Mula Trace for Shopify: Privacy Policy

Mula Trace for Shopify (the "App") is provided by PT Nara Inovasi Indonesia ("Mula", "we"), an Indonesian limited liability company.

• Address: Next Office, Menara Agrinas Palma Lantai 15 Unit 15-03, Jl. H. R. Rasuna Said Kavling VI No. 9 Blok X2, RT 9/RW 4, Kuningan Timur, Kecamatan Setiabudi, Kota Jakarta Selatan, Daerah Khusus Ibukota Jakarta 12950, Indonesia.
• Privacy contact: team@mula.asia.
• Privacy owner: our privacy owner answers at team@mula.asia.

The App is for businesses (Shopify merchants). It is not offered to consumers.

The App asks Shopify for one permission, `read_products`. It reads your products and variants: title, vendor, description, handle, type, status, image, variant title, SKU and barcode.

• It does not ask for access to your customers, orders or payments.
• It does not change your store. Writing passport data into your storefront is not enabled.
• Importing a product publishes nothing. A passport is published only when you choose to publish it.

• A copy of your product catalogue (the App's catalogue copy)

  Why:

  To create and keep passports in step with your catalogue

  How long:

  Until an operator erases it after Shopify's shop-erasure request (section 5)

• Your store's product links in Mula and the unpublished drafts and reviews made through the App

  Why:

  To make passports

  How long:

  Same

• What you enter into passports (descriptions, composition, origin, evidence you record, images, maker names where you hold a maker's permission)

  Why:

  To produce the passport you publish

  How long:

  Until you remove it; published passports stay (section 6)

• Which terms version you accepted and when

  Why:

  To show what you agreed to

  How long:

  While your account is active and up to 12 months after it closes; longer if there is a dispute

• Records of Shopify webhooks the App received (app uninstalled, product events, scopes updated, and Shopify's privacy requests), with the shop id and domain

  Why:

  To keep your catalogue in step and to answer Shopify's privacy requests

  How long:

  Until an operator closes the job under the written procedure

• Bodies of Shopify's customer data requests and customer erasure requests (customer and order identifiers), kept encrypted

  Why:

  To answer or carry out the request

  How long:

  Until an operator closes the job and erases the body, and in any case no longer than 30 days after Shopify's request (section 4)

• The names, email addresses and telephone numbers of the people who use your Mula workspace, with their role and sign-in records

  Why:

  To run your account and keep it secure

  How long:

  While the account is active and up to 12 months after it closes, longer if there is a dispute

• Billing records

  Why:

  See section 8

  How long:

  None: the App is free; no payment is taken.

We do not sell your data, use it for advertising, build profiles of people, or use it to train artificial intelligence models.

The App does not request customer data from Shopify. But Shopify sends every app its mandatory privacy webhooks (customer data request, customer erasure, shop erasure). For the first two, the App records the request and keeps its body encrypted until a Mula operator closes the job. The body contains customer and order identifiers. The job is closed, and the body erased, within 30 days of Shopify's request; the body is never kept longer than that.

• Every webhook is acknowledged to Shopify. Acknowledging a webhook does not mean the request has been fulfilled.
• Customer data requests are answered to the store owner within 30 days, from team@mula.asia. Our internal target is 7 days, with escalation at day 21.
• Customer erasure requests are carried out by an operator by hand, within 30 days of Shopify's request, under a written procedure.
• A request for a shop that never opened the App is acknowledged and not recorded.

Erasure is manual. Nothing is deleted automatically in production.

1. When you uninstall, the App stops reading your store. The uninstall is recorded and waits for an operator.
2. About 48 hours after uninstall, Shopify sends its shop-erasure request.
3. Within 30 days of that request, a Mula operator, by hand and under a written procedure, erases the App's copy of your Shopify product data, and deletes your store's product links in Mula and the unpublished drafts made through the App.
4. The operator checks that no product link remains for your store, and keeps a record of the erasure. The record holds the counts of what was erased and your shop id, is kept outside source control, and is kept for 12 months.

