Roles
For shopper data captured by a quiz, the merchant is the data controller and Mica acts as processor on their documented instructions.
Scope of processing
Mica processes shopper answers and contact details to run the merchant's quiz, show them reporting, and deliver leads to the destinations the merchant configures.
Sub-processors
Railway: hosting and the Postgres database.
GitHub: stores an encrypted copy of the database each night, kept for 30 days.
Anthropic: writes quizzes from the store's product catalog, and answers report questions from aggregated counts that contain no shopper contact details.
Google: generates images from the merchant's text and any image they supply.
Klaviyo: receives leads when the merchant connects their own account.
Omnisend, Mailchimp and Brevo: receive leads when the merchant connects their own account.
A current list with each party's role is available on request.
Security and deletion
Every query is scoped to a single store, and data is not shared between merchants.
Connections to the app use HTTPS, the app reaches its database over Railway's encrypted private network, Klaviyo access tokens, Omnisend, Mailchimp and Brevo API keys and webhook signing secrets are stored encrypted, and nightly database backups are encrypted before they leave Railway.
Each time staff view or export leads in the app, Mica logs the store, the Shopify staff user and the time.
These are the processor terms
This page is the data processing agreement between the merchant and Mica. Installing the app accepts it, and a merchant who needs a signed copy can ask for one.
Merchants write to support@micapopups.com for anything in this section.
Effective 20 September 2026.
Instructions, duration and staff
Mica processes shopper data only to run the app for that merchant, and on the merchant's instructions. Configuring a quiz, connecting Klaviyo, Omnisend, Mailchimp, Brevo or a webhook, and exporting leads are those instructions.
Processing lasts as long as the app is installed, plus the deletion windows in the privacy policy.
Only the operator of Mica can access merchant data, and only to run and support the service.
Changing a sub-processor
Merchants are told by email before a new sub-processor starts handling shopper data, and can object by replying. A merchant who objects and cannot be accommodated may uninstall and have their data deleted.
Helping with requests and incidents
Shopify's data request webhooks are answered automatically: a shopper request appears on the merchant's Leads page with everything Mica holds about that shopper, and a deletion request removes it.
If Mica learns of a breach affecting a merchant's shopper data, it tells that merchant without undue delay and describes what happened, what was affected and what was done.
Mica gives merchants the information needed to show this processing is compliant, and supports the audit rights the law gives them.
Transfers out of the EEA and the UK
Data is processed in the United States. Where a transfer needs a safeguard, it relies on the Standard Contractual Clauses, and the sub-processors above are engaged on the same basis.
Getting the data back, and deletion
Leads can be exported as CSV from the app at any time, including before uninstalling.
After uninstall the store's data is deleted when Shopify sends its shop deletion request, and backups age out within 30 days.