Themivo
Privacy Policy
Last updated: October 18, 2026
The short version. Themivo makes apps for Shopify merchants. We process store and shopper data only to run the features a merchant turns on. We don't sell personal data, we don't use it for our own advertising, and we delete a store's data after it uninstalls one of our apps, when Shopify asks us to.
- 1. Who we are and scope
- 2. Our role
- 3. Data we collect
- 4. How we use it
- 5. Emails to shoppers
- 6. Service providers
- 7. Storage and security
- 8. Retention and deletion
- 9. Your rights
- 10. Cookies and local storage
- 11. International transfers
- 12. Children
- 13. Changes
- 14. Contact
1. Who we are and scope
Themivo ("Themivo", "we", "us") builds and runs apps for the Shopify platform, including Themivo Wishlist & Alerts. This policy covers the website at themivo.com and every Themivo app installed from the Shopify App Store (the "Apps").
It applies to merchants who install an App ("Merchants") and to the customers and visitors of Merchants' stores ("Shoppers").
2. Our role
For Shopper data, the Merchant is the controller and Themivo is a processor acting on the Merchant's instructions, given through the App's settings. For Merchant account data (such as the store's contact email), Themivo is the controller. Shoppers who have a question about their data should contact the store they shopped with first; we will help that store answer.
3. Data we collect
From Merchants, through Shopify
- Store details: shop domain, store name, contact email, plan, currency, locale and time zone.
- Catalog data: products, variants, prices, inventory levels, locations that fulfil online orders, collections and theme settings needed to show the App on the storefront.
- Order data limited to what an App needs, for example the line items and customer of an order, so a sale can be matched to a wishlisted item.
- Shopify session tokens needed to keep the App connected to the store.
From Shoppers, on the Merchant's storefront
- Signed-in customers: Shopify customer ID, name, email address and email marketing consent status, read from the Merchant's store.
- Guests: a random identifier generated in the browser. We don't collect a guest's name or email.
- Activity inside the App, such as items added to or removed from a wishlist, lists shared, alert sign-ups and email unsubscribes.
- Usage events (for example "item added", "list opened") for the Merchant's analytics. These events carry no names or emails, and the Shopper identifier in them is hashed.
- Technical data such as IP address and user agent, used only for security and rate limiting and not stored with wishlist data.
From visitors to themivo.com
This website sets no tracking cookies and runs no advertising scripts. Our hosting provider keeps standard server logs for security. If you email us, we keep your message to answer it.
4. How we use data
- To provide the features a Merchant enables, such as saving lists, sending alerts and showing analytics.
- To send emails the Merchant has configured (see section 5).
- To attribute orders to App activity so Merchants can see results.
- To provide support, fix problems and keep the Apps secure.
- To bill for paid plans through Shopify Billing.
- To meet legal obligations.
We don't sell or rent personal data, we don't use Shopper data to advertise our own products, and we don't combine one Merchant's Shopper data with another's.
5. Emails to Shoppers
When a Merchant turns them on, an App can send Shoppers emails on the Merchant's behalf, such as back in stock, price drop, low stock or reminder emails.
- Emails go only to signed-in customers. Guests receive none.
- Marketing emails (price drop, low stock, reminders) go only to customers who have given email marketing consent in the Merchant's store.
- Back in stock emails go to customers who saved or asked to be told about that product.
- Every email includes an unsubscribe link, and we honor it right away.
Merchants can send these emails through our email provider, their own SMTP server, or tools they connect such as Klaviyo or Shopify Flow. When a Merchant connects a third-party tool, that tool's own privacy policy applies to data sent to it.
6. Service providers
We share data only with providers that help us run the Apps, under contracts that require them to protect it:
| Provider | Purpose |
|---|---|
| Shopify | Platform the Apps run on, authentication and billing |
| Cloudflare | Hosting, databases, file storage and analytics events |
| Email delivery provider | Sending emails the Merchant has configured |
| Integrations the Merchant connects (e.g. Klaviyo, Shopify Flow) | Only when the Merchant turns them on |
We may also disclose data if the law requires it, or to protect the rights, property or safety of Themivo, Merchants or Shoppers. If Themivo is part of a merger or sale, data may transfer to the new owner under this policy.
7. Storage and security
Data is stored on Cloudflare's infrastructure and encrypted in transit with TLS. Each store's App data is kept separately from other stores'. Access to production systems is limited to the people who run the Apps. Requests from storefronts are verified with Shopify's signatures, and API keys we issue are stored only as hashes.
No system is perfectly secure. If we learn of a breach that affects personal data, we will tell affected Merchants without undue delay so they can meet their own obligations.
8. Retention and deletion
- While an App is installed, we keep data for as long as the Merchant uses the features that need it.
- Inactive guest lists are deleted automatically after 60 days without activity.
- Email and delivery logs are deleted after 90 days.
- After uninstall, we stop all processing right away and keep the data briefly in case the Merchant reinstalls. When Shopify sends its shop deletion request (48 hours after uninstall), we delete all of that store's data, files and API keys.
- Shopper requests. When Shopify forwards a customer data request, we export that customer's data for the Merchant. When it forwards a customer deletion request, we delete that customer's lists, items and notification history.
9. Your rights
Depending on where you live (for example under the GDPR, UK GDPR or CCPA), you may have the right to access, correct, delete, restrict or port your personal data, to object to processing, and to withdraw consent.
Shoppers: please contact the store first, since it controls your data. You can also ask the store to delete your Shopify customer data, and Shopify will tell us to delete ours. Merchants: email us at hi@themivo.com. We answer within 30 days. You can also complain to your local data protection authority.
10. Cookies and local storage
On a Merchant's storefront, an App may use the browser's local storage to remember a guest's wishlist and settings. This is needed for the feature to work, holds no name or email, and is removed when the Shopper clears site data. Apps don't set third-party advertising cookies. themivo.com uses no cookies.
11. International transfers
Our providers may process data in countries other than yours. Where the law requires it, we rely on safeguards such as the European Commission's Standard Contractual Clauses.
12. Children
The Apps are made for businesses. We don't knowingly collect data from children under 16 outside of what a Merchant's store provides.
13. Changes to this policy
We may update this policy as the Apps change. We will post the new version here with a new date, and tell Merchants about material changes by email or in the App.
14. Contact
Questions about privacy or this policy: hi@themivo.com.