Privacy policy
Effective October 28, 2026
This explains what Mahj Clearly collects when you visit mahjclearly.com or buy from it, why we collect it, who else sees it, and what you can ask us to do about it.
We are based in Austria, so European data protection law (the GDPR) applies to everything below, wherever in the world you live. If you are in the United States, a section further down adds the rights your state gives you.
Who is responsible
Emanuel Chereji, sole trader (Einzelunternehmen), Hofmannsthalweg 20/1/4, 4030 Linz, Austria. Mahj Clearly is a trading name of that business, and that business is the controller of the personal data described here.
Email: support@mahjclearly.com. Full business details are in our Legal Notice.
We have no data protection officer, because the law does not require a business of this size to appoint one. Write to the address above and it reaches the person who decides.
The short version
To sell to you we need an email address and a payment. To learn whether our page and our advertising work, we measure what visitors do on our pages, and we tell Meta when a purchase happens. Nobody pays us for your data. We make no automated decisions about you that have legal or similarly significant effects. Every tool that touches your data is named below, by name.
What we collect
When you buy. Your name, email address, billing address, phone number if you give one, and what you ordered. Card details go straight to the payment processor. We never see them.
When you visit. Which pages you open and for how long, how far you scroll, which buttons and links you tap (never what you type into a field), page errors, how fast the page loads, and your device, browser, screen size and language. Your IP address: our analytics use it to work out an approximate country, region and city. If you arrived from an advertisement or an email, we also collect the campaign tags, ad identifiers and click identifiers (such as Meta's fbclid) in the link. If you use the practice trainer, we see which practice modes you open and whether your answers were right, so we can tell what is useful. Your practice settings and progress stay in your browser, on your device.
On your order. Shopify keeps the IP address and browser details of the device you order from, for fraud checks. When you check out, we also store on your order the anonymous analytics identifier of your visit, so we can tell which advertising works. We do not use it to identify you as a person on its own.
During and after checkout. The steps of your checkout, what you ordered, the order's number and value, and any discount code. Our analytics never receive your card details, phone number or billing address. When your order completes, they do receive your email address and keep it on your analytics profile, so we can tell which advertising led to a sale and answer you if you write to us.
Session replay. Our analytics tool may record a replay of your visit to our pages: how the page looked, where you scrolled, tapped and clicked. Everything you type into a form field is masked, and your checkout is never recorded.
When you sign up for emails. Your email address, and when and on which form you signed up, so we can send what you asked for and show that you asked.
When you get our marketing email. Whether and when you open it, and which of its links you tap.
When you write to us. Whatever you write and your email address.
On our Facebook Page. Your public profile name, with what you post on the Page or send us there (see "Our Facebook Page" below).
Why we collect it, and what allows us to
| What we do | Why we are allowed to |
|---|---|
| Take your order, deliver what you bought, honor the guarantee | Performing our contract with you (Art 6(1)(b) GDPR) |
| Answer your messages | Performing our contract, or our legitimate interest in running a business people can reach (Art 6(1)(b) and (f)) |
| Keep invoices and accounting records | A legal obligation on us under Austrian tax law (Art 6(1)(c)) |
| Measure how the page and checkout perform, and watch recorded visits to find what confuses people | Our legitimate interest in knowing whether the page works, which you can object to at any time (Art 6(1)(f)) |
| Measure our advertising and show it to people who may be interested | Our legitimate interest in knowing whether our advertising works, which you can object to at any time (Art 6(1)(f)) |
| Send you marketing email, and see whether it is opened and which links are tapped | Your consent (Art 6(1)(a)), which you can withdraw at any time |
| Run our Facebook Page, see its statistics and answer comments and messages there | Our legitimate interest in presenting Mahj Clearly on Facebook and answering the people who write to us (Art 6(1)(f)) |
| Keep our forms free of spam | Our legitimate interest in a site that works (Art 6(1)(f)) |
| Let Shopify use store data for its own network features (Shopify Network Intelligence) | Our legitimate interest in the store features that depend on it, which you can object to at any time by email (Art 6(1)(f)) |
Where we rely on legitimate interest, the interest is a plain commercial one: knowing whether the page and the advertising work, so that money is not spent on things that do not. We weighed that against your side of it. That is why we mask what you type, never record the checkout, do not build a profile of you as a named person, and let you object at any time. We sell only to customers in the United States and do not direct our advertising anywhere else.
