Legal

Privacy policy

How Marka Cart Drawer handles data about the merchants who install it and about the shoppers who visit their stores.

Effective date: 1 October 2026

In short

Shoppers are referenced by their Shopify customer ID. While a store has Marka installed, we also keep each shopper’s email address, phone number and address — encrypted with a key unique to that store — to recognise the same shopper across guest checkouts and duplicate customer accounts of that store and to suggest products that are popular in their area. We never store names.
Marka never contacts shoppers. It sends no emails, text messages or other messages, and contact details are never used for marketing.
Information about individual shoppers stays inside the app. Merchants see totals and choose audiences such as “premium spenders”; they never see who is in an audience, a profile of any shopper or any contact details.
Recommendations and offers based on a shopper’s stored purchase history are only shown to logged-in shoppers who allowed personalisation in the store’s cookie banner.
We do not sell or share personal data for advertising, and we never combine data from different stores.

1. Who we are

Marka Cart Drawer (“Marka”, “we”, “us”) is a Shopify app provided by Marka Modern Retail Private Limited, Basement, Plot No. 39, Sector 27, Arjun Nagar, Gurugram, Haryana 122001, India. Contact for privacy questions: tech@houseofmarka.com.

Merchants’ own data (the store and its staff as our customer): we decide how it is used and are the controller.

Data about a merchant’s shoppers: the merchant decides why it is processed and is the controller (a “business” under the California Consumer Privacy Act); we process it only on the merchant’s behalf and instructions, as a processor (“service provider”). If you are a shopper, the privacy policy of the store you bought from applies first, and the store is your first contact for requests about your data.

2. What this policy covers

The Marka admin inside the Shopify admin; the storefront features added through Shopify’s theme app extension (cart drawer, popups, sticky buttons, offers); the checkout, thank-you and order-status blocks; the app’s Shopify Functions (discounts and bundles), web pixel and Shopify Flow triggers; these public pages and our support channel.

3. Data about merchants

Store and account: shop domain, store name, currency, locale, time zone, plan and billing status, the Shopify access token that lets the app call Shopify on the store’s behalf.
Your configuration: offers, add-ons, popups, audiences, experiments, designs, translations and the published versions of that configuration (the last 50 per store).
Billing: plans are charged through Shopify’s billing system; we see the plan and its status, never card or bank details.
Support: what you send us when you ask for help (for example your name and email address in your message).

We use it to provide, secure and bill the app, to answer you, and to meet legal obligations. Where the GDPR applies, our legal bases are the contract with you (running the app), our legitimate interest in keeping it secure and improving it, and legal obligations.

4. Data about shoppers

We receive shopper data from Shopify through the permissions the merchant approves at install, and from the storefront while shoppers use the cart drawer. From Shopify’s protected customer data we use Level 1 and the Level 2 fields email, phone and address (never name), for every store that has Marka installed and whose access Shopify has approved.

What we process about shoppers
Category	Data	Source
Customer reference	Shopify customer ID, customer since, lifetime order count and amount spent as reported by Shopify, country code of the default address	Shopify
Contact details	Email address, phone number (in international format) and the full default address — street lines, city, state/province, postcode, country — of the shopper’s customer record, and the email address, phone number and delivery (or billing) address entered at checkout. Encrypted with a key unique to the store; never names, company names or the name on an address	Shopify customer records, checkouts
Matching codes	One-way keyed codes of the email address and phone number (to recognise the same shopper) and of the area of an address — the first 3 characters of the postcode, the city, the state/province — used to group orders by area. They cannot be turned back into the values, and the same address gives different codes in different stores. Orders carry only these codes, never the email, phone or address itself	Calculated by Marka
Linked records	Which customer accounts, guest orders and checkouts of the same store belong to the same shopper (from the matching codes)	Calculated by Marka
Orders (last 60 days)	Order ID and number, dates, totals, discounts, refunds, payment / fulfilment / delivery / return status, line items (product, variant, title, product type, category, vendor, quantity, price), customer tags on the order, and the cart attributes the drawer adds (random session ID, accepted offers and add-ons, experiment variant, live intent level). The customer is referenced by ID and by the matching codes of the order’s email, phone and delivery area.	Shopify
Calculated attributes	Spend over 60 days, average order value, delivered and returned orders, return rate, interest scores for product categories and types, a purchase segment (VIP, loyal, repeat, new, at risk, returner, one-time), a spend tier (value, mid, premium) and a typical price range (see section 6) — across all linked records of the same shopper in that store	Calculated by Marka from the rows above
Abandoned carts	Items, values, currency, timestamps, customer ID when known, live intent level, language and the country of the delivery (or billing) address; for checkouts also the contact details above (encrypted, for 30 days).	Shopify abandoned checkouts, storefront events
Access log	Every time contact details are decrypted (only to prepare a data-request file), a log entry records when, why and by whom — never the details themselves	Marka
Storefront events	Random session ID, event type (drawer opened, item added, offer accepted, checkout started …), product and offer IDs, cart value, device type, country, live intent level, experiment variant; the Shopify customer ID when the shopper is logged in	Cart drawer, web pixel, checkout block
Experiment ID in the browser	A random visitor ID kept in the shopper’s browser storage for up to 180 days, so the same shopper keeps seeing the same version of a test. It is not linked to a customer account.	Cart drawer
Privacy requests	Files prepared for a customer’s data request (encrypted), request status	Shopify privacy webhooks
Technical data	Like any web server, ours receives the IP address and browser details with every request (for example from the drawer). The app does not store them in its database; they are used to answer the request and to keep the service secure.	Requests to our server

