Last updated: 22 August 2026
mailipy («the Service») is an AI-assisted email support tool for e-commerce stores. The controller of your account data is ORGANIC ECOM LLC (EIN 30-1338491), with registered address at 1342 NM 333, Ste C 5130, Tijeras, NM 87059 (United States). Contact: edgar.grau.montero@gmail.com.
It is important to distinguish two levels:
| Category | Data | Purpose |
|---|---|---|
| Account | Email and password (managed by Firebase Authentication; the password is stored encrypted/hashed and mailipy never sees it in clear text). | Create and give access to your account. |
| Connections | Support mailbox credentials (IMAP/SMTP) and Shopify access token, both encrypted at rest. | Read incoming email, send approved replies and look up orders. |
| Support content | Support emails (sender, subject, body, thread) and order data retrieved from Shopify (order number, status, tracking, customer name and email). | Generate draft replies for your review. |
| Cart recovery | Abandoned checkout data from your store: buyer email, cart items, amount, currency and recovery link. | Send the cart recovery emails you have configured. |
| Service usage | Technical logs of service activity. | Operate, debug and secure the Service. |
We process your account data to perform the contract (providing you the Service) and, where applicable, on the basis of legitimate interest (security and product improvement). Your customers' data is processed on your behalf and on your instructions (see DPA).
Support replies are never sent without your approval. mailipy generates drafts that a person on your team reviews, edits and approves before sending; you stay in control of every reply.
Cart recovery emails are sent automatically, following the sequence you configure and using templates you have approved beforehand. You can turn this feature off at any time, and every recovery email includes an unsubscribe link.
To provide the Service we rely on providers that process data on our behalf:
| Provider | Function | Location |
|---|---|---|
| Anthropic (Claude API) | Generates the draft text from the email content and the order. Anthropic does not use data submitted through the API to train its models. | USA (with contractual safeguards — standard contractual clauses). |
| Google Cloud / Firebase | Storage (Firestore), authentication, hosting and backend execution. | European Union (europe-west1 region). |
| Resend | Delivery of outgoing email (approved replies and cart recovery emails) for accounts that do not send through their own mailbox. | USA (with contractual safeguards — standard contractual clauses). |
| Your email provider | The IMAP/SMTP mailbox you connect (e.g. Gmail or your hosting provider's email). It is your own provider; mailipy only connects using the credentials you supply. | Depends on your provider. |
Data is stored in the European Union (Google Cloud, europe-west1 region). However, ORGANIC ECOM LLC is established in the United States, so operating the Service involves access to data from the USA, as does processing by Anthropic and email delivery by Resend. Where the GDPR applies, these transfers rely on the European Commission's standard contractual clauses (Implementing Decision (EU) 2021/914) and on the appropriate safeguards required by law.
We retain data for as long as your account is active and for as long as necessary to comply with legal obligations. You may request erasure at any time; when you close your account we delete or anonymise the data within a reasonable period, unless we are legally required to retain it.
We apply technical and organisational measures: encryption in transit (TLS), encryption at rest of sensitive credentials, secret management, and logical isolation of data per account so that no customer can access another's data.
You have the right to access, rectify, erase, restrict and object to the processing of your data, as well as the right to data portability. To exercise them, write to edgar.grau.montero@gmail.com. You may also lodge a complaint with the competent data protection supervisory authority in your country of residence or establishment.
We may update this policy. We will publish the current version on this page along with its update date.