Meravao Privacy Policy

Last updated: September 5, 2026

Meravao is a Shopify app that helps merchants scan product catalogs, identify catalog-readiness and product-content issues, review grounded recommendations, apply supported fixes, and monitor catalog activity. Meravao is operated by BAO GUANGYOU.

Information Meravao processes

Meravao may process the following information to provide the service:

• Shopify shop domain, authenticated app session information, and current subscription or feature-access state.
• Product catalog information needed to scan products, identify issues, prepare recommendations, and apply merchant-authorized or supported automated fixes.
• With analytics consent, bounded Shopify Web Pixel event evidence for product_viewed and product_added_to_cart, limited to event time and product, variant, and product-type identifiers used for product-level observation.
• With the same analytics consent, a short-lived first-party Meravao session cookie may group those approved commercial events into anonymous product sessions. The local session expires after 30 minutes of inactivity or at UTC midnight, whichever occurs first. Page-view events are used only to maintain that local session and their URL, referrer, title, or page payload is not sent to or stored by Meravao.
• The raw local session token is not retained server-side. For accepted commercial events, Meravao may retain only a one-way, shop-scoped session hash for no longer than the existing 35-day Pixel evidence retention period. Shopify clientId, IP address, browser fingerprint, customer identity, and cross-shop identity links are not stored in this session evidence.
• Read-only Shopify discount metadata needed to determine whether a promotion may confound a product-level observation. Meravao stores only the bounded resulting promotion state on the shop/product/variant observation, not customer identities, customer lists or segments, discount codes, or market IDs.
• Catalog scan observations, issue state, optimization history, monitoring settings, activity evidence, and short-lived billing return state generated by the app.
• Operational, security, and error information needed to run, protect, and troubleshoot the service.

Meravao's current core functionality does not request or use Shopify customer or order records. The bounded Web Pixel and anonymous session evidence described above is not used to build customer profiles.

How information is used

Meravao uses this information to:

• authenticate the merchant store and provide the embedded app;
• scan and list detected catalog issues in maintenance order;
• prepare AI-assisted, product-grounded recommendations;
• apply fixes requested or enabled by the merchant;
• provide history, monitoring, and activity evidence;
• aggregate approved product-view and add-to-cart evidence in a consistent anonymous session unit while keeping incomplete session evidence fail-closed;
• evaluate bounded product-level observations while keeping price, inventory, promotion, and tracking uncertainty fail-closed;
• enforce plan limits and paid feature access; and
• maintain service reliability, security, and support.

Shopify permissions and privacy requests

Meravao requests write_products to read and update supported product catalog fields, read_customer_events andwrite_pixels for the bounded Web Pixel lifecycle and approved product event evidence, and read-only read_discounts solely to determine promotion-confounder evidence. Meravao does not request a discount-write permission and does not mutate Shopify discounts.

The anonymous session measurement described above uses the already analytics-consented Web Pixel and does not add Shopify reporting access or protected-customer-data permissions. Any future reporting permission would require a separate reviewed authorization before use.

Promotion applicability that depends on customer or segment targeting, market targeting, Shopify Function-backed logic, incomplete pagination, or other unsupported or ambiguous conditions is kept unknown and fail-closed; it is not treated as evidence that no promotion exists.

Meravao subscribes to Shopify's mandatory customer data request, customer redaction, and shop redaction topics. Customer-related requests are acknowledged without deleting unrelated merchant data because the app does not store customer or order records. After an authenticated shop redaction request, Meravao deletes current shop-linked application records from its database.

Service providers and international processing

Meravao may use hosting, database, monitoring, and AI processing providers where needed to operate the app. Product catalog information included in a recommendation request may be processed by an AI provider for that purpose. Depending on the merchant and provider locations, information may be processed in countries other than the merchant's own.

Retention and deletion

Meravao retains shop-linked operational data only for as long as it is reasonably needed to provide the service, maintain merchant-visible history, secure the app, meet contractual obligations, or satisfy applicable legal requirements. Bounded Web Pixel event evidence and its one-way shop-scoped session hash expire after 35 days. Merchants can uninstall Meravao through Shopify Admin. Shopify's authenticated shop redaction process performs the definitive deletion of current shop-linked application records.

Security

Meravao uses reasonable technical and organizational safeguards, including authenticated Shopify sessions, verified webhooks, server-side access controls, environment-based secret management, and controlled production workflows. No method of transmission or storage can be guaranteed to be completely secure.

Changes to this policy

This policy may be updated when Meravao's service, providers, or legal obligations change. The current public page will show the effective date.

Contact

Privacy questions can be sent to hello@meravao.com. The service operator is BAO GUANGYOU.

Back to Meravao · Support