Effective date: 19 October 2026
This privacy policy explains how Mermaid Devs Pty Ltd (“Mermaid Devs”, “we”, “us”) collects, uses and protects information when a Shopify merchant installs and uses one of our Shopify apps:
- MD Partial Offline Payments
- MD Partial Local Pickup
It applies only to these apps. It does not cover the Mermaid Devs website or our consulting services.
Who we are
Mermaid Devs Pty Ltd is an Australian company based on the Gold Coast, Queensland. We handle personal information in line with the Privacy Act 1988 (Cth) and the Australian Privacy Principles. Where the EU or UK GDPR, or other privacy laws, apply to a merchant’s store, we act as a processor on the merchant’s behalf.
Contact: support@mermaiddevs.com
Our role
The merchant who installs an app controls their store data and their customers’ data. We process that data only to provide the app’s features to the merchant. We do not sell it, rent it, use it for advertising, or contact a merchant’s customers.
Information the apps access
When a merchant installs an app, Shopify grants it access to certain store data through the Shopify Admin API. The apps request only the permissions they need.
MD Partial Offline Payments
- Orders, including order totals, payment status and transactions, and the customer details attached to an order (such as name and email address), so the merchant can view orders and record offline or partial payments against them.
MD Partial Local Pickup
- Orders and the customer details attached to them, so the merchant can manage partial pickups.
- Fulfilment orders and fulfilments, so items can be marked as picked up.
- Products, to show line items correctly.
Order and customer details are read from Shopify when the merchant uses the app and are shown in the app. The apps do not keep their own copy of customer names, email addresses, phone numbers or addresses.
Information we store
To run the apps, we store a small amount of information in our own database:
- Store and session data: the store’s myshopify domain and the access token Shopify issues to the app, so the app can connect to the store.
- App settings: for example, the payment method names a merchant sets up in MD Partial Offline Payments.
- Payment records (MD Partial Offline Payments): for each payment recorded, the Shopify order and transaction IDs, amount, payment date, payment reference entered by the merchant, and whether the payment was voided.
- Usage data: the date the app was first used and a count of transactions recorded, used to run the app and to time in-app review prompts.
Payment references are free text entered by the merchant. We recommend merchants don’t enter customer personal information or card details in this field.
Billing
App subscriptions are billed through Shopify. We never see or store a merchant’s credit card or bank details.
How we use information
We use the information above only to:
- provide, maintain and support the apps
- keep the apps secure and fix problems
- respond to support requests from the merchant
Where information is stored
The apps and their database are hosted with a third-party cloud provider, and data may be stored or processed outside Australia, including in the United States. Data is encrypted in transit using TLS. Access to production systems is restricted to Mermaid Devs.
Sharing
We share information only with:
- Shopify, as needed for the apps to work
- Our hosting provider, which stores the app’s data on our behalf
- Authorities, if we are required to by law
Data retention and deletion
- When a merchant uninstalls an app: Shopify sends us a shop deletion request 48 hours later. When we receive it, we delete all data we hold for that store.
- Customer data requests: if a merchant’s customer asks for their data through Shopify, we provide the merchant with any data we hold about that customer. Because the apps don’t store customer personal details, this is usually limited to order and payment records linked to that customer’s orders.
- Customer deletion requests: if Shopify sends us a customer redaction request, we delete or anonymise any records we hold that are linked to that customer’s orders.
Your rights
Merchants can ask us at any time to access, correct or delete the information we hold about their store by emailing support@mermaiddevs.com.
If you are a customer of a store that uses one of our apps, please contact that store first, as they control your data. We will help the merchant respond to your request.
Complaints
If you have a concern about how we’ve handled personal information, email us and we’ll respond within 30 days. If you’re not satisfied with our response, you can contact the Office of the Australian Information Commissioner at oaic.gov.au, or the data protection authority in your country.
Changes to this policy
We may update this policy when the apps change. The effective date at the top shows when it was last updated.