Published passports stay, and so does your Mula workspace. Uninstalling the App does not close your Mula account. Settings in the App says how to close it. That notice is shown in Settings only: we do not store your store's email address, and there is no automatic message to you after uninstall.

Only what you choose to publish. A published passport has a permanent public address, so printed QR codes keep working. If a passport is taken down, its address shows a page saying it is no longer available. Addresses are never reused by another brand. The public passport page belongs to Mula core, not to the App.

If we take a passport offline on a credible notice of unlawful content or because the law requires it, or if we end the service, its address keeps answering with the same page saying the passport is no longer available. The Terms and App Addendum, clauses 13 and 14, say when that happens and what notice you receive.

A maker is named on a passport only while you hold an active attestation that the maker agreed. No one under 18 is named. A maker can withdraw through you or at team@mula.asia, and the name leaves the public passport within 24 hours of the withdrawal reaching us.

When someone opens a public passport, the only cookie is the language switch, set when they change language; it holds no identifier. We keep no marker on their device to recognise them later and do not store their IP address. We count scans, not people. The passport page runs no advertising or third-party tracking scripts.

The embedded App sets no cookie of its own. It keeps a fingerprint of a spreadsheet you upload in your browser's session storage, so a reload can resume; it is cleared when the tab closes. Shopify's session token runs the embedded frame.

• Hosting providers, acting on our instructions: Supabase (database and files, Singapore, ap-southeast-1) and Vercel (hosting, Singapore for functions; Vercel states its primary processing facilities are in the United States) for Mula core. The App itself runs on its own Vercel project (Singapore) and its own Supabase project.
• Shopify, as the platform you install the App on.
• Google, which hosts our mailbox team@mula.asia.
• Authorities, only on a formal written request with a legal basis.
• The App is free in this version. We take no payment and hold no billing or card data. If paid plans are introduced, Shopify will bill them and this policy will say what billing data we receive.

Backups and logs. Our hosting providers keep backups and logs for the shortest period their plans offer. Supabase keeps daily backups of the database for the last 7 days. Vercel keeps runtime logs for 1 day. Data erased under section 5 may remain in a backup until that period ends.

Transfers. We are in Indonesia and data is hosted in Singapore. Some providers are US companies. Transfers out of Indonesia are made with the protections Law 27/2022 on Personal Data Protection requires. Where data about people in the EU or EEA is transferred, we rely on the protections the applicable data protection law requires for that transfer; our providers are bound by written terms that restrict them to our instructions. We will say in this policy if a transfer mechanism changes.

For the data of the people who use your Mula workspace, the records of your account and your acceptance of the terms, and the public passport pages, Mula is the controller: we decide why and how that data is handled, as this policy states.

For any personal data inside the content you record through the App, for example the name of a maker you attest, you are the controller and Mula is the processor: we handle it on your instructions, which are this policy and the Terms and App Addendum. The same applies to the bodies of Shopify's customer requests for your store (section 4). A written data processing agreement is available on request at team@mula.asia.

This policy is governed by the laws of the Republic of Indonesia, including Law 27/2022 on Personal Data Protection. Any dispute about this policy is brought exclusively before the District Court of South Jakarta (Pengadilan Negeri Jakarta Selatan), Republic of Indonesia, as clause 16 of the Terms and App Addendum states. It does not reduce any right you have under data protection law that applies to you and cannot be excluded by agreement.

You can ask for a copy of data we hold about you, to correct it, to delete it, to restrict or object to its use, and to withdraw consent. Write to team@mula.asia. We give a first response within 3 working days and work to resolve requests within 14 working days. We may ask for reasonable information to confirm who you are. If you are in the EU or EEA you can complain to your data protection authority.

Requests about a store's customers go to the store owner (section 4).

Each version shows its effective date at the top. If a change affects how we use your data we will say so in the App at least 30 days before it takes effect.

PT Nara Inovasi Indonesia · team@mula.asia · address in section 1.