Privacy Policy
Effective Date: May 15, 2026
This Privacy Policy describes how Tuvion, Inc. ("we", "us", "our") collects, uses, and protects information when you use the Marv: AI Email & MMS Designer application ("Marv", "the App") available on the Shopify App Store.
What Data We Collect
Merchant Account Data
When you install Marv, we collect information associated with your Shopify account, including your name, email address, and store URL. This information is provided by Shopify as part of the app installation process.
Brand Profile Data
Marv automatically reads your Shopify store to detect your brand colors, logo, fonts, store name, address, phone number, and website. We may also collect additional information such as your industry, and brand description. This data is used to generate on-brand email and MMS designs.
Product Data
When you generate a design, Marv accesses product information from your Shopify store, including product names, descriptions, images, prices, and URLs. It also stores up to 50 best selling product details by looking at your orders data for the last 60 days solely to help you configure your campaign. Marv may also read publicly available customer reviews from your product pages to inform the copy it generates.
Generated Content
Marv stores the email and MMS designs it creates for you, including email templates, subject lines, copy, and exported images (such as animated GIFs). These are stored so you can access, edit, and export your designs.
Usage and Billing Data
We track the number of designs generated, API usage costs, and billing transactions to manage your subscription and design quota.
What We Do NOT Collect
Marv does not collect, store, or process end-customer (buyer) data. We do not access your customers' names, email addresses, shipping addresses, and payment information. When Shopify sends a customer data request or customer data erasure webhook, we respond confirming that no customer personal data is stored by the App. If this changes in the future, we will update this policy and implement appropriate handling procedures.
Legal Basis for Processing (GDPR)
If you are located in the European Economic Area (EEA), we process your data on the following legal bases:
| Processing Activity | Lawful Basis |
|---|---|
| Merchant account data for app operation | Performance of contract (Art. 6(1)(b)) |
| Brand profile detection and design generation | Performance of contract (Art. 6(1)(b)) |
| Product data for design generation | Performance of contract (Art. 6(1)(b)) |
| Usage and billing data | Performance of contract and legal obligation (Art. 6(1)(b), (c)) |
| Analyzing aggregated usage patterns to improve the App | Legitimate interest (Art. 6(1)(f)) — you have the right to object |
How We Use Your Data
We use the data we collect to:
- Generate email and MMS designs tailored to your products and brand
- Detect and apply your brand identity (colors, fonts, logo) to designs
- Manage your subscription, billing, and design quota related to Marv
- Push your designs into your connected Klaviyo account as draft campaigns, when you have authorized Marv to connect to Klaviyo
- Export your designs as a ZIP file that can be imported into Shopify Email, Mailchimp, Omnisend, or any other email service provider
- Analyze aggregated, de-identified usage patterns to improve the App's features and performance
Klaviyo Integration
If you choose to connect Marv to your Klaviyo account, the integration uses Klaviyo’s OAuth authorization flow. Marv requests only the permissions required to create draft campaigns in your account. When you push a design to Klaviyo, Marv sends Klaviyo the rendered HTML, subject line, preview text, and from-name for that single campaign. Marv does not read, download, or store your Klaviyo subscriber lists, profiles, or any other customer data from Klaviyo.
Marv only creates draft campaigns — it never sends campaigns to your recipients. You can revoke Marv’s access to your Klaviyo account at any time from your Klaviyo account settings; this does not affect drafts that have already been created.
We do not use your content, product data, or brand assets to train AI models. We do not sell your data to third parties.
Automated Decision-Making
Marv uses AI to generate marketing content. This processing does not involve automated decision-making that produces legal effects or similarly significantly affects you as defined by GDPR Article 22.
Information Sharing
We may share information with:
- Service Providers: Such as Generative AI services, your Email Service Providers, and design assets storage services
- Business Transfers: In the event of a merger or sale of our company
- Business Partners: To offer certain products, services, or promotions
Data Security
We take reasonable measures to protect your data, including:
- Shopify OAuth for authentication (we do not store your Shopify password)
- All data transmitted over HTTPS
- Shop-scoped data isolation (your data is only accessible to your store)
Data Breach Notification
In the event of a personal data breach, we will notify affected merchants without undue delay and no later than 72 hours after becoming aware of the breach, providing details of the nature of the breach, the categories of data affected, and the measures taken or proposed to address it.
Data Retention
We retain your merchant account data, brand profile, product data, and generated designs for as long as your Marv subscription is active. This enables us to continue providing the service, including accessing your previously generated designs and maintaining your brand profile for future campaigns.
