1. Who we are and scope
MaShop is operated by Edeverse ("we", "us"). This policy explains how we handle personal data on mashop.app: the marketing site, the documentation, the support portal, and the signed-in builder workspace (together, the "Platform").
Edeverse is the data controller for the Platform data described in this policy: your account, your projects, your prompts, and your billing records.
MaShop generates a commerce application for you (your "Merchant App") from your prompts. The code it produces is the "Generated Code". You deploy the Merchant App to your own infrastructure. Data about your storefront customers lives primarily in your own Supabase project, which you own and control. When MaShop provisions that project for you, it is created in your own Supabase organization, in the EU (eu-central-1 region) by default. For your storefront customers' data, you are the controller and your own privacy policy applies. We say "primarily" because payment confirmations for merchant stores can be received and processed by a Platform webhook endpoint. We do not currently offer a standard data processing agreement covering that pass-through. If your business needs one, email contact@edeverse.com.
"Credits" are the prepaid units that meter your AI usage on the Platform.
2. Information we collect
Information you provide
- Account details: your email address, first name, last name (optional), and a password. Authentication runs on Supabase Auth.
- OAuth identities: if you sign in with Google or GitHub, we receive profile data from that provider (see "Information from third parties" below).
- Magic link sign-in: your email address, when you choose to sign in by email link.
- Prompts and project content: everything you type to the AI, plus the files, images, and configuration in your projects.
- Support requests: your messages and any attachments (we store the file name, type, and size).
- Optional extras: a referral code, a project name, category, or description.
- Payment details: you enter card details on Whop's checkout pages, not on MaShop. We receive payment events from Whop (status, amount, plan, and membership identifiers).
Information collected automatically
- Signup IP address and a device hash. The device hash is a SHA-256 hash derived from your browser type, language, and platform; we store the hash, not those raw values.
- Approximate location at country level, read from request headers and stored in a cookie.
- Cookies: a language cookie, a country cookie, a consent cookie, and Google Analytics cookies. See the Cookie Policy.
- Usage analytics through Google Analytics 4, with IP anonymization enabled.
- Error and performance data through Sentry, including Session Replay. Sentry records about 10 percent of sessions, and every session where an error occurs, so we can reproduce bugs.
- Operational logs: request metrics, rate limit counters, and payment and webhook event logs, held in short-lived Redis buffers (Upstash).
- Email delivery logs: the recipient address, subject, and delivery status of each transactional email we send.
- Billing records: a ledger of your Credit transactions, including token counts for AI calls.
Information from third parties
When you sign in with Google or GitHub, that provider sends us your name, email address, and avatar. We use these fields to create and fill your profile. This disclosure identifies the source of that data, as Article 14 GDPR requires.
3. How we use your data
| Purpose | Data used | Legal basis (GDPR Art. 6) |
|---|---|---|
| Create and secure your account, sign you in | Email, name, password, OAuth identity | Contract (Art. 6(1)(b)) |
| Run the workspace and generate code from your prompts | Prompts, project files, conversation history, AI memory | Contract (Art. 6(1)(b)) |
| Bill subscriptions and Credits, keep the Credit ledger | Payment events from Whop, Credit transactions, token counts | Contract (Art. 6(1)(b)) |
| Detect duplicate signups and prevent abuse of signup offers | Signup IP and device hash, compared with signups from the previous 30 days | Legitimate interest (Art. 6(1)(f)): fraud prevention |
| Send transactional emails and monitor delivery | Email address, subject, delivery status | Contract for the email itself; legitimate interest for delivery logs |
| Answer support requests | Support messages and attachments | Contract (Art. 6(1)(b)) |
| Monitor errors, performance, and service security | Error reports, session replays, request metrics, rate limit counters | Legitimate interest (Art. 6(1)(f)) |
| Measure traffic on the marketing site and docs | GA4 events and cookies | Consent (Art. 6(1)(a)) |
| Measure usage of the signed-in workspace | GA4 events | Acceptance at signup (see section 11) |
| Keep billing records required by law | Credit ledger, payment records | Legal obligation (Art. 6(1)(c)) |
We do not sell your personal data.
We do not make decisions with legal or similarly significant effects for you based solely on automated processing. Automation on the Platform is limited to service features, such as routing a prompt to a model.
No law requires you to provide personal data to us. Account details are a contractual requirement: without an email address and a password, we cannot create your account or provide the Platform.
4. AI features and how prompts are handled
When you send a prompt, we send it, together with relevant project context (files, conversation history, and stored AI memory), to a third-party inference provider that generates the response and the Generated Code.
Our inference provider is Fireworks AI. Your prompts do not flow to OpenAI or Anthropic. Every model we use is an open-weight model served through Fireworks. The platform code contains an optional fallback route through a second provider, OpenRouter; it is not enabled today, and no prompts flow through it. We will update this policy before enabling it.
What the providers say about your prompts, under their own terms (retrieved 2 July 2026):
- Fireworks' privacy notice states: "We do not use your prompts, training data, or API inputs to train or improve our AI models without your explicit opt-in." Its documentation adds that Fireworks "does not log or store prompt or generation data for any open models, without explicit user opt-in", and that prompt data exists "only in volatile memory for the duration of the request". All models we use are open models on Fireworks serverless.
These are the providers' commitments in their own terms, not guarantees we can enforce technically. We pass them on so you can assess them.
On our side, prompts and AI answers are stored in your conversation history so you can resume work. AI memory entries store preferences the AI has learned about your project. Deleting a project removes its conversation history; AI memory is removed when your account is deleted, or earlier if you ask us (sections 9 and 10). For how our AI features behave, see the AI Charter.
