Privacy policy
Last updated 2026-10-16
Mailpilot is an email marketing app for Shopify stores. This policy explains what personal data the app handles, why, how long we keep it and who we share it with. It is provided by Lindner Marketing AB, Knivsta, Sweden (“we”).
Who is responsible
For the personal data of a store’s customers, the store (the merchant) is the controller and we are its processor: we only handle that data on the merchant’s instructions, to send and measure the merchant’s emails. The data processing terms are part of our terms of service. For the data of merchants and their staff (account and billing contact details), we are the controller.
What we collect
| Data | Where it comes from | Why |
|---|---|---|
| Customer name and email address, email marketing consent (state, level, date), language, tags | The store’s Shopify customers, the store’s signup forms, imports the merchant starts | Send the merchant’s emails only to people who may receive them, in their language, with their name |
| Orders and checkouts (items, totals, currency, dates; no addresses, no payment details) | Shopify | Start emails such as “thank you” or “you left something in your checkout”, and show which emails led to sales |
| Store browsing events (product viewed, added to cart, checkout started) | The app’s Shopify web pixel, only when the visitor’s cookie choices allow it | Browse and cart reminder emails |
| Email events (delivered, opened, clicked, bounced, unsubscribed), with the browser user agent and a shortened, hashed IP address | Our sending service and tracking links | Show results, stop sending to addresses that bounce or complain, filter automated clicks |
| Consent evidence (time, source, form text version, hashed IP) | Signup forms and confirmation links | Prove that a customer agreed to emails, as the law requires |
| Merchant staff name and email, store settings, billing records (the plan, the email balance, balance payments approved in Shopify, and what each day’s emails cost; no customer data) | Shopify when the app is installed and used | Run the account, support, billing through Shopify |
We do not collect customer postal addresses, phone numbers or payment details.
What we never do
- We never sell personal data or share it for other companies’ advertising.
- We never use one store’s customer data for another store.
- We never use customer data to train AI models.
- We never email a store’s customers for our own purposes.
Comparison numbers (benchmarks)
To show a store how its emails compare with similar stores, we combine store totals from the stores that use the app: for example the share of emails clicked, orders and money per email sent, unsubscribe, bounce and complaint rates, signup form conversion, and email revenue as a share of the store’s sales. Each of these is one number for the whole store over 90 days. No customer’s name, email address or other personal data is part of them. We show a group’s numbers only when at least 20 stores are in it, and only as rounded low, middle and high points of the group (25th percentile, median and 75th percentile). We never show or share one store’s numbers or name. A merchant can turn this off at any time in Settings > Store profile; the store’s numbers are then left out from the next weekly update. We keep each month’s combined numbers for 13 months.
AI features
When a merchant uses the writing assistant, the store’s brand details, products and the email being edited are sent to Anthropic (Claude) to produce a draft. Customer personal data is not included. Anthropic does not train on this data. We keep AI requests and answers for 30 days to fix problems, then delete them. Merchants can also connect their own Claude account to the app; that connection only sees store-level data and totals, never individual customers.
Who we share data with (subprocessors)
| Company | What for | Where |
|---|---|---|
| Amazon Web Services | Sending email (Amazon SES), hosting, backups | EU (Stockholm) or as listed in our DPA |
| Anthropic | AI writing features, only when used | United States (Standard Contractual Clauses) |
| Shopify | The platform the app runs on, billing | Canada / worldwide |
When a merchant moves from another email service, the app reads the merchant’s data from that service with a key the merchant provides, only to copy it into the merchant’s account, and the key is deleted after the move. From Klaviyo we copy only each person’s email address, name, language, country and time zone, email consent, and the one field the merchant used to mark people as unengaged. Phone numbers, addresses, IP addresses and other custom fields are not copied.
How long we keep data
- Sent email records: 18 months. Opens and clicks: 12 months (the shortened IP is removed after 30 days).
- Store browsing events: 24 months. AI requests: 30 days. Customer data exports: 7 days.
- Orders and purchase events: kept while the app is installed (revenue reporting), deleted with the store’s data. When a customer asks to be erased, their events are deleted and everything that identifies them is removed from their orders.
- An unsubscribe is kept as a one-way hash for as long as needed to keep honoring it.
- Billing records: kept while the app is installed, deleted with the rest of the store’s data.
- When a store uninstalls the app, sending stops at once and all of the store’s data is deleted when Shopify asks us to (48 hours later), and at the latest 30 days after uninstall. One exception: if money is left on the store’s email balance, we keep the amount, the store’s myshopify.com address and the date its free trial started for 12 months, so we can add the balance back if the store installs the app again. Then we delete them.
Your rights
Customers of a store should contact that store, which decides on access, correction and deletion requests; we carry them out when Shopify forwards them to us (customer data and deletion requests). Every marketing email has a one-click unsubscribe link and a preferences page where you can also stop open tracking. Merchants and anyone else can write to us at privacy@trymailpilot.com. You can complain to your data protection authority; ours is the Swedish Authority for Privacy Protection (IMY).
Security
All traffic is encrypted (HTTPS/TLS). Keys and tokens are encrypted in the database. Backups are encrypted. Access is limited to named staff with two-factor login, and access to customer data is logged.
Changes
We will post changes on this page and tell merchants in the app before a material change takes effect.