Our legal and compliance policies

This Privacy Policy explains how Yoghurt Pot Limited, trading as Motina ("Motina", "we", "us" or "our"), collects, uses, stores and shares personal data.

Motina is an ecommerce analytics and insights service that connects to supported ecommerce platforms, including Shopify, to analyse store data and storefront activity and identify findings, trends and opportunities.

Yoghurt Pot Limited is a company registered in England and Wales under company number 12105928, with its registered office at 45 Tameside, Stokesley, TS9 5PE.

If you have questions about this Privacy Policy or how we handle personal data, contact privacy@motina.co.uk.

1. Who this policy applies to

This Privacy Policy covers personal data relating to:

• merchants and businesses using Motina;
• people who administer or use a Motina account on behalf of a merchant;
• people who contact Motina for support or other enquiries;
• visitors to the Motina website;
• customers and visitors of stores that use Motina, where Motina processes their data on behalf of a merchant.

The way we are legally responsible for personal data depends on the context.

2. When Motina is a controller and when it is a processor

When we are a controller

Yoghurt Pot Limited acts as a controller when we decide why and how personal data is used for our own purposes.

This generally includes information used to:

• create and administer merchant accounts;
• manage our relationship with merchants;
• provide customer support;
• secure and operate Motina;
• understand use of our own website and Service;
• communicate with merchants;
• comply with legal obligations;
• establish, exercise or defend legal claims.

When we are a processor

When Motina processes personal data relating to a merchant's customers or storefront visitors in order to provide the Service, the merchant generally determines why that data is processed.

In those circumstances:

• the merchant is generally the controller; and
• Yoghurt Pot Limited acts as the merchant's processor.

Our processing of this data is also governed by our Data Processing Addendum.

If you are a customer or visitor of a store that uses Motina, the merchant's own privacy notice should provide information about how that merchant uses your personal data.

3. Information we collect about merchants

When you install, access or use Motina, we may process information including:

Account and store information

This may include:

• your Shopify store domain;
• the shop-owner email address made available by Shopify;
• an email address you choose for Motina notifications;
• information about your subscription and account status.

We do not currently store merchant or staff names from Shopify.

Where Shopify processes your Motina subscription payment, Shopify handles the underlying payment transaction. Motina does not receive your full payment card details from Shopify.

Merchant session and technical information

When an authorised merchant uses Motina, we may process:

• IP address;
• browser and user-agent information;
• session identifiers;
• authentication and security information;
• information about interactions with Motina;
• diagnostic and error information.

Merchant admin sessions expire after approximately 120 minutes in accordance with our current session configuration.

Support and communications

If you contact us, we may process:

• your email address;
• your name where you provide it;
• the company or store you represent;
• the content of your message;
• attachments or other information you choose to provide;
• records of our response.

Please avoid sending us personal data that is not necessary for us to deal with your enquiry.

4. Information obtained from Shopify

When a Shopify merchant installs Motina, the merchant authorises access to specified Shopify data.

Motina currently requires access to:

• products and variants;
• inventory;
• orders.

Our current Shopify integration does not request dedicated access to:

• customer records;
• checkouts;
• themes;
• discounts;
• fulfilments.

Some information relating to customers, discounts and fulfilment status may nevertheless be included within Shopify order data that Motina is permitted to access.

Product and inventory information

We may process information including:

• product titles;
• handles;
• publication status;
• product and variant identifiers;
• variant options;
• prices;
• product image URLs;
• inventory quantities;
• inventory locations.

Most product and inventory information is not personal data, but it forms part of the store information Motina processes to provide the Service.

Order information

We may process:

• Shopify order identifiers;
• order timestamps;
• order values and totals;
• discounts;
• line items;
• product identifiers;
• product titles;
• quantities;
• prices and subtotals;
• refunds;
• customer identifiers;
• customer email addresses.

Shopify order payloads can contain additional customer information.

Motina deliberately applies an ingestion allow-list so that customer information we do not require is discarded rather than retained.

For example, we do not retain customer:

• names;
• postal addresses;
• phone numbers;
• tags;
• marketing-consent information;
• lifetime order counts.

We retain customer email addresses where required to associate customer activity and orders for the analytics provided by Motina.

5. Storefront analytics information

Motina collects certain information about how visitors interact with a participating merchant's storefront.

Depending on the activity taking place, this can include:

• page views;
• product views;
• add-to-cart activity;
• checkout steps;
• page path;
• page title;
• page URL;
• referring URL;
• UTM campaign information;
• product identifiers;
• variant identifiers;
• browser or user-agent information;
• a Motina-generated anonymous visitor identifier;
• a Motina-generated session identifier.

