MarginReality

Privacy Policy

Last updated: July 2026

The short version

Your Shopify CSV never leaves your browser. We do not have a server that receives it, a database that stores it, or an account that ties it to you. The only personal data we keep is the email address you give us (opt-in) and the license key we issue when you buy the $9 Pro report. Payment is handled by Creem, our Merchant of Record. We never see or store your card details.

1. Your Shopify CSV stays in your browser

When you upload a Shopify Orders CSV to any MarginReality tool, the file is parsed entirely on your device using JavaScript running in your browser. Zero bytes of your CSV are transmitted to our servers. We do not upload it, cache it, log its contents, or send it to any third party. Closing the tab erases the data. This is the single most important fact about how MarginReality handles your data, and it is true for both free and paid reports.

We are able to make this guarantee because there is no server-side upload endpoint for CSV contents. If you open your browser dev tools Network tab while running a report, you will not see the CSV payload leave your machine.

2. No account, no login

MarginReality has no user accounts. There is no registration, no password, and no session tied to your identity. Your identity, where we need one, is the combination of your email address and your license key. If you never buy a Pro report, we never learn who you are beyond the anonymous analytics described in section 6.

3. Payment data (handled by Creem)

The $9 Pro report is sold through Creem, which acts as the Merchant of Record. That means Creem, not MarginReality, processes your payment and is responsible for the transaction. Specifically:

  • Card data: Entered on Creem's checkout page. MarginReality never receives, stores, or sees your credit card number, CVC, or expiry. We are not a PCI-DSS scope because we never touch card data.
  • What we receive from Creem: A webhook with your email address (so we can send your license key), the fact that payment succeeded, and the order identifier. We do not receive your card or billing details from Creem.
  • Taxes (EU, UK, VAT, GST): Creem handles sales tax, VAT, and GST collection and remittance as the Merchant of Record. Tax-related questions should go to Creem support. MarginReality remains responsible for the privacy of the data Creem passes to us, as described in this policy.
  • Receipts and invoices: Issued by Creem. If you need a VAT invoice or a charge receipt, contact Creem or use the link in your purchase confirmation email.

4. License key and email (Upstash Redis)

When your $9 payment succeeds, we issue a license key and email it to you via Resend. We store the following in Upstash Redis (a managed Redis service):

  • Your email address: To deliver the license key and to look up your purchase later.
  • Your license key: To verify that you have purchased Pro when you unlock features in the browser.
  • Purchase timestamp: When the license was issued.

The license key is stored locally in your browser via localStorage when you enter it. It is bound to the browser you unlock on. We do not place a tracking cookie to identify you across browsers. See our Terms of Service for what one license covers.

5. Email we send you

We use Resend to deliver email. The emails we may send are limited to:

  • Your $9 Pro license key and purchase confirmation.
  • An optional welcome sequence (3 short emails over the first week) sent only if you explicitly subscribe on a tool page. You can unsubscribe at any time via the link in every email or our unsubscribe page.
  • Direct replies to support questions you send us.

We do not send unsolicited marketing email to customers who only bought a license and did not opt in to the welcome sequence. License-key delivery is transactional and is not a marketing list.

6. Cookies, analytics, and advertising

MarginReality uses cookies and similar technologies to provide and improve the site. We use the following:

  • Google Analytics (GA4): Collects anonymous usage data such as page views and session timing. IPs are truncated by Google before storage.
  • Plausible Analytics: Privacy-first, cookie-free, GDPR/CCPA/PECR compliant. Collects aggregate page view counts only. No cross-site tracking.
  • Microsoft Clarity: Heatmaps and session recordings for usability. Clarity masks IP addresses and does not build user profiles for advertising.
  • Google AdSense (only on content pages, never on tool pages): May set advertising cookies to serve ads based on your interests. Opt out at Google Ad Settings. See Google's partner-sites policy for how Google uses ad data.
  • localStorage for your license key: A first-party storage entry, not a tracking cookie. Only written when you enter a license key. Clearing your browser data also clears the key (you will need to re-enter it).

The cookie consent banner you saw on entry lets you decline non-essential analytics and advertising. Essential functionality (CSV processing, license key entry) does not depend on cookies and works with cookies declined.

7. Data retention

  • CSV contents: 0 retention. The data is never on our servers.
  • Email + license key: Retained indefinitely so we can verify your purchase when you return on a new browser, recover a lost license key, or honor refund requests. We keep this minimal and do not enrich it with behavioral data.
  • Welcome-sequence subscribers: Retained until you unsubscribe. Unsubscribing stops future emails but does not delete the license-key record if you also purchased Pro.
  • Analytics: Aggregated and anonymized. GA4 retains data per Google's defaults; Plausible retains aggregate counts; Clarity retains session recordings per Clarity's defaults.
  • Payment records: Held by Creem as the Merchant of Record, per their retention policy and legal requirements.

8. Third-party services summary

  • Creem: Merchant of Record for $9 Pro purchases. Processes payment, handles taxes, issues invoices.
  • Upstash Redis: Stores email, license key, purchase timestamp, and source.
  • Resend: Email delivery for license keys and the opt-in welcome sequence.
  • Vercel: Website hosting and edge delivery.
  • Google Analytics, Plausible, Microsoft Clarity: Anonymous product analytics.
  • Google AdSense: Advertising on content pages only (never on tool pages).

9. Your rights (GDPR, CCPA, and similar laws)

If you are in the European Union (GDPR), the United Kingdom (UK GDPR), California (CCPA/CPRA), or another jurisdiction with similar privacy rights, you may:

  • Access: Request a copy of the email and license-key data we hold for you.
  • Rectify: Correct an out-of-date email address tied to your license.
  • Erase: Request deletion of your email and license-key record. Note: this does not refund a purchase and does not affect records Creem is required to keep as Merchant of Record.
  • Object or restrict: Object to processing of your data for the welcome-sequence emails (unsubscribing also accomplishes this).
  • Portability: Receive your email + license-key record in a machine-readable format.
  • Withdraw consent: For any processing based on consent (analytics, welcome sequence), withdraw at any time without losing access to your purchased Pro report.
  • CCPA opt-out of sale: We do not sell your personal information, so no opt-out is required. We also do not share data for cross-context behavioral advertising beyond what AdSense needs to serve ads on content pages.

To exercise any of these rights, email privacy@marginreality.com from the address tied to your purchase. We respond within 30 days, and we will not require you to create an account to exercise a right.

10. Data breach notification

In the event of a breach affecting your personal data (the only personal data we hold is email, license key, and purchase timestamp), we will notify affected users within 72 hours of becoming aware of the breach, in line with GDPR Article 33. Breaches at Creem, Upstash, or Resend are the responsibility of those providers under their own breach-notification obligations; we will also surface any notice we receive from them on this page.

11. International transfers

Your email and license key may be processed by Upstash, Resend, and Vercel in regions outside your home country (commonly the United States or the European Union, depending on the provider). These providers rely on Standard Contractual Clauses or equivalent transfer mechanisms for EU/UK data. CSV contents are never transferred because they never leave your browser.

12. Children's privacy

MarginReality is not directed to children under 13 (under 16 in the EU). We do not knowingly collect personal data from children. If you believe a child has provided an email address, contact privacy@marginreality.com and we will delete it.

13. Changes to this policy

We may update this policy from time to time. Material changes (for example, adding a new data processor, or changing what we store) will be posted on this page with an updated “Last updated” date. Continued use of MarginReality after a change constitutes acceptance of the updated policy, to the extent permitted by law.

Contact

Privacy questions or rights requests: privacy@marginreality.com. General support: support@marginreality.com.