MAIO Privacy Policy

Last updated: August 2026

What we collect

MAIO stores minimal operational data: shop domain, shop metadata used for snapshots, and the results of the scans and visibility checks you run.

How data is used

Data is used only to provide the app’s features and to improve their reliability.

Merchant product analytics

When an authenticated merchant uses the embedded app, MAIO records page views and interactions with actionable controls so we can understand feature usage and diagnose failures. An event contains the shop domain, a stable installation identifier, app version, UTC timestamp, event name, app page path, and a stable control identifier. User-visible application errors are recorded with common credential, email, and URL-query patterns removed so MAIO can diagnose failures quickly. MAIO does not collect arbitrary control text, form values, typed text, click coordinates, access tokens, Shopify user identity, or shopper activity in these events. Product analytics events are automatically deleted after 90 days.

Tokens and security

Shopify access tokens are stored server-side only and are never exposed in client-side code.

AI Traffic analytics and the MAIO pixel

MAIO installs a Shopify web pixel on the storefront to power the AI Traffic report. Once per browser session, the pixel sends MAIO two things: the store’s myshopify.com domain, and the bare hostname of the site the visitor arrived from (for example chatgpt.com). URL paths and query strings are removed in the browser before anything is sent, and no cookie, IP address, device identifier, customer identifier, or cross-site profile is collected or stored.

MAIO checks the hostname against a list of known AI assistants. If it does not match, the request is discarded and nothing is written. If it matches, MAIO increments a single aggregate counter of the form “store X saw N sessions from ChatGPT on 2026-08-07”. Because these counters hold no identifiers, individual visitors cannot be distinguished, re-identified, or tracked across sessions or sites.

The pixel declares analytics as its only purpose and is loaded by Shopify’s pixel manager only where the visitor has consented to analytics tracking. MAIO does not use this data for marketing, does not sell or share it, and does not use it for automated decision-making. MAIO does not request or access Shopify protected customer data.

AI Crawler Detection

If a merchant switches on the optional “MAIO AI Crawler Detection” theme app embed, storefront pages include a 1×1 image served from the store’s own domain. Fetching that image tells MAIO which automated crawlers are reading the store, which Shopify otherwise gives apps no way to see. The embed is off unless the merchant turns it on.

MAIO identifies the requester from its user agent. If it is a known crawler (for example GPTBot, ClaudeBot or Googlebot), MAIO records the crawler name, the page path it requested, and the time. Crawlers are automated software, not people.

If the requester is not a known crawler it is treated as a shopper, and MAIO stores nothing that could identify them: no IP address, no user agent, no page path. A small number of requests per store per day are counted only to confirm the feature is working. MAIO does not use any of this for marketing, does not sell or share it, and does not use it for automated decision-making.

AI Traffic counters and crawler detections are stored on MAIO’s servers in the United States (UpCloud, New York), are reported over a rolling 30-day window, and are automatically deleted after 13 months.

Services MAIO contacts on your behalf

Some Visibility Controls send your store’s public URLs to third parties, at your request and only when you press the button that does it. Submitting to IndexNow sends the URL to IndexNow-compatible search engines, including Microsoft Bing and Yandex. Running a speed test sends the URL to Google PageSpeed Insights. Running a scan sends it to MAIO’s own scanning service. These requests carry the public address of a page and nothing about you or your shoppers.

Data retention and deletion

When MAIO is uninstalled, app sessions are removed and associated MAIO shop records are deleted via uninstall webhook handling.

Contact

For privacy requests related to MAIO, contact: mike@maioai.com

MAIO v1.0.41