This information helps Motina understand storefront behaviour, associate activity across a browsing session and analyse how storefront activity relates to store performance and orders.

Visitor and session identifiers

Where permitted, Motina uses pseudonymous identifiers to recognise a browser and browsing session.

The current identifiers are stored using browser local storage rather than cookies.

They include identifiers used to:

• recognise a returning browser;
• distinguish individual browsing sessions;
• determine when a session should expire.

Session identifiers normally rotate following approximately 30 minutes of inactivity.

An associated session identifier may also be placed in Shopify cart attributes so that storefront activity can subsequently be associated with an order.

These identifiers do not by themselves contain a person's name or email address.

Further information is provided in our Cookie & Tracking Notice.

Consent

Where applicable, Motina respects the privacy and analytics consent signals provided by Shopify's customer privacy functionality.

Where analytics consent is required and has not been provided, Motina does not create or use its normal visitor identifiers for analytics tracking.

Motina may receive anonymous aggregate event counts that do not identify or distinguish the visitor.

Where applicable law permits analytics processing without prior consent and the merchant's Shopify configuration reflects this, tracking may operate in accordance with those settings.

Merchants remain responsible for configuring their storefront privacy settings appropriately and providing any privacy information or consent mechanism required by applicable law.

6. IP addresses

Storefront visitors

Motina does not ordinarily store the IP address of a storefront visitor in its analytics warehouse.

An IP address may be used transiently for operational purposes such as rate limiting.

An IP address may also appear in server security or error logs where, for example, a request fails authentication or triggers a rate limit.

We do not use storefront visitor IP addresses to build Motina visitor profiles.

Merchants

The IP address and user agent associated with an authenticated merchant session may be stored for the duration of the relevant session for security and session-management purposes.

7. Information collected through motina.co.uk

When you visit our website, we may collect ordinary technical and analytics information about your visit.

We currently use Google Analytics to help us understand use of the website.

Depending on your location, applicable law and consent choices, analytics information may include:

• device and browser information;
• approximate location derived from technical information;
• pages viewed;
• referring pages;
• interactions with the website;
• analytics identifiers.

We also use Formspree to process information submitted through forms on our website.

If you complete a form, we process the information you choose to submit, which may include your name, email address, company, store and the content of your message.

Further details about cookies and other browser storage are provided in our Cookie & Tracking Notice.

8. How we use personal data when we are a controller

Where Yoghurt Pot Limited acts as controller, we may use personal data for the following purposes.

Providing and administering Motina

We process account and contact information to:

• provide access to Motina;
• administer subscriptions;
• send service-related communications;
• maintain our relationship with you;
• provide support.

Our lawful basis is generally performance of our contract with you where you are contracting personally, or our legitimate interests in administering our business relationship with the organisation you represent.

Operating and securing the Service

We process technical, session, diagnostic and security information to:

• authenticate users;
• protect accounts;
• detect abuse;
• investigate faults;
• maintain service reliability;
• protect Motina and its infrastructure.

Our lawful basis is our legitimate interest in operating and protecting our Service, merchants and systems.

We may also process information where necessary to comply with a legal obligation.

Improving Motina

We may analyse information about how merchants use Motina to understand:

• which functionality is useful;
• where errors occur;
• how the Service performs;
• how we can improve the product.

Our lawful basis is generally our legitimate interest in developing and improving Motina.

Where a separate consent requirement applies to a cookie, local-storage mechanism or similar technology, we will also obtain consent where required.

Responding to enquiries

We use contact and correspondence information to respond to support requests, questions and other communications.

Our lawful basis may be performance of a contract, steps taken at your request before entering a contract, or our legitimate interest in communicating with merchants and prospective merchants.

Legal and regulatory purposes

We may process personal data where necessary to:

• comply with applicable law;
• respond to lawful requests;
• enforce our Terms of Service;
• prevent fraud or misuse;
• establish, exercise or defend legal claims.

Our lawful basis is compliance with legal obligations or our legitimate interests in protecting our legal rights, as applicable.

9. How we use merchant customer and storefront data

Where Motina acts as a processor for a merchant, we process data according to the merchant's instructions and our agreement with that merchant.

Processing may include:

• importing ecommerce data;
• measuring store and product performance;
• analysing inventory;
• analysing orders and refunds;
• measuring storefront behaviour;
• associating storefront sessions with subsequent orders;
• generating aggregated metrics;
• detecting trends, changes or anomalies;
• generating findings and opportunities;
• producing recommendations and supporting evidence;
• operating, maintaining and securing the Service;
• responding to merchant support requests relating to the Service.

