Privacy Policy

Last updated: 14 August 2026

This policy explains what the Drawly app («the app») accesses, what it stores, and for how long. The app is operated by Mveb. For any question about this policy, write to the address at the bottom of this page.

What the app stores

The app runs giveaways, so it does store personal data — and it is important to be precise about which:

• Entrant details: the email address the entrant submits, and their name if the merchant asks for one. This is what a giveaway is made of — without it there is no way to contact a winner.
• Tickets and their reasons: which entry, order or referral each ticket came from, so the merchant can explain any entrant’s ticket count.
• Anti-fraud markers: a random label the entrant’s own browser keeps for itself, stored by us only as a salted, irreversible hash, plus a hash of the connecting address. Neither can be turned back into an identity. They exist for one purpose: telling «same device» from «different device» when the merchant limits entries per device.
• Marketing consent: whether the entrant ticked the optional box. Entry never depends on it.
• Draw records: the seed and a hash of the ticket list, so a completed draw can be verified later.
• Store session: the store domain and the access token issued by Shopify, required to call the Shopify API on the merchant’s behalf.

The app never sees or stores card numbers, addresses or order contents. Orders are read from Shopify to award tickets and are not copied into our database.

Who owns entrant data

Entrant data belongs to the merchant. The merchant is the data controller; the app is the data processor and handles that data only to run the giveaway. Merchants can export their entrants to CSV at any time, on every plan, and can delete an entrant or an entire giveaway from the app at any moment.

Emails to entrants

The app sends at most three emails to an entrant: a confirmation when they enter, a notification if they win, and one message when the giveaway ends telling them the winner has been drawn. Nothing else is ever sent to them — no digests, no marketing, no reminders. Emails are sent from the app’s own infrastructure under the merchant’s name, with replies going to the merchant.

Sharing

No data is sold, rented or shared with third parties. The app uses no advertising networks and no analytics that identify individuals. Email delivery is performed by our email provider, which processes the recipient address solely to deliver that message.

Retention and deletion

Entrants are kept for as long as the merchant chooses. The default is to keep them: they are the merchant’s contacts, and finished giveaways stay open so that a draw can still be checked months later. A merchant can switch on automatic deletion 90, 180 or 365 days after a giveaway ends.

Service records — the email log and the background job queue — are deleted automatically after 90 days.

When the app is uninstalled, the store session is deleted. Shopify also sends mandatory deletion requests 48 hours after uninstall (shop/redact), and on receipt the app deletes everything belonging to that store: giveaways, entrants, tickets, draw records, winners, the email log and settings.

Customer deletion requests (customers/redact) delete the matching entrant together with their tickets, winner record and email log. Data requests (customers/data_request) are answered with everything the app holds about that person, passed to the merchant to forward on.

Security

All traffic runs over TLS; the app is served only over HTTPS. Entries submitted from a storefront are signed by Shopify and the signature is verified before anything is written.

Entrant email addresses and names are encrypted in the database with AES-256-GCM. Search and duplicate checks run on a keyed fingerprint of the address, not on the address itself, so a copy of the database file does not reveal who took part. On top of that the app runs on Google Compute Engine, where disk storage is encrypted at rest by the platform. Database backups are written to the same encrypted disk, never copied off it, and rotated after 14 days. Access to the production server is limited to the app operator over SSH key authentication only; password login is disabled. Development uses a separate local database, and production data is never copied into it.

Data processing agreement

For personal data belonging to entrants and customers, the merchant is the data controller and the app is the data processor. By installing the app the merchant accepts this policy as the data processing agreement between us. The app processes that data only to provide the functionality described above, only on the merchant’s instructions, and engages no sub-processors other than the hosting and email providers named here. A merchant who needs a separately signed agreement can request one at the address below.

Giveaway law

Giveaways, contests and sweepstakes are regulated differently in different countries and states. The merchant is the organiser and is responsible for their own official rules and for compliance with local law. The app provides a field for those rules and shows them on the entry form; it does not give legal advice.

Security incidents

If personal data is exposed or lost, affected merchants are notified by email within 72 hours of discovery, together with what happened, what data was involved and what was done about it. Shopify is notified in parallel. Access is revoked and credentials rotated first, before any investigation continues.

Contact

Questions, data requests and complaints: support@mveb.org. We reply within two business days.