We do not collect shoppers’ names (first or last), company names, payment card data, passwords, dates of birth, government identifiers, marketing consent, or order and customer notes. When a store shows the optional “Welcome back, first name” greeting in the drawer, the store’s theme fills in the name inside the shopper’s browser; it never reaches us. The street lines of an address are stored (encrypted) with the rest of the address but no feature of the app uses them.

Data linked to a Shopify customer ID is still personal data, and we treat it as such.

5. How we use shopper data

Run the cart drawer, offers, bundles and add-ons the merchant sets up. Shopify’s checkout, through the app’s discount function, is the only place prices and discounts are decided; the drawer only previews them.
Personalised recommendations (“Picked for you”, “Buy it again”, leaving out products the shopper returned) for logged-in shoppers who allowed personalisation.
Audiences: the merchant chooses which offers, popups and add-ons are shown to which groups — spend tier, purchase segment, interests or live intent. The app matches the shopper against those groups; the merchant never sees who is in a group.
A/B experiments: showing each visitor one version of an offer or design and measuring which version performs better on aggregated results.
Analytics and order attribution, shown to merchants as totals, rates and a list of the store’s own attributed orders (order number, amount, offers) — never with a shopper profile.
Recognising returning shoppers: the matching codes of email addresses and phone numbers link a shopper’s guest orders, checkouts and duplicate customer accounts in the same store, so that their purchase history, interests, spend tier and price range are complete when recommendations are chosen for them.
Popular near you: products bought by other shoppers of the same store in the same area (postcode area, city or state/province, grouped by the matching codes). An area is only used when at least 5 different shoppers of that store are in it; the suggestion never names a place or a shopper.
Showing the same logged-in shopper, in the same store and inside the cart drawer, items left in an earlier cart.
Starting Shopify Flow workflows when the merchant switches them on (customer ID and cart facts only; never an email address).
Security, preventing abuse, handling privacy requests and meeting legal obligations.

Marka never contacts shoppers — no emails, text messages or notifications of any kind — and contact details are used for nothing but the purposes above: not for marketing, not for our own purposes, never shown to the merchant in the app, never shared, and never used for another store.

6. Automated decisions, spend tiers, live intent and personalised prices

Segments, spend tiers, interests and live intent are calculated automatically:

Spend tier compares a logged-in shopper’s own orders with the same store (average order value and 60-day spend) with that store’s other customers. It is not an income estimate, is never based on location or demographics, and never uses data from other stores.
Live intent (high, medium, low, hesitant) is worked out in the shopper’s browser from the current visit only — cart value compared with the store’s typical order, number of items, cart opens, removals, checkout clicks and product views. Only the resulting level leaves the browser, with analytics events (after analytics consent where it is required) and as a cart attribute on the order. No intent profile is stored.
Interests and segments come from the shopper’s orders with that store in the last 60 days.

They decide which recommendations and offers are shown. Every shopper can still buy every product at the store’s regular price. When a merchant targets an offer that changes a price or discount at an audience, the shopper may see a price that other shoppers do not see. In that case the drawer shows a notice next to the price:

visitors in the United States see the wording required by New York’s Algorithmic Pricing Disclosure Act:
THIS PRICE WAS SET BY AN ALGORITHM USING YOUR PERSONAL DATA
visitors in the European Union and the European Economic Area are told that the price was personalised on the basis of automated decision-making (Consumer Rights Directive 2011/83/EU, article 6(1)(ea));
visitors elsewhere see a short label (by default “Personalised offer”).

These decisions do not produce legal effects for shoppers. Shoppers who are not logged in, or who decline personalisation (preferences) in the store’s cookie banner, are not matched against audiences built from stored purchase history. Merchants can switch personalisation off for their whole store.

The drawer reads the shopper’s choices through Shopify’s Customer Privacy API. Analytics events wait for analytics consent and personalisation waits for preferences consent wherever the store asks for consent. A merchant can switch this check off only by an explicit setting in the app.
The web pixel runs in Shopify’s sandbox, is limited to analytics, and is declared as not selling data.
The drawer keeps a random session ID in the browser’s session storage and the experiment ID described in section 4 in the browser’s local storage. We do not set advertising cookies.