The merchant, rather than Motina, is generally responsible for determining the lawful basis for this processing.

We do not use a merchant's customer data for our own independent advertising or marketing purposes.

10. Automated analysis and recommendations

Motina uses automated analytical processes to examine store information and generate findings, opportunities and recommendations.

These processes may identify patterns, trends or relationships within ecommerce and storefront data.

Motina's recommendations are intended to assist merchants with decisions about their stores.

Motina does not use this functionality to make solely automated decisions about individual customers that produce legal effects or similarly significant effects upon those individuals.

11. Aggregated and de-identified information

We may create statistical, aggregated or de-identified information from data processed through Motina.

Where information has been genuinely anonymised so that an individual is no longer identifiable, it is no longer personal data.

We may use aggregated or de-identified information to:

• understand how Motina performs;
• improve our analytics;
• develop the Service;
• understand general ecommerce trends;
• operate and secure Motina.

We do not attempt to re-identify information that has been genuinely anonymised.

12. Who we share information with

We do not sell merchant customer personal data.

We may disclose personal data to the following categories of recipient where necessary.

Service providers and sub-processors

We use third-party providers for functions including:

• cloud hosting and infrastructure;
• analytics and data warehousing;
• content delivery and network security;
• error monitoring and diagnostics;
• product analytics;
• email delivery;
• support and communications;
• website analytics;
• website forms.

Our current providers may include DigitalOcean, Tinybird, Resend, Cloudflare, Sentry, Mixpanel, Google and Formspree.

Where these providers process merchant customer data on our behalf, further information is available in our Sub-processor List.

Ecommerce platforms

We exchange information with Shopify and other supported ecommerce platforms as necessary to connect, authenticate and operate the Service.

Professional advisers

We may share information with professional advisers such as accountants, insurers, auditors or legal advisers where reasonably necessary.

Authorities and legal requirements

We may disclose information where reasonably necessary to:

• comply with law or a lawful request;
• respond to a court order;
• protect our rights or the rights of others;
• investigate fraud, abuse or security incidents.

Corporate transactions

If Motina or Yoghurt Pot Limited is involved in a merger, acquisition, restructuring, financing or sale of business or assets, relevant information may be disclosed to parties involved in that transaction subject to appropriate confidentiality and data-protection arrangements.

13. International processing and transfers

Yoghurt Pot Limited is established in the United Kingdom.

We aim to process core Motina service data within the United Kingdom and European Economic Area where reasonably practicable. For example, our analytics warehouse is currently operated in an AWS region in Ireland.

However, some of the service providers we use operate internationally or use sub-processors in other countries, including the United States.

Personal data may therefore be processed outside the country in which it was originally collected.

Where data-protection law restricts an international transfer, we use an appropriate legal mechanism where required.

Depending on the transfer, these safeguards may include:

• a finding or regulation recognising that the destination provides an adequate level of protection;
• approved Standard Contractual Clauses;
• the UK International Data Transfer Agreement;
• the UK Addendum to the EU Standard Contractual Clauses; or
• another transfer mechanism permitted by applicable law.

Where required, we also assess the circumstances of restricted transfers and any additional safeguards that may be appropriate.

Our Sub-processor List provides further information about the providers involved in delivering Motina.

14. How long we retain information

We do not intend to keep personal data indefinitely.

Retention depends on the type of information and the reason it is processed.

Ecommerce and analytics data

Our current principal retention periods are:

• order information: up to 2 years;
• refund information: up to 2 years;
• storefront analytics events: up to 2 years;
• derived daily product metrics: up to 2 years;
• customer-to-visitor associations used for analytics: up to 2 years;
• findings and recommendations: up to 2 years;
• products, variants and inventory state: while the merchant continues to use Motina, subject to the deletion process described below.

Some derived analytics, segments or projections are rebuilt from the underlying data rather than retained as a permanent historical record.

Technical information

Our current operational retention periods include:

• duplicate-delivery records: approximately 48 hours;
• authenticated merchant sessions: approximately 120 minutes.

Account, support and legal records

We retain merchant account, correspondence and business records only for as long as reasonably necessary for the purposes for which they were collected, including providing the Service, resolving disputes, maintaining appropriate business records and meeting applicable legal obligations.

Some records may therefore be retained after use of Motina has ended where there is a legitimate or legal reason to do so.

15. Uninstalling Motina and deleting store data

When a Shopify merchant uninstalls Motina:

• Motina's access token for the store is removed;
• monitoring and access to the store stop;
• the tenant is marked for deletion; and
• Motina's deletion process begins.

