MarginOS Privacy Policy

Last Updated: August 21, 2026

1. Introduction

This Privacy Policy describes how MarginOS (“we,” “us,” or “our”) collects, uses, and protects data in connection with our website (marginos.com) and the MarginOS analytics application (together, the “Service”). Our application integrates data from your Shopify store, advertising accounts, and uploaded business documents to provide unified business analytics.

This policy covers four types of data:

Prospect Data: Information you give us through forms on our website, before you become a customer.
Merchant Data: Information we collect directly from you when you create an account or contact us.
Customer Data: Personal data of your customers processed on your behalf from Shopify.
Business Operational Data: Marketing performance data and information extracted from uploaded business documents.

2. Data We Process and Why

A. Prospect Data (Website Forms)

What we collect: Your name, work email address, brand name, Shopify store URL, annual revenue band, whether you use a third-party logistics provider, which paid advertising channels you run, and any free-text answers you choose to give us.
Purpose: To assess whether your brand is a fit for the analysis you requested, to prepare and deliver that analysis, and to send you related MarginOS updates and offers.
Lawful basis: Our legitimate interest in responding to a business enquiry that you initiated, and in marketing closely related business services to you. Where local law requires consent instead, we rely on the consent you give when you submit the form.
How to opt out: Every marketing email contains a one-click unsubscribe link. You can also email support@marginos.com at any time and we will remove you. Unsubscribing from marketing does not stop emails needed to deliver something you specifically asked us for.
We do not sell prospect data, and we do not share it for anyone else’s marketing.

B. Merchant Data

What we collect: Your name, email address, Shopify store URL, and support communications.
Purpose: Account maintenance, billing, and customer support.

C. Customer Data (Processed on Your Behalf)

What we process: We access Customer Identifiers (name, email), Addresses (shipping/billing), Consent status, and Order history via the Shopify API.
Stated Purpose: Generating analytics reports, customer segmentation, and automated predictions for your store.

D. Google User Data (OAuth & Ads)

Authentication: We collect your Google email and basic profile info to authenticate your identity.
Marketing Data: If you connect your Google Ads account, we retrieve SKU-level performance and cost data.
Purpose: To calculate and display your advertising ROI and product-level profitability.

E. Business Operational Data (Document Parsing)

What we process: We process uploaded invoices, tenant documents, and inventory lists.
Purpose: We utilize third-party tools to extract SKU, quantity, and cost data to provide inventory and margin analytics.

3. Website Analytics and Cookies

Our website uses Google Analytics to understand aggregate traffic patterns, such as which pages people visit and how they arrive. This sets cookies and processes your IP address and device information. We use it only to improve the website.

You can block these cookies through your browser settings or a browser extension without losing access to any part of the site. We do not use website analytics to build individual profiles, and we do not sell this data.

4. Customer Consent and Opt-Out

As the Data Controller, you are responsible for obtaining appropriate consent from your Customers.

Consent Enforcement: Our Service respects Customer consent. We will only process data for Customers who have provided the necessary consent, as indicated by the emailMarketingConsent and smsMarketingConsent fields in your Shopify data.

Customer Opt-Out: Your Customers have the right to opt-out of processing, especially for automated decision-making (like predictions). If a Customer requests to opt-out, you are responsible for notifying us at support@marginos.com. Upon receiving your request, we will manually flag that Customer in our system to be excluded from all future automated predictions and profiling.

5. Data Retention

Prospect Data: Retained while you remain on our mailing list. If you unsubscribe or ask us to delete your record, we remove it. Prospect records showing no engagement are reviewed and cleared at least every 24 months.
Merchant/Account Data: Retained for as long as your account is active.
Google User Data: Retained only for as long as your account is active and necessary to provide the Service. Upon account deletion or your revocation of Google OAuth access, all associated Google User Data is permanently deleted from our systems.
Uploaded Documents: Raw documents (e.g., invoices, inventory lists) uploaded for parsing are retained for up to 90 days by our processing partners to ensure successful extraction and error handling, after which they are deleted. Extracted business data is retained as part of your account records to provide the Service.
Customer Data: Protected Customer Data is automatically purged from our production systems 24 months after receipt.

6. Data Security

We implement robust technical measures:

Encryption: Data is encrypted in transit (SSL/TLS) and at rest (AES-256).
Infrastructure: Our application is hosted on Railway, utilizing secure GitHub-integrated deployment pipelines.
Access Control: Staff access is strictly limited to a “need-to-know” basis and logged.

7. Data Sharing (Subprocessors)

We do not sell personal data. We share data only with necessary Subprocessors:

Railway: Cloud hosting and infrastructure for the application.
Resend: Delivery of transactional and marketing email, including form confirmations and newsletters. Resend processes the name and email address of recipients.
Parseur: Automated extraction of data from business documents.
Google Cloud/Ads API: Retrieval of marketing performance metrics.
Google Analytics: Aggregate website traffic measurement.
Shopify: Data synchronization for store analytics.
Website hosting provider: Hosting and delivery of marginos.com.

8. Your Rights

Whether you are a Merchant, or someone who has only submitted a form on our website, you have the right to access, correct, or request the deletion of the personal data we hold about you. Contact us at support@marginos.com and we will action it.

Merchants may also request the deletion of an entire account, which will result in the purging of all associated Customer Data from our systems.

If you are in the UK or EEA, you also have the right to object to processing carried out on the basis of legitimate interest, including marketing. You can do this at any time using the unsubscribe link in any marketing email, or by emailing us.

9. Changes to This Policy

We may update this policy from time to time. We will notify you of any significant changes by email or through the app interface.

10. Contact Us

If you have any questions about this Privacy Policy, please contact us at support@marginos.com.

11. Google API Disclosure

MarginOS’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We strictly use and transfer Google User Data solely to provide the MarginOS Service, and we do not use, transfer, or share this data for serving advertisements, retargeting, or any other purposes outside of providing the user-facing analytics of the MarginOS Service.