1. Scope and our role
This Policy applies to Announce Me, its merchant administration experience, storefront theme extension, support and related website. It does not govern Shopify’s own handling or a merchant’s independent handling of personal information.
For merchant-user, account, billing, support, website and security information, Marvello generally acts as the controller, business or APP entity. For storefront content and visitor analytics processed to provide the app for a merchant, the merchant generally acts as controller or business and Marvello acts as processor or service provider. The legal role depends on the facts and applicable law.
2. Information we collect
From Shopify: store domain and identifiers; installation, permission and plan information; authorised user identifiers and, where Shopify supplies them, name, email, locale and account-role details; market, country, currency and shipping configuration needed for enabled features; and webhook data needed to maintain, secure or delete the service.
From merchants: announcement copy, links, discount codes, schedules, targeting, translations, design choices, shipping thresholds, configuration, support messages and any information voluntarily included in them.
From storefront interactions: store, announcement and experiment-variant identifiers; impression or click event; country and date context; analytics-consent state; and, only where analytics consent permits, a random browser identifier that is transformed with the store domain into a shop-specific pseudonymous hash. Announce Me does not intentionally collect shopper names, email addresses, Shopify customer IDs, order records or payment-card data for these analytics.
Automatically: limited request, device, browser, security, availability and error information produced by our systems and providers. Network providers may process IP addresses to deliver and protect the service even where we do not intentionally retain them in application analytics.
3. How and why we use information
We use information to authenticate authorised users; install and operate the app; retrieve supported market and shipping settings; save, publish and display announcements; calculate and report aggregate impressions, clicks, unique pseudonymous visitors and experiment results; administer plans; provide support; secure, troubleshoot and improve reliability; comply with Shopify requirements and law; enforce our terms; and respond to privacy requests. Where applicable, our legal bases include performance of a contract, legitimate interests in operating and protecting the service, compliance with law and consent. We do not sell personal information, share it for cross-context behavioural advertising or use Merchant Personal Data to build advertising profiles.
4. Storefront privacy and merchant duties
Storefront analytics operates only when enabled by the merchant and Shopify’s customer-privacy interface reports that analytics processing is allowed. When that permission is not available, Announce Me is designed not to send analytics events or create the browser identifier. When withdrawal is reported, the local identifier is removed and later consent-dependent collection stops.
The merchant controls whether analytics is enabled, the storefront relationship and its privacy and cookie notices. Merchants must configure Shopify privacy settings and obtain any notice or consent required in each market. Standard storefront functionality such as rendering an announcement may still operate without analytics.
5. Disclosure and recipients
We disclose information only as reasonably necessary to Shopify; hosting, database, DNS, security and infrastructure providers; personnel and contractors bound by confidentiality; professional advisers; a successor in a genuine corporate transaction under safeguards; and regulators, courts or authorities where disclosure is lawfully required. We may also disclose information at a merchant’s documented direction. Our current service-provider categories and purposes appear in Subprocessors. We do not permit subprocessors to use Merchant Personal Data for their own advertising.
6. Overseas processing
Because Announce Me and its providers operate internationally, information may be processed in Australia, the European Economic Area, the United Kingdom, the United States and other locations where Shopify, Google Cloud or Cloudflare maintains infrastructure or support operations. Where required, we use reasonable contractual, organisational and technical safeguards, including applicable standard contractual clauses. Australian privacy law may make us accountable for certain overseas disclosures. Contact us for current transfer information relevant to your store.
7. Retention and deletion
We keep store configuration, authorised sessions and associated operational data while the app is installed or as needed to provide and secure it. Shopify’s uninstall and shop/redact processes trigger deletion of tenant-scoped sessions, configuration and announcement analytics from the active application database, subject to processing time, backups and lawful holds. Announce Me responds to Shopify’s mandatory customer data request and deletion webhooks even though it is not designed to retain customer or order records.
Our intended maximum operational periods are 13 months for storefront analytics, 90 days for routine security and diagnostic logs and 24 months after closure for support correspondence. Transaction, tax, dispute and compliance records may be retained for up to seven years, or longer where law requires. Backup copies are isolated from ordinary use and expire under provider backup cycles. We delete or de-identify information when no longer reasonably needed, subject to legal obligations and defensible claims.
8. Security and incidents
We use measures designed for the nature and risk of the information, including tenant separation, least-privilege access, encrypted transport, controlled secrets, authenticated Shopify requests, restricted administration, monitoring and deletion procedures. No online service can guarantee absolute security. If a personal-data breach occurs, we will investigate, mitigate and notify affected merchants, individuals or regulators when required by applicable law and our DPA.
9. Access, correction and other rights
Depending on your location, you may have rights to access, correct, delete, restrict or object to processing, obtain portability, withdraw consent and complain to a regulator. These rights may be limited by law. Merchants may also uninstall through Shopify and control storefront analytics in Announce Me.
Storefront visitors should ordinarily contact the merchant first because the merchant controls the storefront relationship. We assist merchants with verified requests and respond directly where we are responsible. We may request proportionate information to verify identity and authority and will respond within the period required by applicable law.
10. Consequences and choices
You may choose not to provide optional information. Without required Shopify installation, authentication, store configuration or billing information, we cannot provide the relevant service. Disabling analytics stops merchant-facing measurement but does not prevent the announcement bar from operating. Browser controls and the merchant’s Shopify privacy interface may also affect local storage and event collection.
11. Children and sensitive information
Announce Me is a business service and is not directed to children. Merchants must not use announcement content, targeting or links to intentionally collect sensitive information or children’s personal information through Announce Me unless they have a lawful basis and provide all required protections. We do not intentionally infer sensitive traits from storefront events.
12. Complaints and contact
Send privacy questions, access or correction requests and complaints to matthew@marvellogroup.co.uk. Please identify the relevant store and request without sending passwords, tokens or unnecessary personal information. We will acknowledge and investigate complaints and respond within the period required by applicable law. If you are dissatisfied, you may complain to the Office of the Australian Information Commissioner or your local privacy regulator.
You may request a copy of this Policy in an accessible form by contacting us.
13. Changes
We review this Policy as our practices and legal obligations change. We will publish revisions here with a new effective date and provide additional notice through the app, Shopify or email where a change materially affects rights or is otherwise required.