Legal · Marka Shopify apps
Privacy Policy
What each app reads, stores and shares, for how long, and your rights. Effective 21 October 2026.
This Privacy Policy explains how the Shopify apps published by Marka Modern Retail Private Limited, trading as House of Marka ("Marka", "we", "us"), handle personal data. It covers:
- Marka Reviews, listed on the Shopify App Store as ReviewMaster
- Marka Bundles & Upsells
- Marka Cart Drawer
- Marka Metrics
The policy for our website, houseofmarka.com, is a separate privacy policy. Margship has its own website and policy.
We wrote each app's section from the app's code. If an app changes what it collects, keeps or shares, we update this policy in the same release.
1. Who is responsible for what
For your customers' data, your store is in charge and we act for you. When an app processes data about your store's customers and visitors ("shoppers"), you, the merchant, decide why and how that data is used:
- Under the GDPR and UK GDPR you are the controller and we are your processor.
- Under US state privacy laws you are the business and we are your service provider.
- Under India's Digital Personal Data Protection Act 2023 you are the Data Fiduciary and we are your Data Processor.
We process that data only to run the app for your store, under the Data Processing Addendum. Shoppers who want to use their privacy rights should contact the store. We help the store answer, as described in section 9.
For your account with us, we are in charge. We are the controller of the data we need to run our relationship with you:
- your store's contact details;
- the plan and billing records Shopify sends us;
- your support emails to us;
- the security records described below;
- for Marka Reviews, the list of email addresses that have unsubscribed from review emails, so no Marka Reviews store emails them again.
2. Data every app handles
When you install any of our apps, Shopify gives it:
- your store's name and domain;
- the store's email address, currency, locale and time zone;
- an access token that lets the app call Shopify on your behalf.
We use these to run the app, to contact you about it, and to apply your plan. Access tokens are stored encrypted. Marka Reviews, Marka Bundles & Upsells and Marka Metrics also encrypt them themselves with AES-256-GCM.
The apps record your staff only as Shopify's user ID, where they need to know who did something (for example an audit of who viewed customer details). They do not keep staff names or email addresses.
Billing. Paid plans are charged by Shopify. We receive the plan, its price and status, never card or bank details.
Security records. Our servers keep technical logs, which can include IP addresses, for up to 30 days, to keep the apps running and secure.
What we never do with any app's data:
- We do not sell personal data, and we do not share it for cross-context behavioural advertising.
- We do not use your store's or your customers' data to train AI models.
- We do not combine one store's customer data with another's.
3. Marka Reviews
Marka Reviews sends review requests after an order is fulfilled, collects reviews, photos, videos and questions, and shows them on the store.
What it reads from Shopify. Your products, and your orders when they are paid, fulfilled or cancelled, including the customer's name and email on fulfilled orders. It uses the scopes read_products, write_products, read_orders, read_customers, write_files and write_discounts. Of Shopify's protected customer data it uses name and email only, to send review requests and match reviews to orders. It does not read or store phone numbers or addresses.
What it stores about shoppers:
| Data | Why | How long |
|---|---|---|
| Review requests: the customer's name and email, the order and the products bought | Send the review request and any reminders, and mark the review "verified" when it matches the order | The link works for the delay you set plus 60 days. The name and email are removed 30 days after that. The request is deleted after 730 days. |
| Reviews: name, email, optional location, rating, title, text, photos and videos, and the order they belong to | Show the review on your store, let you reply, and send an incentive if you offer one | Until you delete the review, the shopper's data is erased, or your store's data is deleted |
| Questions: name, optional email, question | Show the question and email the shopper once when you answer it | As for reviews |
| Incentives: email, discount code and its use | Give the reviewer the discount you offered, once per customer | As for reviews. On erasure the email is removed. |
| Unsubscribed email addresses | Never email someone who unsubscribed | Kept permanently, as the reason to keep them is to keep them suppressed |
The reviewer's email address is never published. Photos and videos are stored in your store's Shopify Files, not on our servers.
Imports. If you import reviews from a CSV file, Etsy or AliExpress, the reviewer names, locations and texts in that import are stored like other reviews. Images from AliExpress are shown from AliExpress's servers.