Giving us your data is voluntary, but we cannot sell to you without an email address and a payment.
Who processes data for us
- Shopify International Limited, Ireland, runs the store, the checkout, the order records and the order emails. Shopify also uses this data, together with data from other stores and its own services, for its own analytics, personalization and advertising features (Shopify Network Intelligence). For that use Shopify is itself responsible, under its Consumer Privacy Policy (https://www.shopify.com/legal/privacy/consumers), and you can exercise your rights with Shopify at https://privacy.shopify.com. You can also object to this use by emailing us, and we pass your objection on to Shopify.
- Shopify Payments, executed by Stripe Technology Europe Limited, Ireland, takes the payment and checks it for fraud. If you pay with Shop Pay, Apple Pay, Google Pay or another wallet, its provider also handles the payment under its own privacy policy.
- Shopify Messaging sends the marketing emails you asked for.
- PostHog (PostHog, Inc., USA) provides the page and checkout analytics described above and stores them in the United States (PostHog US Cloud).
- Meta Platforms Ireland Limited handles advertising and hosts our Facebook Page. Meta is a special case and has its own section below.
Microsoft hosts the mailbox that receives your support email (Microsoft 365, provided through GoDaddy).
Anthropic (Anthropic Ireland, Limited, with processing by Anthropic PBC in the USA) provides Claude, the AI assistant we use to read your support emails, draft our replies and look up your order. Anthropic handles this data under its own privacy policy (https://www.anthropic.com/legal/privacy).
These providers act on our instructions and may not use your data for their own purposes, except as described above, Stripe for fraud prevention and its own legal duties, Microsoft for its limited business operations, and where a section below says otherwise.
Advertising, and the part where Meta and we are jointly responsible
A Meta pixel runs on our pages and reports page views, the products you look at, checkout steps and purchases. Our store also sends these events to Meta from its server (Meta's Conversions API), with scrambled (hashed) versions of your email address, name, phone number if you gave one, and billing city, state, ZIP code and country, together with your IP address and browser details, so Meta can match the sale to the advertisement you clicked. Meta can combine what its pixel collects here with what it knows about your activity elsewhere.
For that collection and transmission, Meta Platforms Ireland Limited and we are joint controllers under Art 26 GDPR. This is the essence of the arrangement between us, which we are required to make available to you:
- We are responsible for having a legal basis for collecting the data and sending it to Meta, for telling you about it (which is what this section does), and for making this summary available.
- Meta is responsible for its own security, for keeping records of the processing, and for handling your requests about the data once it has arrived.
- Once the data has reached Meta, what Meta does with it afterwards is Meta's own responsibility, not ours, and not covered by the joint arrangement.
- You can exercise your rights against either of us. Whichever of us you contact, the request is valid.
Meta's own description of its side is at facebook.com/legal/controller_addendum. You can change the advertising you see in your Facebook or Instagram settings, under Ads.
Under US state privacy laws, sending these events to Meta is targeted advertising (California calls it sharing for cross-context behavioral advertising). Because Meta gives us advertising measurement in return, some states may count it as a sale too, although no money changes hands. We treat it as both, and one opt-out covers both (see "If you are in the United States").
Our Facebook Page
Our Facebook Page, https://www.facebook.com/1366816579852209, and our ads on Facebook and Instagram run on Meta's platforms, under Meta's own privacy policy (https://www.facebook.com/privacy/policy). When you visit the Page, comment, or send us a message, Meta processes your data as that policy describes. We see your public profile name and what you write, and use it only to answer you and to moderate comments. Meta also gives us statistics about how people use the Page (Page Insights). They come to us only as totals and do not tell us who you are.
For Page Insights, Meta Platforms Ireland Limited and we are joint controllers under Art 26 GDPR. Meta has taken on the main responsibility for it, including telling you about it (https://www.facebook.com/legal/terms/information_about_page_insights_data) and answering your requests. Meta's side of the arrangement is at https://www.facebook.com/legal/terms/page_controller_addendum. If you write to us about it instead, we pass your request on to Meta.
Data leaving Europe
Some of the providers above are in, or send data to, the United States.
Where the European Commission has decided that a country, or a certified provider in it, protects personal data adequately (for example providers in the United States certified under the EU-US Data Privacy Framework), the transfer relies on that decision. Where it has not, the transfer relies on the European Commission's Standard Contractual Clauses, together with the extra technical and organizational measures the provider has in place.
