Privacy policy

• Store owners and their staff who use Mordi, inside the Shopify admin or on our website.
• Your store's customers, whose details Mordi handles for you. For their data, your store decides what happens and we act on its behalf (as a “processor”). Customers with questions about their data should contact the store; we help the store answer.

• Your account: your name and email, and on our website a password (stored only as a secure hash) and two-step sign-in settings. Inside Shopify, Shopify signs you in.
• Your store, from Shopify, with the permissions you approve when you install Mordi: the store's name, email, address, website, currency and time zone; products (names, descriptions, prices, photos, links); orders (date, amounts, items, refunds and a customer reference); customers (email, name, country and city, whether they agreed to marketing emails, number of orders and amount spent); and your store's pages and blog posts.
• What shoppers do on your store: Mordi's Shopify pixel reports pages and products viewed, searches, items added to the cart and checkouts, under Shopify's anonymous visitor ID (and the customer's Shopify ID when they're signed in or buy). Shopify runs it only as far as each shopper's privacy choice allows.
• Your website: Mordi reads your public pages for your logo, colours, fonts, products and the way you write.
• Tools you connect, only if you connect them: from email tools (Klaviyo, Mailchimp, Mailcoach, Resend) your lists, contacts and their subscription status, past emails and their results; from PostHog, what visitors do on your site.
• What you create and tell Mordi: drafts, approvals, your goal, notes and messages.
• Email results: for emails sent through Mordi, deliveries, opens, clicks, unsubscribes and complaints.
• Technical data: sign-in sessions, a security log (sign-ins, changes, approvals) and error reports.

• To run Mordi for you: learn your brand, suggest and write emails, and show you results and what each email earned.
• To send the emails you approve, only to people who agreed to receive them, and to honour every unsubscribe (also in your store's Shopify customer records).
• To bill you (through Shopify for Shopify stores).
• To keep Mordi secure, prevent abuse and fix problems.
• To contact you about your account and important changes.

We don't sell personal data, we don't use it for advertising, and we don't use your store's or your customers' data to train AI models.

Mordi uses an AI provider (currently OpenAI) to read and write. Only the data a task needs is sent to it: for example, your products, brand and goal when Mordi writes an email. Under its business terms, the provider doesn't use this data to train its models. You review and approve every email before it goes out.

We use these service providers, each bound to protect the data and use it only to provide their service to us:

• Hetzner Online (Germany): hosts our servers and database.
• OpenAI (United States): AI reading and writing.
• Shopify: the platform your store runs on, and billing for Shopify stores.
• Amazon Web Services: sends the emails Mordi sends for you, when you choose “Mordi sends your emails”.
• Telegram: only if you connect it, for notifications from Mordi.

Tools you connect (Klaviyo, Mailchimp, Mailcoach, Resend, PostHog) exchange data with Mordi because you asked; their own terms and privacy policies apply. We may also share data when the law requires it, or to protect Mordi, its users or the public. If Mordi is sold or merged, the data would move to the new owner under this policy.

Our servers and database are in Germany. Some providers process data in the United States; where required, those transfers rely on the safeguards in their data processing terms, such as standard contractual clauses.

• While you use Mordi.
• When you remove Mordi from your Shopify store, Shopify tells us 48 hours later and we erase your store's data and its Mordi account.
• When a customer asks your store to erase their data, Shopify tells us and we erase it everywhere in Mordi.
• To close an account made on our website, email us and we delete it within 30 days.
• Backups are kept for up to 14 days, so erased data is gone from them within 14 days.

All traffic is encrypted (HTTPS). Access keys to your store and your tools are stored encrypted. Each store's data is kept apart at the database level, so one store can never see another's. Only the operator can reach the servers, and sign-in to Mordi's website can be protected with two-step verification.

You can ask to see, correct, export or delete your personal data, or object to how we use it: email mordechaiarba@gmail.com. Your store's customers should contact the store; Shopify passes their requests to us and we help the store answer them. You can also complain to your data protection authority.

On our website we use one cookie to keep you signed in. Inside Shopify, Mordi uses Shopify's session tokens and one cookie that remembers which store opened it. We don't use advertising or tracking cookies.

If you joined Mordi's waitlist, we keep your email, when you joined and which form you used, for invitations and launch updates. Every email has a way to unsubscribe.

Mordi is for businesses and isn't meant for anyone under 16.

We'll post any changes here with a new date, and tell you in the app or by email about important ones.

Mordechai Arba, Israel · mordechaiarba@gmail.com