Emails to shoppers. Each order gets at most one review request, plus the reminders you choose (none on the Free plan). The shopper also gets an email with their discount if you offer an incentive, and one email when you answer their question. Every email has a one-click unsubscribe. An address that unsubscribes is suppressed for every store using Marka Reviews. The email says it was sent because the shopper bought from your store. You can limit review requests to customers who accepted marketing.
Storefront. The review blocks set no cookies. They remember a shopper's "helpful" votes in the browser and that a review pop-up was shown. More in Cookies and Storefront Tracking.
Optional connections you choose. Etsy (with your own Etsy app key), AliExpress, and a Google Merchant Center ratings feed, which Google collects from a private link and which carries published reviews with reviewers' display names. When a shopper adds a YouTube link to a review, the video's thumbnail loads from YouTube.
4. Marka Bundles & Upsells
Marka Bundles & Upsells shows bundle, quantity-break and upsell offers on the store, prices them at checkout through Shopify discounts, and can offer a product after payment.
What it reads from Shopify. Your products and collections, to build offers. It uses the scopes read_products, read_orders, read_customers, write_discounts and write_app_proxy.
What it stores about shoppers:
| Data | Why | How long |
|---|---|---|
| Offer details added to cart lines (which offer, tier or gift step), and any personalisation text the shopper types | Price the offer correctly at checkout and show the shopper what they chose | Part of the cart and the order in Shopify. The app keeps no copy. |
| Offer events (an offer was shown or added to cart), with a random session ID and, if the shopper is logged in, a keyed hash of their customer ID | Show you how offers perform. Recorded only when the shopper allows analytics and preferences in Shopify's privacy settings, and only while you keep offer analytics on | Your chosen window of 7 to 60 days (60 by default). If the shopper withdraws consent, that session's events are deleted. |
| Order summaries you import (order ID, keyed customer hash, totals, the offer lines) | Show you sales from your offers | Your chosen window of 7 to 60 days |
| After-payment offers: a keyed customer hash, locale, country, order total and items | Offer and add a product after payment | Deleted 24 hours after the offer expires |
The app stores no shopper names, email addresses, phone numbers or postal addresses. Customer IDs are kept only as keyed hashes. Customer history, customer contact details, the checkout analytics pixel, AI writing assistance and automatic translation are not active. We will update this policy before switching any of them on.
Our support access. Our staff can see your store's data in the app only if your store's owner grants it, for 24 hours at a time, for a stated reason. Every access is recorded in a log the owner can see.
Storefront. The offer blocks set no cookies. More in Cookies and Storefront Tracking.
5. Marka Cart Drawer
Marka Cart Drawer replaces the theme's cart with a drawer that carries rewards, offers and add-ons, priced at checkout through Shopify discounts. It sends no emails or messages to anyone.
What it reads from Shopify. Products and inventory, orders (a rolling 60 days), customers, and abandoned checkouts. It uses the scopes read_products, read_inventory, read_orders, read_customers, read_customer_events, read_themes, write_discounts, write_cart_transforms and write_pixels.
What it stores about shoppers:
| Data | Why | How long |
|---|---|---|
| Drawer events (an offer shown, added or declined): a random session ID, products, cart value, country chosen on the store, device type, and the customer ID if logged in | Show you how the drawer performs and choose offers. Recorded only when the shopper allows analytics, unless you switch that requirement off (see Cookies) | 90 days |
| Orders: line items, totals, statuses and refunds | Recommendations and conversion reports | A rolling 60 days |
| Which offers and experiments led to an order | Report sales from the drawer and from A/B tests | While the app is installed |
| A customer profile: customer ID, first order date, number of orders and amount spent, country, and derived spend tier, interests and price band | Show logged-in shoppers relevant offers | Deleted 730 days after the customer's last order |
| Carts left behind | Show "left in your cart" items in the drawer and match orders. Nothing is sent to the shopper. | Expire after 30 days, deleted after 90 |
| Email, phone and address, only if Shopify has granted the app access to these protected fields | Recognise returning shoppers across devices for personalisation | Encrypted with AES-256-GCM under a key for your store only. Removed 730 days after the last order or cart, at once if Shopify withdraws access, and at uninstall |
The app does not store names, payment details, birth dates or notes. It does not store IP addresses or locate shoppers by IP. Before any contact detail is decrypted, the purpose, the fields and who asked are recorded in an access log, kept for 365 days.