Shopify is not certified under the Data Privacy Framework. Transfers to Shopify rely on the safeguards in Shopify's data processing terms: Standard Contractual Clauses or Shopify's binding corporate rules.
You are entitled to a copy of the safeguards we rely on. Email support@mahjclearly.com and we will send them to you.
How long we keep things
| What | How long | Why |
|---|---|---|
| Orders, invoices, accounting records | 7 years from the end of the year they relate to | Austrian tax law requires it (§ 132 BAO) |
| Analytics events | As long as we need them for the purposes above, then deleted or stripped of what identifies you, stored without your name | So we can see whether our pages and advertising work |
| Marketing subscription | Until you unsubscribe, plus a record afterwards that you did | So that unsubscribing actually works and we do not email you again by mistake |
| Support email | As long as needed to help you, and then for up to 3 years | So we can answer follow-up questions and show what was agreed about a refund |
Your rights
You can ask us for a copy of your data, to correct it, to delete it, to restrict what we do with it, to object to anything we do on the basis of legitimate interest, and to receive your data in a portable form. Where we rely on your consent, you can withdraw it at any time; doing so does not make anything we did before that unlawful.
Email support@mahjclearly.com. We answer within one month. There is no charge.
If you think we have got this wrong, you can complain to the Austrian data protection authority: Österreichische Datenschutzbehörde, Barichgasse 40-42, 1030 Vienna, Austria, dsb@dsb.gv.at. You can also complain to the authority where you live.
Cookies and similar technologies
Strictly necessary cookies keep your cart, your checkout and your session working. Our analytics and advertising tools (PostHog and the Meta pixel) also use cookies and similar browser storage, and they run from your first page. You can block or delete cookies in your browser settings; if you do, the cart and checkout may not work properly. To stop the advertising use, email us as described under "If you are in the United States". Browsers' older "Do Not Track" setting has no agreed meaning, so we do not act on it.
Marketing email
We only send marketing email to people who asked for it, by ticking the box at checkout (which is never ticked for you) or by signing up on a form. The order confirmation, which carries your access to what you bought, is not marketing and will reach you either way.
Our marketing emails are sent through Shopify Messaging, which records whether and when each email is opened (through a small image in it) and which of its links you tap. We use this to see which emails are useful. Turning off images in your email app stops the record of opens, though taps on links are still recorded.
Every marketing email carries an unsubscribe link and our postal address. Unsubscribing takes effect straight away, and in any event within 10 business days.
If you are in the United States
These rights come from state law and apply on top of everything above. Wherever you live in the United States, you have them.
We share personal information for targeted advertising. That is the Meta pixel and the server-side events described above, which we also treat as a possible sale. Nobody pays us money for personal information. We do not sell or share sensitive personal information, and we do not use personal information for profiling that leads to decisions with legal or similarly significant effects. We do not use personal data to train large language models, or sell or give it to anyone for that purpose.
You can opt out of targeted advertising, of any sale, and of profiling, by emailing support@mahjclearly.com with "Opt out" in the subject line. You can also turn off personalized ads in your Facebook and Instagram ad settings. When you opt out, we stop sending your events to Meta and stop recording your visits, and we delete the analytics data we can link to you.
You can also ask for a copy of the data we hold about you, ask us to correct it, and ask us to delete it. We will check that the request comes from you, for example by matching it to the email address on your order, and answer within 45 days. You may use an authorized agent, and if we decline a request we will tell you why. Put "Privacy request" in the subject line. If we say no, you can appeal by replying to that answer, and we will respond to the appeal within 60 days.
Exercising any of these rights costs nothing, and we will not treat you differently for it.
Security
We use Shopify's secure checkout and limit who can see the information we hold. No system is perfectly secure, so we cannot promise absolute security. We may also share information if the law requires it, to protect our rights, or if the business is sold or merged.
Children
Mahj Clearly sells to adults. We do not knowingly collect data from anyone under 16, and we have no reason to. If you believe a child has given us data, email support@mahjclearly.com and we will delete it.
Changes to this policy
If we change it, the new version appears here with a new effective date. Changes apply going forward. They do not change what we already agreed with you about a purchase you have already made.
Mahj Clearly is a trading name of Emanuel Chereji, Hofmannsthalweg 20/1/4, 4030 Linz, Austria. Full business details are in our Legal Notice.