Privacy Policy
Version 1.0 · Effective October 8, 2026
This policy explains what Mintveo collects, why, who we share it with, how long we keep it and how to ask us to see or delete it. It covers our website (mintveo.com), the Mintveo app (app.mintveo.com), our store apps for WooCommerce, Shopify, Salla and Zid, and the tracking script those apps add to a store.
Summary
- Merchants (store owners and their team) use Mintveo to see which ads earn their sales. For your account data, Mintveo decides how it is used (we are the "controller").
- Shoppers visit a merchant's store. The store decides to use Mintveo; we handle shopper data only to give that store its reports and to report its sales to the ad platforms it connected (we are the store's "processor" or "service provider"). Questions from shoppers go first to the store, and we help the store answer.
- We do not sell personal data, and we do not use it to advertise Mintveo.
- Our servers are in the United States.
- Shoppers' email addresses, phone numbers and names are hashed (turned into a code that cannot be read back) before they are used for matching or sent to ad platforms. A hash can still be matched to the same email, so we protect it as personal data.
- If the store uses a supported cookie banner (section 3.4), we follow the shopper's choice.
- You can ask to see or delete your data at [email protected]. We answer within 30 days.
1. Who we are
Mintveo LLC, a California limited liability company, runs Mintveo. For any privacy question or request, write to [email protected].
2. Our two roles
| Whose data | Examples | Our role |
|---|---|---|
| Merchants and their team, visitors of mintveo.com | Your email, name, your store and ad account connections | Controller |
| Shoppers of a merchant's store | Visits, clicks, orders on that store | Processor / service provider for the merchant |
When we act for a merchant, we use shopper data only for that merchant and only as described here and in our data processing terms (section 6 of our Terms of Service). The merchant is responsible for telling its shoppers about Mintveo in its own privacy notice and for asking for their consent where the law requires it.
3. What we collect and where it comes from
Store and ad account data is needed for the Service to work. Shopper data is collected as each store decides, and the shopper's choices on the store's cookie banner limit it (3.4).
3.1 Merchants and their team (you give it to us)
| Data | Required? | Why |
|---|---|---|
| Email address | Required | You sign in with a one-time code sent by email (we never ask for a password) |
| First and last name | Required | Shown to your team and in our emails |
| Profile picture | Optional | Shown in the app |
| Your acceptance of our Terms and this policy, with its version and date | Required | Proof of agreement |
| Team invitations (email, role) | Optional | To add colleagues to your store |
| Support messages you send us | Optional | To help you |
If you do not give the required data, we cannot create your account. If you do not connect a store or an ad account, we cannot show reports for it.
We keep a log of important actions in your account (for example "ad account disconnected" or "deletion requested"), with who did it and when, for security.
3.2 From your store platform (when you install our app)
When you connect WooCommerce, Shopify, Salla or Zid, the platform gives us access you approve on its own screen. We receive:
- Store details: store name, address of the site, currency, country, time zone, language, logo.
- Orders: order number, date, status, totals, items bought (product, quantity, price), and the ad platform click codes and cookies saved with the order. The order also carries the shopper's name, email, phone and address; see 3.4 for how we treat them.
- Products: name, link, image, price, cost and category, to show which products ads sell.
- Access keys the platform gives us to read this data, stored encrypted.
On Shopify we ask only to read orders and products.
3.3 From ad platforms you connect (Meta, Google Ads, TikTok, Snapchat)
When you connect an ad account, the platform asks for your approval. We read:
- your ad accounts, campaigns, ad sets and ads (names, status, budgets);
- daily results: spend, impressions, clicks, conversions;
- copies of your ad images and videos, to show them in your reports;
- an access key, stored encrypted.
We use this only to show you your ad results next to your sales and to report your sales back to the same platform (section 5). See section 9 for platform-specific rules.
3.4 From shoppers on a merchant's store
This part is written for shoppers. When a store uses Mintveo, our script runs on the store's pages (on WooCommerce, our plugin also runs on the store's server). Some stores also use a Mintveo link on their own domain in their ads (for example go.storename.com). We can collect:
| Data | Details |
|---|---|
| A random visitor ID | Saved in a first-party cookie or in browser storage on the store's own domain (section 6). It does not contain your name. |
| The ad that brought you | Ad platform, campaign, ad set and ad, the click code the platform added to the link (for example fbclid, gclid, ttclid, ScCid), and the ad platform cookies the store already has (_fbp, _fbc, _ttp, _scid) |
| Pages you visit on the store | Address of the page and the page you came from. Email addresses and phone numbers in a page address are removed before we save it. |
| Shopping steps | Products added to or removed from the cart, checkout opened, payment method chosen, sign-in and sign-out |
| Technical data | IP address, browser and device type, and the country, region and city worked out from the IP address on our own servers |
| Device characteristics ("browser fingerprint") | At most once a day: screen, fonts, language, time zone, graphics and similar browser settings, browser brand, device model, and whether private browsing is on. It helps recognise a returning visitor whose cookie was deleted. |
| Sign-in on the store | If you are signed in, the script turns your email and phone into a hash in your browser; your plain email and phone never reach us from the script. |
| Orders | The order the store sends us (3.2). We turn your email, phone and name into hashes and use those for matching, and keep your postal code, city, region and country. We do not keep your plain email, phone, name or street address. |
| Your cookie choice | What you chose on the store's cookie banner |
Cookie banners. If the store has a cookie banner (WordPress consent plugins, Shopify's banner, Salla's cookie bar, or any banner that uses Google Consent Mode), we follow it:
- You accept: everything above.
