depending on the type of data:

We are committed to honoring all data subject and merchant data requests submitted to us directly, and we will respond to such requests within 30 days as described in Section 9.

11. California Privacy Rights (CCPA / CPRA)

If you or your customers are California residents, you have specific rights under the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA).

12. Children's Privacy

The App is intended solely for use by Shopify merchants and is not directed at or designed for use by children. We do not knowingly collect any data from children under the age of 13, or under the applicable minimum age in the visitor's jurisdiction (which may be as high as 16 in certain EEA member states). If you believe that a child has provided data through the App, please contact us at team@maviraai.com and we will promptly delete any such data.

13. Changes to This Policy

We may update this Privacy Policy from time to time. For material changes — such as expansions in the types of data we collect or new purposes for which we use data — we will provide at least 30 days' notice before the updated policy takes effect, via the Shopify App Store, the App interface, and by email to the address associated with the Merchant's Shopify account where practical. For non-material changes (such as clarifications or formatting), we will update the effective date without advance notice. The updated policy will include a revised effective date.