Privacy policy
Effective October 1, 2026
Milanus MultiApp helps Shopify merchants manage customer-tag pricing, product badges, and shopper-approved saved carts. The merchant that installs the app controls how its customer data is used; the app processes that data only to provide the installed features.
Data processed
The app processes shop identity and authorized administrator session data; Shopify customer IDs and managed pricing tags; product, variant, SKU, and pricing data; and order identifiers needed to mark a saved cart as converted. A saved account cart is associated with the signed-in Shopify customer ID so that the same customer can continue it on another device. Customer names and email addresses can appear in a merchant-requested CSV export but are not retained by that export operation. The customer-tag export does not request Shopify customer phone or address fields.
When mobile cart saving is enabled, a signed-in customer may choose to save their cart with a mobile number. Only after that choice does the app read that customer's own Shopify profile phone to fill the review form; the customer may change it. The read is audited without recording the phone in the audit. The profile phone is not placed in browser storage or read for anonymous shoppers. Validation occurs only after the customer continues.
For a guest subject to the cart rule or a signed-in customer choosing mobile cart saving, the app stores an encrypted mobile number, a keyed one-way hash, the last four digits, the Twilio Lookup line-type result, the minimum cart-line data needed to restore the cart, and the customer's optional SMS-recovery consent record. Twilio Lookup confirms validity and mobile line type but does not prove that the customer owns the number, and no text message is sent during validation. Recovery marketing consent remains optional.
When the merchant enables account-cart syncing, a signed-in shopper's cart is saved automatically after cart changes and loaded for the same Shopify customer account on another device. Saved items merge with items already in that browser cart; existing items are not replaced. The storefront response contains only bounded variant IDs and quantities, and another signed-in customer cannot read or bind that cart.
Each merchant connects its own Twilio account using an API key. Account credentials are encrypted and tied to the installing Shopify store. The app stores masked credential identifiers, connection timestamps, request counters and action audit records. It does not request or store the merchant's Twilio login password. A connection test sends the merchant-supplied test number to Twilio but does not retain the full test number.
Purposes and sharing
Data is used to apply and verify customer pricing, run merchant-requested imports and exports, display badges, validate mobile numbers, save carts, prevent abuse, and meet legal obligations. Phone lookups are submitted using the installing merchant's Twilio account, not a shared app-owner account. Data is shared only with Shopify, the app's infrastructure provider, and Twilio as needed to deliver those functions. It is not sold. Recovery SMS sending is not currently enabled.
Retention and deletion
CSV preview and completed-import records expire after 24 hours. Imports still being applied are retained for recovery. Verification-attempt records expire after 24 hours. Encrypted guest-cart retention is merchant-configurable from 1 to 365 days and defaults to 90 days. The running production service checks for expired records on startup and hourly; an outage can delay removal until service resumes. Shopify revokes API access on uninstall. After an authenticated uninstall notice, the app promptly removes the shop's active app data, credentials, sessions, and identifiable guest carts. It keeps only the minimum temporary installation-generation fence needed to process Shopify's delayed authenticated shop-redaction request without erasing a newer reinstall; final redaction removes that fence. Short-lived payload-free webhook delivery IDs prevent retry duplication. Customer-redaction requests remove matching customer data. Backup copies are separate from the active database and may remain according to the hosting provider's backup retention and restore procedures.
Security and choices
Secrets are kept outside source code, mobile numbers and merchant API credentials are encrypted at rest, public requests are signed or authenticated through Shopify, and checkout rules are independently enforced by Shopify Functions. Merchants can disconnect Twilio after disabling the guest phone requirement; this removes the saved key from the active database but does not revoke it in Twilio or erase existing backups. Customers may decline recovery SMS consent. Privacy access or deletion requests should be sent to the merchant first so the merchant can identify the relevant Shopify customer or cart.
Contact
Questions can be sent to sales@milanus.com, by telephone at +1 305-545-9778, or through Milanus contact support.