Privacy policy

Marginful (“we”) is a profit-analytics service for online stores. This policy explains what personal data we handle, why, for how long, who receives it, and your rights. Marginful is read-only towards your store: it never creates, edits or deletes products, prices, inventory, orders, customers, discounts or refunds.

1. Two roles

• For merchants’ store data (orders, products, their customers) the merchant is the controller and Marginful is a processor acting on the merchant’s instructions. If you bought from a store that uses Marginful, please contact that store; we will help it answer you.
• For our own users, customers, website visitors and partners Marginful is the controller.

2. Data we read for merchants

With the access the merchant approves at install: Shopify scopes read_products, read_inventory, read_orders, read_customers, read_shopify_payments_accounts, read_shopify_payments_payouts, and optionally read_all_orders.

• Shop: name, currency, time zone, country, plan.
• Catalog: products, variants, SKUs, prices, costs, weights, collections, inventory.
• Orders: line items, discounts, taxes, shipping, payment gateway and method, card brand (never the card number), refunds, fulfilments, chargebacks, tags, landing and referring page; shipping country, region and city.
• Payouts and fees from Shopify Payments, PayPal or Stripe; ad spend and campaign names from ad platforms; expenses and documents from QuickBooks, Xero or Morning (Morning documents include the supplier or client name); shipping and product costs from fulfilment providers — only for services the merchant connects.
• Files the merchant uploads: supplier invoices and spreadsheets.

3. What we store about stores’ customers (minimised)

• A display name of first name + last initial (e.g. “Dana L.”), a one-way SHA-256 hash of the e-mail (to recognise returning customers), and country.
• We do not store raw e-mails, phone numbers, street addresses, postcodes, card numbers or shoppers’ IP addresses.
• Line-item attributes entered at checkout (for example optical prescription values) are stored only to compute costs and are erased when the store’s customer asks to be forgotten. They can be health data and are protected accordingly.

4. Storefront pixel (optional)

If the merchant turns it on: a random visitor id and session id, page path, referrer (without query), campaign parameters (UTM) and ad click ids, product and order ids. On Shopify it runs only after the shopper allowed analytics; on other sites it honours Global Privacy Control and Do Not Track and can wait for the site’s consent banner. IP addresses and user agents are used only in memory for abuse protection and are never stored.

5. Data we process for ourselves

• Account: name, e-mail, password hash, sign-in method, passkeys, two-step settings, language and display preferences — to provide and secure your account.
• Security and audit log: actions, time, and the IP address for sign-in, password and connection events — for security and accountability.
• Billing: plan, subscription status, Shopify charge ids or Paddle customer and subscription ids, refund requests.
• Support and early-access sign-ups: what you send us (for example an e-mail and store address).
• Push notifications: the browser subscription for alerts you turned on.
• Partner program: partner name, contact e-mail, payout note, referral and commission records, and the mf_ref cookie (the partner code and click time) set when someone arrives through a partner link.
• AI usage counters: tokens and cost per month, no content — to keep AI costs within limits.

We do not sell or share personal data for advertising, and we use no advertising or analytics trackers on our website or app.

6. AI features

When a merchant uses AI features, we send the following to Anthropic (Claude API):

• Ask Marginful: the question and the figures needed to answer it — store, product, campaign and order figures, order numbers, and for customer questions up to ten customers’ display names (“Dana L.”) with their order counts and lifetime figures. Conversations are not stored by Marginful.
• Weekly briefing: aggregated store figures; the briefing text is stored in the workspace.
• AI import mapping: column headers and up to 20 sample rows, with e-mails, phone numbers and addresses masked.
• AI invoice reading: the supplier invoice file the merchant uploads, when it is read by AI. Most invoices are read by Marginful’s own reader on our servers without AI.

Under Anthropic’s commercial terms, API data is not used to train its models; Anthropic keeps it for a limited period for abuse monitoring.

7. Who receives data

• Sub-processors that run the service: hosting and database, e-mail delivery, and — only when AI features are used — Anthropic.
• Paddle for direct (non-Shopify) billing. Paddle is the merchant of record and collects payment details as an independent controller under its own privacy notice. Shopify bills Shopify stores on their Shopify invoice. We never see card details.
• Services the merchant connects (ad platforms, accounting, payment and fulfilment providers): we read from them on the merchant’s instruction.
• Authorities when the law requires it.

Some sub-processors are in the United States; such transfers rely on the EU-US Data Privacy Framework or on the European Commission’s Standard Contractual Clauses.

8. Retention and deletion

• Store data is kept while the app is installed or the workspace is active.
• Shopify: on uninstall the access token is deleted at once and syncing stops; 48 hours later Shopify sends a shop/redact request and we delete the store and all of its data.
• Webhook delivery records keep only ids and are deleted after 30 days. Sign-in codes are deleted 7 days after they expire.
• The audit log is deleted together with the workspace.
• Backups are encrypted and kept for a limited period, then overwritten.
• Billing records are kept as long as tax law requires.

9. Customer privacy requests (GDPR / CCPA / Israeli law)

Marginful subscribes to Shopify’s mandatory privacy webhooks:

• customers/data_request — we compile what we hold (display name, e-mail hash, country, order references) and make it available to the merchant.
• customers/redact — we delete the customer record, detach their orders, and erase line-item attributes and pixel events tied to them.
• shop/redact — we delete all data of the shop.

10. Your rights

Depending on where you live you may ask to access, correct, delete, restrict or port your data, object to processing, and withdraw consent. Under Israeli law you may review and ask to correct information about you held in a database. Under the CCPA you may know, delete and correct, and you will not be discriminated against for doing so. You may also complain to your supervisory authority — in Israel the Privacy Protection Authority, in the EU your local data protection authority, in the UK the ICO.

11. Security

TLS in transit; provider tokens and authenticator secrets encrypted with AES-256-GCM; HMAC verification of every Shopify webhook; role-based access; two-step verification and passkeys; an audit log of privileged actions; separate test and production databases; encrypted backups. We notify affected merchants without undue delay if a breach affects their data, and authorities where the law requires.

12. Cookies

We use only cookies needed to run the site and the app (sign-in, language, display preferences, security) and the partner cookie mf_ref described above. No advertising or analytics cookies.

13. Children

Marginful is a business service and is not directed to children.

14. Contact and changes

Questions or requests: contact us. We respond within 30 days. We post changes here and, for material changes, tell account owners by e-mail or in the app.