5. Recipients and sub-processors
We share personal data with the following providers, only to run the Platform.
| Category | Provider | What they process |
|---|---|---|
| Database, authentication, file storage | Supabase | Account data, projects, conversations, files. Our Platform database is hosted in the EU (eu-central-1) |
| Application hosting | Vercel | All traffic to the Platform, including IP addresses and request headers |
| Billing | Whop | Checkout and card details (entered on Whop), subscription and payment events |
| AI inference (primary) | Fireworks AI | Prompts, project context, generated output |
| Transactional email | Resend | Recipient address, subject, message content, delivery events |
| Error monitoring | Sentry | Error reports, performance traces, session replays |
| Caching and monitoring | Upstash | Short-lived operational metrics, event buffers, and rate limit counters (Redis) |
| Code hosting and deployment (only when you connect them) | GitHub, Netlify | Your Generated Code, repository and site metadata, through OAuth tokens you authorize |
| Sign-in and analytics | OAuth sign-in profile data; GA4 usage events |
When you connect an external service to your account (GitHub, Netlify, your own Supabase organization, or a payment or shipping provider), we act on your instruction. Your OAuth tokens are encrypted before storage (section 8) and used to operate that connection, for example to push code and trigger deploys.
6. International transfers
Some of these providers process data in the United States, so your data does not stay only in the EU. For each transfer we rely on a recognized mechanism:
| Provider | Transfer mechanism |
|---|---|
| Vercel, Sentry, Google, Upstash, Netlify, GitHub | EU-US Data Privacy Framework (active participants on the official DPF list as of 2 July 2026), plus standard contractual clauses where applicable |
| Resend | Listed under the EU-US DPF and its UK extension (re-certification under review), plus standard contractual clauses |
| Supabase | Standard contractual clauses. Our Platform database is hosted in the EU (eu-central-1) |
| Whop | Standard contractual clauses |
| Fireworks AI | Appropriate safeguards such as standard contractual clauses |
7. Cookies
We use a small set of cookies: a language preference cookie, a country cookie, a consent cookie, and Google Analytics cookies. The marketing site, the docs, and the support portal ask for your consent through a banner before analytics cookies are set; until you choose, analytics consent defaults to denied. The full list, with names and lifetimes, is in the Cookie Policy.
8. Security
Details are on our Security page. In short: traffic is encrypted with TLS in transit, and our infrastructure providers encrypt stored data at rest. Workspace data is protected with row level security, which scopes access to your account and the collaborators you invite. OAuth tokens and connection keys you give us, including your Merchant App's Supabase service key, are encrypted with AES-256-GCM at the application layer before storage. No internet service is perfectly secure. If a breach affects your data, we will inform you as the law requires.
9. Data retention
Where our systems enforce a concrete period, here it is:
- Automatic project snapshots are deleted after 30 days, and we keep at most the 100 most recent automatic snapshots per project. Snapshots you create manually stay until you delete them or delete the project.
- Operational monitoring buffers (Upstash Redis): performance metrics live 24 hours, event and alert logs 7 days, and aggregate counters 30 days.
- AI memory entries can carry an expiry date and are ignored after it passes.
Other data is kept for the life of your account, with no fixed deletion schedule:
- Profile data, including your signup IP and device hash.
- The Credit ledger, which is designed as an immutable billing audit trail. After account deletion we keep billing records as long as accounting rules require.
- Conversations, until you delete the project they belong to or your account.
- AI memory and AI session records, until your account is deleted or you ask us to remove them.
- Support tickets and email delivery logs, which have no automatic deletion routine.
Deleting a project removes its files, snapshots, deployment records, builder sessions, and conversations from our database, and deletes the connected GitHub repository and Netlify site where we hold a valid token. AI memory and AI session records are not removed by project deletion; email us to remove them sooner (section 10). Your own Supabase project is not deleted: it is yours, and you can remove it from the Supabase dashboard.
To delete your account, email us (section 10). We will delete or anonymize your data, except what we must keep by law.
10. Your rights
Under the GDPR you can ask us to:
- access the personal data we hold about you;
- correct inaccurate data;
- delete your data;
- restrict or object to processing, including processing based on legitimate interest;
- receive a copy of the data you provided (portability);
- withdraw consent at any time, for example for analytics cookies, without affecting past processing.
To exercise any of these rights, email contact@edeverse.com. We do not currently offer in-product data export or account deletion. Email us and we will help. We answer within the time limits the GDPR sets.
You can also complain to a supervisory authority. In France that is the CNIL (cnil.fr); elsewhere in the EU, contact your local authority.
11. Consent in the signed-in workspace
We want to be plain about one thing. The marketing site, the docs, and the support portal ask for cookie consent through a banner, and analytics consent defaults to denied until you choose. The signed-in workspace is different: it runs Google Analytics with consent granted by default and shows no in-app banner. We treat the Terms and this policy, which you accept through a required checkbox at signup, as the basis for that measurement. If you object, email contact@edeverse.com and we will handle your request under section 10.
12. Children
MaShop is a business tool for merchants. It is not directed at children, and we do not knowingly collect personal data from children. To create an account you must be old enough to enter into a binding contract in your country. If you believe a child has given us personal data, email contact@edeverse.com and we will delete it.
13. Changes to this policy
We may update this policy as the Platform changes. We post updates on this page, and the date in the page header shows the current version. For significant changes we will also tell you in the workspace or by email.
14. Contact
Edeverse handles all privacy questions and requests at contact@edeverse.com. We have not designated a data protection officer; this address reaches the people responsible for privacy at Edeverse.