Privacy Policy

1. Who we are

Manny (“we”, “us”) is a product operated by Lehare Heritage, a registered Australian business name (ABN 83 967 896 123), based in Australia. Contact: hello@manny-app.com.

2. What we collect

• Account data: email, name, timezone, currency, and business details you provide during onboarding.
• Shopify data: via the Shopify Admin API, with scope limited to read_orders, read_all_orders (so a store’s order history older than 60 days can be included) and read_products. We request only the order fields our reports use: order dates, totals, discounts, refunds, cancellation status, and whether the order is the customer’s first, which tells a new customer from a returning one. We also read your shop’s currency so figures are labelled in it. We turn orders into daily totals for your store (order count, gross and net revenue, discounts, refunds, average order value, new and returning customers). We do not store records about individual shoppers, and we do not request or store shopper names, email addresses, phone numbers, or addresses. Individual orders are kept only as a 30-day delivery log of an order identifier, total, and time, used to avoid counting an order twice. We do not request read_customers or read_analytics.
• Marketing platform data: campaign, ad set, ad, and creative performance from Meta, Google Ads, TikTok and Pinterest; email performance from Klaviyo; and website traffic and search performance from Google Analytics and Google Search Console, where you connect those accounts. These are aggregate reporting figures, not data about individual people.
• Usage telemetry: authentication events, sync runs, and audit log entries for security and troubleshooting.

Manny does not place scripts, pixels, or cookies on your storefront and does not collect data about your store’s visitors.

3. How we protect it

All data is stored in Supabase (Postgres) in the Australian region. Data is encrypted in transit (TLS) and at rest. Platform access tokens and secrets are additionally encrypted by Manny (AES-256) before they are stored, and each merchant can only read their own data.

4. Third-party processors

• Supabase (hosting and database)
• Vercel (application hosting)
• Stripe (payments for direct-signup merchants)
• Shopify (billing for App Store merchants)
• Resend (transactional email: invites, alerts, notifications)
• Anthropic, through Vercel AI Gateway (AI insights: only aggregated metrics are sent, never individual orders or shopper records)
• Sentry (error monitoring, EU region; access tokens and secrets are removed before an error report is sent)

5. Retention

Daily reporting totals are kept for 365 days on a rolling basis. Audit logs are kept for 365 days, alert history for 180 days, sync logs for 90 days, and webhook delivery logs, which record only an order identifier, total, and time, for 30 days. After you uninstall Manny from Shopify, we delete all of your store’s data within 48 hours of receiving Shopify’s shop/redact webhook. If your agency connected other platforms to your Manny account, that data stays until the agency removes it or you ask us. Direct-signup merchants can ask us to delete their account and data at any time.

6. Your rights

You can request export or deletion of your data at any time by emailing hello@manny-app.com. Shopify merchants can also use the built-in GDPR request tools in their Shopify admin; those are routed to Manny automatically. Because Manny keeps no records about individual shoppers, a shopper’s data request or deletion request has no personal data to return or erase. We log each request for audit using only Shopify’s customer and order identifiers, never the shopper’s email address or phone number.

7. Cookies

Manny uses first-party cookies strictly for authentication and session management in the Manny app. No advertising or third-party tracking cookies are set.

8. Changes

When this policy materially changes, we will notify active merchants by email at least 14 days before the change takes effect.