Retention after uninstall. When you uninstall Marv, your generated designs and associated data are retained for 48 hours before permanent deletion. This grace period exists as a merchant safety feature — if you accidentally uninstall the app or reinstall during a plan change, reinstalling within the 48-hour window automatically restores your designs. After 48 hours, all generated designs, brand profile data, and associated account data are permanently deleted from our systems.
Immediate deletion requests. If you wish to have your data deleted immediately upon uninstall without waiting for the 48-hour window to elapse, contact us at support@agentmarv.com and we will process your request promptly.
Billing and transaction records may be retained for a longer period as required by applicable tax and accounting laws.
Your Rights Under GDPR
If you are located in the European Economic Area (EEA), you have the right to:
- Access the personal data we hold about you
- Correct inaccurate personal data
- Delete your personal data (uninstalling the app schedules full deletion within 48 hours; see the Data Retention section above for details)
- Restrict or object to certain processing of your data
- Data portability — request a copy of your data in a portable format
We will respond to verified data subject requests within 30 days. To protect your data, we may verify your identity by confirming your Shopify store ownership and the email address associated with your account.
To exercise any of these rights, contact us at support@agentmarv.com.
Your Rights Under CCPA
If you are a California resident, the California Consumer Privacy Act (CCPA) and its amendment, the California Privacy Rights Act (CPRA), provide you with specific rights regarding your personal information.
Categories of Personal Information Collected
| CCPA Category | Data Collected | Business Purpose |
|---|---|---|
| Identifiers | Name, email address, store URL | App operation, account management |
| Commercial information | Product catalog data, billing transactions, design quota usage | Design generation, subscription management |
| Internet or electronic network activity | App usage data, API call logs | Service operation, quota tracking |
| Professional or employment-related information | Store name, industry, brand description | Brand profile detection, design personalization |
| Audio, visual, or similar information | Product images, logos, generated design assets | Design generation, asset hosting |
Your Rights
You have the right to:
- Know what personal information we collect, the categories of sources, and the business purpose for collection
- Delete your personal information
- Correct inaccurate personal information
- Opt out of the sale or sharing of personal information — we do not sell or share personal information as defined by the CCPA
- Non-discrimination — we will not discriminate against you for exercising your CCPA rights
We will respond to verified CCPA requests within 45 days. If we need additional time, we will notify you of the extension and the reason.
To exercise any of these rights, contact us at support@agentmarv.com.
Cookies and Tracking
Embedded Shopify App
The Marv app embedded inside the Shopify admin does not use third-party analytics, advertising, or tracking cookies, and does not perform browser fingerprinting. The embedded app does not set its own cookies on your browser; it authenticates through Shopify App Bridge session tokens, which are not persistent cookies. Any cookies you may observe from shopify.com while using Marv are set by Shopify as part of the Shopify admin and are governed by Shopify's Privacy Policy. If Marv's hosting infrastructure sets any short-lived strictly-necessary cookies (such as bot-mitigation cookies) to protect the service from abuse, these are not used for tracking or advertising.
Marketing Site (agentmarv.com)
The marketing site at agentmarv.com uses Google Analytics 4 to measure aggregate traffic and understand how visitors discover Marv, and we configure Google Analytics with IP anonymization. We do not load Google Analytics at all unless you click Accept on the consent banner shown on your first visit — no requests are sent to Google's servers and no analytics cookies are set. If you click Decline, or do not respond, Google Analytics is never loaded. You can change your choice at any time by clearing site data for agentmarv.com in your browser, which will cause the banner to reappear. Data Google receives in connection with Analytics, if you accept, is governed by Google's privacy and terms; you can also install the Google Analytics opt-out browser add-on to block Analytics on every site you visit.
Separately, the Marv listing on the Shopify App Store is operated by Shopify, not by us. Shopify reports a limited set of impression and install events for that listing into the same Google Analytics property using a tracking ID we have provided to Shopify; these events are governed by Shopify's own privacy practices.
Shopify's Data Practices
Shopify collects certain data as part of the app installation and billing process. Shopify's handling of that data is governed by Shopify's own Privacy Policy. This Privacy Policy covers only the data that Tuvion, Inc. collects and processes through the Marv application.
Children's Privacy
Marv is not directed at individuals under the age of 16. We do not knowingly collect personal data from children.
Changes to This Policy
We may update this Privacy Policy from time to time. If we make material changes, we will notify you through the App or by updating the effective date at the top of this page.
Contact Us
If you have questions about this Privacy Policy or how your data is handled, contact us at:
support@agentmarv.com
Tuvion, Inc.