Shopify subsequently sends Motina a shop/redact privacy webhook following uninstall.

On receipt, we erase the merchant's applicable store data from our active application and analytics systems.

Deleted information may continue to exist temporarily within backups for up to 30 days, after which the relevant backup copies are rotated out.

Backup copies are retained for recovery and resilience purposes and are not used to continue normal processing after data has been deleted from active systems.

Certain information may be retained where required by law or reasonably necessary to establish, exercise or defend legal claims.

Ending a paid subscription without uninstalling Motina does not necessarily trigger the same immediate deletion process. Limited processing or access may continue temporarily in accordance with our Terms of Service and applicable retention policies.

16. Shopify privacy requests

Motina supports Shopify's mandatory privacy request mechanisms, including:

• customer data requests;
• customer deletion requests; and
• store deletion requests.

Where we receive a valid request relating to data we process on behalf of a merchant, we can identify and delete relevant customer information from our downstream systems where required.

17. Your data-protection rights

The rights available to you depend on where you live, the applicable law and the circumstances in which your information is processed.

Where Yoghurt Pot Limited acts as controller, you may have rights including:

• the right to obtain information about how your personal data is used;
• the right to access personal data we hold about you;
• the right to ask us to correct inaccurate information;
• the right to ask us to erase personal data in certain circumstances;
• the right to restrict certain processing;
• the right to object to processing based on legitimate interests;
• the right to data portability in certain circumstances;
• the right to withdraw consent where processing is based on consent;
• rights relating to certain automated decision-making.

These rights are not absolute and may be subject to conditions or exceptions under applicable law.

To make a privacy request concerning data for which Yoghurt Pot Limited is the controller, contact privacy@motina.co.uk.

We may need to verify your identity before fulfilling a request.

Customers of merchants using Motina

If you are a customer or visitor of a store that uses Motina and your request concerns information processed by Motina on that merchant's behalf, you should normally contact the merchant directly.

The merchant is generally the controller responsible for responding to your request.

We will assist merchants with valid data-protection requests as required by our Data Processing Addendum and applicable law.

If you contact us directly about a merchant's customer data, we may need to refer your request to the relevant merchant.

18. Complaints

If you have concerns about how Yoghurt Pot Limited uses your personal data, please contact us first at privacy@motina.co.uk.

If you are in the United Kingdom, you also have the right to complain to the Information Commissioner's Office (ICO), the UK's data-protection supervisory authority.

Information about making a complaint is available at ico.org.uk.

If another data-protection authority has jurisdiction over the processing, you may also have the right to complain to that authority.

19. Security

We use technical and organisational measures designed to protect personal data against unauthorised access, alteration, disclosure, loss or destruction.

These measures include, where appropriate:

• encryption of data in transit using HTTPS/TLS;
• infrastructure and storage security controls;
• access restrictions for production systems;
• key-based administrative access;
• encrypted Shopify access tokens;
• authentication and session controls;
• verification of Shopify webhook signatures;
• authentication and rate limiting for storefront event ingestion;
• backups and recovery processes;
• separation of development and production environments.

No internet-connected system can be guaranteed to be completely secure.

Further information about our security and data-handling practices is available in our Security & Data Practices documentation.

20. Cookies and similar technologies

Motina and our website may use cookies, local storage and similar technologies for purposes including:

• maintaining authenticated sessions;
• protecting the Service;
• remembering storefront visitor and session identifiers where permitted;
• measuring website usage.

Our storefront analytics identifiers are stored using browser local storage rather than Motina cookies.

More information, including the technologies currently used and their purposes, is available in our Cookie & Tracking Notice.

21. Children

Motina is a business service and is not directed at children.

We do not knowingly create Motina merchant accounts for children or intentionally collect children's personal data for our own independent purposes.

A merchant's storefront may be visited by people of different ages. Where Motina processes storefront or order data on a merchant's behalf, the merchant remains responsible for determining whether and how that processing is lawful.

22. Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect:

• changes to Motina;
• changes to the information we process;
• new service providers;
• legal or regulatory developments;
• improvements to our privacy practices.

The current version and effective date will be published on our website.

Where a change materially affects how we use personal data for our own purposes, we will take reasonable steps to bring the change to the attention of affected users where required.

23. Contact us

For privacy and data-protection enquiries:

Yoghurt Pot Limited
Company number: 12105928
45 Tameside
Stokesley
TS9 5PE
United Kingdom

Email: privacy@motina.co.uk
Website: motina.co.uk