We use these sub-processors:

Sub-processors
Sub-processor	Purpose	Location
Microsoft Azure (Microsoft Corporation)	Hosting of the app server, database, encryption keys, logs and monitoring	United States — Azure region North Central US (Illinois, United States)
Shopify Inc. and its affiliates	The platform the app runs on; source of store and order data; Shopify Flow when the merchant turns it on	Shopify’s infrastructure

We do not sell personal data and do not share it for cross-context behavioural advertising. We may disclose data when the law requires it. We will tell merchants about a new sub-processor before it starts processing their stores’ personal data.

9. Where data is stored

All data is stored in the United States (Microsoft Azure, North Central US (Illinois, United States)). Our team operates the service from India and may access the systems remotely to run and support it. If you are in the European Economic Area, the United Kingdom or Switzerland, your data is therefore transferred to the United States and may be accessed from India. These transfers are covered by the European Commission’s Standard Contractual Clauses (with the UK addendum and the Swiss amendments), which are part of our data processing agreement with each merchant.

10. How long we keep data

Retention periods
Data	Kept for
Orders used for personalisation	A rolling 60 days (deleted every night as they get older)
Abandoned carts	Marked expired after 30 days, deleted after 90 days
Shopper profiles (calculated attributes)	Deleted 2 years after the shopper’s last order — and at once when the merchant erases the customer in Shopify or deletes the customer
Storefront events	90 days; daily totals without personal data are kept while the app is installed
Order attribution (order totals, offers, experiment variant, intent level)	While the app is installed; the customer ID is removed when the customer is erased
Data-request files	30 days
Contact details and matching codes	Deleted at once when the merchant uninstalls Marka, 2 years after the shopper’s last order or abandoned cart, from carts 30 days after they were left, and at once when the merchant erases or deletes the customer in Shopify. The codes on orders leave with the orders after 60 days; linked records are recalculated every night
Access log	1 year
Experiment ID in the shopper’s browser	Up to 180 days
Everything about a store	Deleted 30 days after the app is uninstalled, or earlier when Shopify asks us to (Shopify sends this request 48 hours after uninstall)
Database backups · hosting logs	Backups expire after 7 days, so deleted data leaves the backups within that time · application logs are kept 30 days

11. How we protect data

Encryption in transit (TLS) for every connection to and from the app.
Encryption at rest by Microsoft Azure for the database, its logs and backups; contact details and files prepared for data requests are additionally encrypted (AES-256-GCM) with a key unique to each store, derived from a master key held in Azure Key Vault.
Contact details are decrypted only to answer a data request, and every decryption is written to an access log. Recognising shoppers and grouping by area work on one-way keyed codes, without decrypting anything.
Shopper information is not shown in the merchant admin, so it cannot be browsed or exported there.
Separate test and production environments with separate keys; access to production is limited to the people who run the service.
A documented process for handling security incidents, including notifying affected merchants without undue delay.

12. Your rights

If you are a shopper

Ask the store you shopped with. The merchant sends your request through Shopify, and Shopify passes it to us:

Access / copy: we prepare a file with everything Marka stores about you (your contact details, purchase history of the last 60 days including guest orders with your email address or phone number, calculated interests, segment and spend tier, abandoned carts and order attribution) and give it to the merchant, who passes it on to you.
Deletion: when the merchant erases your data in Shopify or deletes your customer account, we delete your profile, contact details, linked records, carts and files, and remove your customer ID and matching codes from orders and events.
Objection to personalisation: decline preferences in the store’s cookie banner or stay logged out; you will see the store’s standard recommendations and offers.

Depending on where you live you may have further rights — under the GDPR to rectification, restriction, portability, objection and not to be subject to decisions based solely on automated processing that significantly affect you; under the CCPA/CPRA to know, delete and correct personal information and not to be discriminated against for using these rights (we do not sell or share personal information, so there is nothing to opt out of). You can also complain to your data protection authority.

We handle requests that Shopify sends us as soon as they arrive, and always within 30 days.

If you are a merchant

You can ask us for access to, correction or deletion of your data, object to our processing, or ask for a copy in a portable format: write to tech@houseofmarka.com. Uninstalling the app starts the deletion described in section 10.

13. For merchants: what to tell your shoppers

You remain responsible for your store’s own privacy policy and cookie banner. You may adapt this paragraph:

“We use the Marka Cart Drawer app to run our cart, offers and recommendations. It keeps your email address, phone number and address (encrypted) to recognise you across guest checkouts and accounts in our store and to suggest products popular in your area. If you are logged in and allow personalisation cookies, it uses your orders with us from the last 60 days to choose the products and offers we show you, which can include personalised prices. Marka never contacts you, acts on our behalf, does not sell your data and does not use it for any other store.”