- You decline analytics: no visitor ID, no fingerprint, no sign-in matching, and nothing that links your visits together. If you came from an ad, we count that click without linking it to you; its IP address and browser type are used only to filter out robots.
- You decline marketing: we still measure, but we never send your purchase to ad platforms.
If the store has no cookie banner, we collect as described above. Adding a banner where the law requires one is the store's responsibility (see our Terms of Service, section 5). Some platforms (Zid today) have no built-in banner; a banner the merchant adds is followed if it uses Google Consent Mode.
Declining on a cookie banner never affects your purchase; it only limits ad measurement.
3.5 Visitors of mintveo.com
Our servers record your IP address and browser type in their logs for 30 days, to run and secure the site. We use no advertising or analytics cookies on mintveo.com (section 6).
4. Why we use it (purposes and legal basis)
| Purpose | Data | Legal basis |
|---|---|---|
| Run your account, sign you in, keep it secure | 3.1 | Our contract with you |
| Show which ads led to which sales (attribution), including filtering out robots and fake clicks | 3.2, 3.3, 3.4 | Our contract with the merchant. For shopper data, we act on the merchant's instruction and rely on the merchant's basis (its legitimate interest or the shopper's consent) |
| Recognise a returning visitor (cookie, then hashed email or phone, then device characteristics) | 3.4 | Same as above |
| Report the store's sales to the ad platforms it connected (Conversions APIs), so they can measure and improve its ads | 3.2, 3.4 | Same as above. Never sent for a shopper who declined marketing |
| Send service emails (sign-in codes, invitations, deletion notices) | 3.1 | Our contract with you |
| Improve Mintveo using aggregated statistics that identify no person and no store | All, aggregated | Legitimate interest |
| Run and secure mintveo.com | 3.5 | Legitimate interest |
| Meet legal duties | Any | Legal obligation |
We do not use any of this data to advertise Mintveo, to build profiles we sell, or to train general AI models.
Automated matching. Linking an order to an ad is done by software (cookie first, then hashed contact details, then device characteristics as a last resort). It affects only which ad gets credit in the merchant's reports. It makes no decision about the shopper.
7. Where we store data and transfers
Mintveo's servers and databases are in the United States. If you are in Saudi Arabia, another GCC country or elsewhere, your data is transferred to and processed in the United States. We limit what we transfer to what the Service needs, use providers that work under data protection terms, and apply the safeguards your local law requires (including the standard contractual clauses published by the Saudi Data and AI Authority, SDAIA).
8. How long we keep it
| Data | Kept |
|---|---|
| Your account | While you use Mintveo. When an owner deletes the store's account (Settings > Data & privacy), it is locked at once and its data is deleted 30 days later; you can cancel during those 30 days. |
| Store data (orders, products, shopper visits, clicks, device characteristics, consent choices) | While the store uses Mintveo. Deleted 30 days after the app is uninstalled or the account is deleted. Shopify: deleted when Shopify asks us (48 hours after uninstall). |
| Store access keys | Deleted as soon as the app is uninstalled |
| Ad account data | Ads, images, videos and breakdowns are deleted as soon as you disconnect the account. Daily spend stays in your reports until you delete it in Settings > Data & privacy, or with the account. Snapchat data is never kept longer than 36 months. |
| Sign-in identity (email) | Deleted with the account |
| Security log of account actions | Kept for 2 years after account deletion, for security and legal reasons |
| Server logs | 30 days |
| Backups | Database history: 6 hours. Deleted files: up to 30 days. |
When a period ends, we permanently delete the data so it cannot be viewed or recovered: database rows and stored files, including their older versions, are removed; database history expires within 6 hours and deleted files within 30 days.
We also delete data we received from an ad platform (Meta, Google, TikTok or Snapchat) when that platform asks us to under its terms, when you disconnect the account, when you or a shopper asks us to, or when we no longer need it, and we confirm the deletion to the platform if it asks.
