Privacy policy

What we collect from merchants

When you install Maya, Shopify gives us access to your store. We keep:

• Your store's myshopify.com domain and the access token Shopify issues to Maya.
• Your store's name, contact email, currency and time zone, read from Shopify. We use the email only to send you alerts about Maya.
• The settings you save in Maya (fee, design, text, placement, policy page and fulfillment settings) and an activity log of changes and events in your Maya dashboard.
• Messages you send us when you ask for support.

What we keep about orders

For orders placed while Maya is installed, we keep:

• the order ID and number, date, currency, subtotal and protection fee;
• the shopper's protection choice (protected, declined or no choice), which widget design and fee they were shown, and when they chose;
• whether the protection item was fulfilled, and whether the order was cancelled.

We do not keep any information that identifies the shopper.

What happens on your storefront

• Maya's widget runs in the shopper's browser. It reads the cart through Shopify's cart API to show, add, remove and update protection.
• It records the shopper's choice as cart attributes (for example _maya_choice). Shopify stores these with the order.
• It sends Maya short reports on whether the widget appeared: the kind of page, desktop or mobile, the theme ID and, when another protection app is on the page, that app's name and fee. Reports carry no shopper identifiers and are counted per day.
• It uses the browser's session storage to avoid sending the same report twice. The widget sets no cookies.
• To block abuse, our servers count requests per IP address for up to one minute in temporary memory. IP addresses are not saved in our database, though they can appear in short-lived server logs.

How we use this data

Only to run Maya for you: show and price protection, keep Maya's protection product and policy page in your store, mark protection items fulfilled if you turn that on, show reports in your dashboard, send you alerts, answer support requests and prevent abuse. We do not sell data, use it for advertising or build profiles of shoppers.

Who we share it with

• Shopify, which runs your store and the APIs Maya uses.
• Our hosting provider, whose servers run Maya and its database.
• Resend, our email delivery provider, only when Maya sends you an alert email.

We share data with anyone else only if the law requires it.

How long we keep it, and deletion

• We keep the data above while Maya is installed.
• When you uninstall Maya, we delete its access token and sessions straight away. Your settings, order records and activity log stay for 48 hours, so a reinstall picks up where you left off. Shopify then sends a shop redaction request, and we delete everything we hold for your store.
• When Shopify sends a customer redaction request, we delete our records for the orders it names. When it sends a customer data request, we report what we hold for those orders so you can answer the customer.

Security

Maya is served over HTTPS. Access tokens and data are kept on servers with restricted access, and Maya's database and cache are not reachable from the internet.

Your rights

Merchants can ask us to access, correct or delete their data at any time by email. Maya processes order data on the merchant's behalf, so shoppers should contact the store they bought from; we will help the store answer.

Changes

If we change this policy, we will update this page and the date at the top.

Contact

Email support@octidev.com or message us on WhatsApp.