Storefront. The drawer keeps a session ID and its own settings in the browser and, with analytics consent, an A/B test ID for 180 days. More in Cookies and Storefront Tracking.
6. Marka Metrics
Marka Metrics reports on the store's sales, customers, profit, taxes and storefront visits. It shows nothing to shoppers except an invisible Shopify web pixel.
What it reads from Shopify. Orders (amounts, items, discounts, taxes, payment method and card brand, fulfilment, returns, and the marketing source of the visit), customers, products and inventory, payouts, disputes and returns, and Shopify's own reports. It uses the scopes read_orders, read_fulfillments, read_products, read_customers, read_inventory, read_reports, read_returns, read_customer_events, write_pixels and read_shopify_payments_accounts, _payouts and _disputes. If you use segment tags on the Pro plan, it also uses write_customers, to add tags beginning marka:.
What it stores about shoppers:
| Data | Why | How long |
|---|---|---|
| Orders, with the shipping city, region, country and postal code only (never street lines), and the customer ID | Sales, profit, tax and customer reports | While the app is installed |
| Customers: ID, order counts, locale, tags, marketing and tax status, default city, region, country and postal code | Customer reports, segments and lifetime value | While the app is installed |
| Customer names, emails and phone numbers | Let you search and recognise customers in reports. Only while "Store customer names, emails and phone numbers" is on in the app's settings (on by default). Turning it off deletes them. | Encrypted with AES-256-GCM, while the setting is on |
| Storefront visits recorded by the web pixel: pages and products viewed, cart and checkout steps, clicks on links and buttons, searches, and which checkout field was in use (never what was typed), with a visit ID and a pseudonymised Shopify browser ID | Traffic, funnel and drop-off reports. Recorded only when the store's privacy settings allow analytics for the shopper | The window you choose, 30 to 400 days (395 by default) |
| Data-request packages | Answer a shopper's request through the store | 30 days |
Before storing, the app removes email addresses and phone numbers from searches and checkout messages, and strips secret parts of web addresses. It does not store IP addresses, and it does not record screens, heatmaps or what shoppers type into fields.
Emails. A weekly summary and any scheduled reports go to the addresses you set, or to your store email. Marka Metrics never emails shoppers. If you enter a webhook address for scheduled reports, the report summary and a download link that expires after 7 days are sent there.
7. Where data is stored
Our apps run on Microsoft Azure in the United States:
| App | Region |
|---|---|
| Marka Reviews | Central US |
| Marka Bundles & Upsells | Central US |
| Marka Cart Drawer | North Central US |
| Marka Metrics | North Central US |
Marka Reviews sends email through Resend, in the United States. Marka Metrics sends email through Azure Communication Services, also in the United States. The full list is on Subprocessors.
We are based in India. Where data from the European Economic Area, the United Kingdom or Switzerland is processed outside those places, we rely on the European Commission's Standard Contractual Clauses and their UK and Swiss equivalents, which are part of the Data Processing Addendum.
8. How long we keep data, and deletion
Each app's tables above give the main periods. When you uninstall, the app's data is deleted as set out in Data Requests and Deletion. Database backups are kept for 7 to 14 days, depending on the app, and then overwritten.
9. Your rights
Shoppers. Your store is in charge of your data. To see, correct, delete or get a copy of it, contact the store you bought from. When a store passes your request to us through Shopify, the app concerned acts on it as described in Data Requests and Deletion. You can also unsubscribe from Marka Reviews emails with the link in any of them.
Merchants. You can ask us for a copy of the account data we hold about you, or to correct or delete it, by writing to support@houseofmarka.com. Depending on where you are, you may also have the right to object to or restrict our processing, and to complain to your data protection authority. In India, you may contact our grievance contact at the same address. We answer within 30 days.
10. Children
The apps are for businesses. They are not directed at children, and we do not knowingly process children's data except as part of a store's ordinary orders and reviews.
11. Changes
We will update this policy when an app changes what it handles. We will tell you about material changes in the app or by email before they take effect, and change the effective date shown above.
12. Contact
Marka Modern Retail Private Limited Basement, Plot No. 39, Sector 27, Gurugram, Haryana 122001, India support@houseofmarka.com