9. Platform-specific information
Google. Mintveo's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We access your Google Ads accounts (campaigns, ads and their results) and report your sales to Google Ads through Google's APIs. We use this data only to show your ad results in Mintveo and to report your sales to Google Ads. We do not use it for advertising, do not sell it, do not use it to train general AI models, and our staff look at it only with your permission, for security or when the law requires.
Meta, TikTok and Snapchat. We read your ad accounts and their results, and report your store's sales to the platform through its Conversions API, as described in sections 3.3 and 5. We use Meta advertising data only to assess the performance of your own campaigns, as Meta's Developer Policies require. Merchants who use Mintveo agree to show their shoppers a clear notice that the store uses tools from these platforms (pixels, Conversions APIs) to measure and improve ads, and how to opt out, as each platform's business terms require.
Shopify. We follow Shopify's privacy webhooks. When a shopper asks the store for their data, we help the store answer. When a shopper asks to be erased, we delete their contact details, IP address, device characteristics and visit history; the order amounts stay in the store's reports. When a store uninstalls, we delete the store's data.
WooCommerce plugin. The plugin sends data to Mintveo's servers (api.mintveo.com) only after the store owner connects it to a Mintveo account. It sends the order details (including the customer's name, email, phone and address, which our servers hash on arrival; we keep only the hashes and the postal code, city, region and country), the visitor ID and ad click on the order, the shopping steps in 3.4, and the visitor's IP address and browser type.
Salla and Zid. Our app reads orders and store details through the platform's API after the merchant installs it, and adds the Mintveo script to the store.
10. How we protect it
- All traffic is encrypted (HTTPS).
- Access keys are encrypted in our database, and stored files are encrypted at rest.
- Shoppers' emails, phones and names are hashed before matching and before they are sent out.
- Only the staff who need it to run and support Mintveo can access personal data, and we limit and monitor access to our systems.
- Each merchant's data is kept separate from other merchants' data.
No system is perfectly secure. If a breach affects personal data, we tell the affected merchants without undue delay so they can meet their own duties, and for data we control we tell you and the authorities as the law requires (in Saudi Arabia, SDAIA within 72 hours). If the breach involves data we received from an ad platform, we also report it to that platform as its terms require.
11. Your rights and how to use them
Depending on where you live, you can ask us to:
- tell you what data we hold about you and how we use it;
- give you a copy in a readable format;
- correct it;
- delete it;
- withdraw any consent you gave (this does not affect what was done before);
- object to or limit some uses.
Merchants: use Settings > Data & privacy, or email [email protected].
Shoppers: write to the store you bought from, or to [email protected] with the store's name; we work with the store to answer. To stop Mintveo on a store, decline on the store's cookie banner. If you accepted earlier, reopen the store's cookie settings and decline; from then on we stop collecting and stop sending your purchases to ad platforms (data already sent to an ad platform is held under that platform's policy). Deleting the mv_vid cookie alone does not stop it. If the store has no cookie banner, email [email protected] with the store's name; we stop processing your data for that store and tell the store.
How to delete your data (including data we received from Meta, Google, TikTok or Snapchat):
- To delete one ad account's data: disconnect it on the Integrations page, then delete its remaining spend history in Settings > Data & privacy.
- To delete everything: delete your account in Settings > Data & privacy. Your data, including your sign-in email, is deleted 30 days later (you can cancel until then). We keep only the security log of account actions (section 8).
- Or email [email protected] from the address you use with Mintveo and tell us what to delete.
We confirm when it is done, and if we cannot delete something we tell you why.
We answer within 30 days. If a request is complex we may take up to 30 more days and will tell you why first. We may ask you to prove who you are.
Complaints: write to [email protected] with "Complaint" in the subject; we answer within 30 days. If you are not satisfied, or we do not answer in time, you can complain to your data protection authority. In Saudi Arabia that is the Saudi Data and AI Authority (SDAIA), https://sdaia.gov.sa, normally within 90 days of the issue.
California. We act as the store's service provider and do not sell personal information. Sending a store's sales to ad platforms is the store's decision, and the store is responsible for any "sale" or "sharing" notices and opt-outs that apply to it. We will not treat you differently for using your rights.
12. Children
Mintveo is a business tool and is not meant for anyone under 18. We do not knowingly collect data about children. If you think a child's data reached us, write to [email protected] and we will delete it.
13. Changes
When we change this policy we update the version and date at the top and keep a list of changes below. For important changes we email merchants and ask them to accept the new version when they next sign in.
| Version | Date | Change |
|---|---|---|
| 1.0 | 8 October 2026 | First version |
14. Contact
Mintveo LLC, California, United States · [email protected] · We answer within 30 days.