Privacy Policy

1. Who we are

Mainframe Mail ("Mainframe", "we", "us") is an email marketing platform for Shopify merchants. This policy explains what personal data we process, why, and how — for both the merchants who use Mainframe ("merchants", "you") and the merchants' own customers whose data flows through the app ("end customers"). Contact us at hello@mainframe.io.

2. Data we collect

From merchants: account details (name, email, password hash), billing information (processed by Stripe or, for merchants installed via the Shopify App Store, by Shopify's own Billing system — we never see full card numbers), and content you create in the app (campaigns, flows, popups, brand assets).

From connected Shopify stores, via OAuth and only the scopes a merchant explicitly grants: customer records (name, email, phone, address, marketing consent), orders and checkouts, and product catalog data. We only request the minimum scopes needed to sync this data and send campaigns.

From end customers directly: email engagement (opens, clicks, unsubscribes) and popup interactions on a merchant's storefront, used to power analytics and automation for that merchant.

3. Why we process it

To provide the core service: syncing store data, sending the campaigns and automations a merchant builds, attributing revenue to those sends, and billing merchants for their plan. We do not sell personal data, and we do not use end-customer data for any purpose beyond delivering the merchant's own email marketing program.

4. Who we share data with

We use a small set of subprocessors to run the service: Shopify (source of store/customer/order data, via OAuth), Stripe (billing, for merchants not on the Shopify Billing track), Resend (transactional/marketing email delivery), and our hosting/database providers. Each is bound by its own data protection terms. We do not share personal data with third parties for their own marketing purposes.

5. Storage, security and retention

Data is encrypted in transit (TLS) and sensitive credentials — including Shopify access tokens — are encrypted at rest (AES-256-GCM). Access is limited to the staff who need it to operate the service. Merchants can configure retention periods for unsubscribed and inactive contacts in their account settings; we otherwise retain data for as long as the merchant's account is active, or as required by law.

6. Your rights

End customers can unsubscribe from any campaign directly via the link in that email. To request access to, correction of, or deletion of personal data (GDPR/CCPA and similar rights), contact the merchant whose store you interacted with — they control the data — or write to hello@mainframe.io and we will route the request. Merchants can request an export or deletion of their own account data at any time via the same address.

7. Shopify-specific data requests

For stores connected via the Shopify App Store, Shopify may forward customer data requests, erasure requests, and shop-level erasure requests to us automatically per its mandatory privacy webhooks. We honor these requests in line with Shopify's developer requirements and applicable law.

8. Changes to this policy

We'll update this page if our data practices change materially, and update the date at the top. Continued use of Mainframe after a change means you accept the update.

9. Contact

Questions about this policy or your data: hello@mainframe.io.