Privacy Policy

This Privacy Policy explains how MyBranz, Inc. ("MyBranz," "we," "us") collects, uses, and shares information in connection with Affinity (the "Service"), an application that helps Shopify merchants score their customers on brand affinity and activate high-affinity audiences to advertising and marketing platforms.

Affinity is a business-to-business tool installed by a merchant (the "Merchant") on their store. For the personal data of the Merchant's customers that we process, the Merchant is the data controller and MyBranz acts as a data processor on the Merchant's behalf.

1. Information we collect

From the Merchant's store (via Shopify)

• Order data — order totals, currency, dates, and the associated customer.
• Customer data — name, email address, and Shopify customer ID.
• Storefront behavioral events — page and product views and similar onsite activity, collected via a Shopify web pixel.

From connected tools (only if the Merchant connects them)

• Email engagement (e.g. Klaviyo) — email opens and clicks.
• Support engagement (e.g. Gorgias) — support ticket activity.
• Reviews (e.g. Judge.me) — product reviews.

From advertising platforms (only if the Merchant connects them)

• With the Merchant's authorization via Facebook Login and Google OAuth, we access the list of ad accounts they can manage and create/update audiences within the account they select. We do not receive any platform user's personal data back, and we do not access per-person ad engagement.

Account and technical data

• Merchant store domain, installation details, configuration, and access tokens (encrypted at rest).

2. How we use information

• To compute a 0–100 brand-affinity score and tier for each customer, ranked within the Merchant's store.
• To build audience cohorts the Merchant defines, and—only when the Merchant chooses—to activate them.
• To operate, secure, support, and improve the Service.

3. How we share information

We do not sell personal data. We share data only as needed to provide the Service:

• Advertising & marketing platforms. When a Merchant activates an audience, we send a SHA-256 hash of each consented customer's email address to the destination the Merchant selected (e.g. Meta Custom Audiences, Google Customer Match, Klaviyo). We only include customers whose marketing consent is granted. We do not send raw email addresses or other personal data beyond what these hashed-match APIs require.
• Subprocessors. We use infrastructure providers (e.g. cloud hosting and database providers) to run the Service. They process data on our behalf under contract.
• Legal. We may disclose information where required by law or to protect rights, safety, and the integrity of the Service.

4. Consent

We honor Shopify's Customer Privacy settings. In regions where consent is required, the storefront pixel only collects data after the shopper consents. Only customers with granted marketing consent are eligible for activation, and their email is hashed before it is sent to any advertising platform.

5. Data retention

We retain customer and engagement data for as long as the Merchant uses the Service, and delete it when the Merchant uninstalls or requests deletion. We honor Shopify's mandatory data-erasure and shop-redaction webhooks.

6. Your rights & deletion

Depending on your location, you may have rights to access, correct, or delete your personal data, or to object to or restrict its processing. A customer of a Merchant should contact that Merchant, who can request action through us. Anyone may also contact us directly. See our Data Deletion instructions.

7. Security

We encrypt access tokens and connector credentials at rest (AES-256-GCM), transmit data over TLS, and scope every query to a single store. No method of transmission or storage is perfectly secure, but we work to protect your information.

8. International transfers

We may process and store information in the United States and other countries. Where required, we use appropriate safeguards for cross-border transfers.

9. Changes

We may update this policy. Material changes will be reflected by updating the date above and, where appropriate, by additional notice.

10. Contact

MyBranz, Inc. — privacy@mybranz.com.