Privacy is Part of Mālama.

Merchants & Brands

When a business signs up to use Mission Mālama, we collect the information needed to operate the service on their behalf, including:

• Business and account information
• Shopify shop and domain information
• Configuration and settings for how Mission Mālama runs on their store
• Subscription and billing status
• Impact and transaction information necessary to operate the service
• Communications and support information
• Security and operational logs

Customers

Mission Mālama currently requests and uses only two Shopify Protected Customer Data fields:

• Name
• Email

These may be used for impact attribution, to create or update a Keala impact profile, to track progress and history within that profile, to apply loyalty and reward benefits, and to connect eligible commerce activity with a customer's Mission Mālama experience.

Mission Mālama does not require a customer's phone number, physical address, payment-card details, or Shopify password to operate.

Automatically Collected Technical Information

Our systems automatically log operational and security information needed to keep Mission Mālama running reliably and securely. We don't operate a separate advertising-tracking or analytics system beyond what's described in Cookies & Similar Technologies, below.

Mission Mālama is built around a privacy-first checkout: whether a customer's activity is tied to an identifiable profile is their choice.

When a Customer Opts In

• Their name and email may be associated with the impact generated by that activity
• A Keala impact profile may be created or updated for them
• Eligible progress and rewards may be attributed to them

When a Customer Does Not Opt In

• The environmental impact of that activity may still count toward non-identifiable brand or community totals
• No identifiable Mission Mālama profile is created or updated from that event
• The impact event is stored without the customer's email
• No identifiable loyalty points are credited from that event

In short: opting in personalizes the experience; opting out still lets the impact count, just without attaching it to an identifiable profile.

We use the information described above only for specific, narrow purposes:

• Operate Mission Mālama
• Calculate and record environmental impact
• Provide Keala profiles and progress
• Provide loyalty and rewards
• Operate Kahua's merchant functionality
• Operate our Shopify integration
• Administer merchant subscriptions
• Protect the security and reliability of our systems
• Provide support
• Respond to lawful privacy requests
• Improve Mission Mālama's functionality

Mission Mālama does not sell personal information.

We work with a small number of infrastructure providers who process information on our behalf so we can operate Mission Mālama (see Service Providers & Subprocessors, below) — we don't consider this a sale. We do not currently use targeted advertising networks or data brokers; this policy will be updated if that changes.

Mission Mālama uses a 24-month inactivity retention period for identifiable customer information. After 24 months of inactivity:

• Identifiable customer information is removed or anonymized
• The customer's email is disassociated from retained impact events
• Identifiable loyalty and redemption records are removed where applicable
• The customer's personal-information record is removed

We may preserve non-identifiable impact and accounting records needed for environmental impact totals, accounting and system integrity, and transaction/idempotency protection — but these records are no longer associated with the identifiable individual.

Shopify requires public apps to support standardized privacy rights for personal data. Mission Mālama supports Shopify's privacy processes, including:

• Customer access requests
• Customer deletion/redaction requests
• Shop data deletion/redaction after uninstall, where required

These requests are handled through Shopify's standard privacy workflows. See Merchant Data Processing, below, for how this fits into the data we hold on a merchant's behalf.

This section is Mission Mālama's data-processing disclosure — how we process customer information on behalf of the merchants who use us.

Role

When a merchant uses Mission Mālama with Shopify, Mission Mālama processes certain customer information on that merchant's behalf to provide the Mission Mālama service.

Data Processed

Currently, this is limited to:

• Customer name
• Customer email
• Commerce and impact information needed to attribute and record eligible impact

Purpose Limitation

We process this data only to provide the Mission Mālama functionality a merchant has agreed to, along with related security, support, and legal requirements.

Customer Consent

See Customer Consent, above, for how a customer's own choice at checkout determines whether their name and email are attached to an identifiable profile.

Merchant Responsibilities

Merchants remain responsible for:

• Their own customer relationships
• Ensuring they have appropriate authority, notice, and consent to use Mission Mālama
• Complying with the laws that apply to their own business

Mission Mālama Responsibilities

In turn, Mission Mālama will:

• Process data only for providing the service and related legitimate operational purposes
• Apply reasonable security safeguards
• Respect verified privacy and deletion requests
• Apply the retention and anonymization policy described above
• Limit access to authorized systems and personnel
• Use service providers only as necessary to operate Mission Mālama

Privacy Requests

When a customer access, correction, or deletion request relates to data Mission Mālama holds on a merchant's behalf, we work with that merchant to resolve it.

Retention & Deletion

See Data Retention, above, and Shopify Privacy Requests for how the 24-month retention policy and Shopify's redaction lifecycle apply here.

Security

See Security, below, for the safeguards that apply to this data.

Service Providers

See Service Providers & Subprocessors, below.

Contact

Merchants can contact team@missionmalama.com with privacy or data-processing questions.

Mission Mālama relies on the following infrastructure and service providers to operate:

• Shopify — commerce integration and Shopify Billing
• Supabase — database/data infrastructure and encrypted backups
• Railway — backend application hosting
• Base44 — Kahua/Keala application infrastructure
• Stripe — impact-related invoicing/payment infrastructure, only where applicable

The Mission Mālama Shopify app subscription itself is billed and processed through Shopify Billing, not Stripe.

Each provider processes information only as needed to provide their respective infrastructure or service to us.

Caring for people also means protecting what they entrust to us.

Verified, reasonable safeguards currently in place include:

• Encryption in transit and at rest
• Encrypted, daily database backups
• MFA/2FA on critical infrastructure accounts
• Shopify HMAC/authenticity verification
• Brand/tenant data isolation
• Customer-data field allowlists
• Rate limiting on endpoints that return personal information
• Access logging for personal information and admin activity
• Individually identifiable, revocable admin tokens, stored as SHA-256 hashes
• Row-level security protecting our admin credential store
• 24-month inactivity retention and anonymization

We're continuing to strengthen these protections as Mission Mālama grows. No security system can guarantee absolute security, and we don't claim one that can — the safeguards above are reasonable measures, not a certification or a guarantee.

missionmalama.com does not set its own cookies to track visitors across other sites or build advertising profiles. Two things on this site involve outside technology:

• A third-party script from GoHighLevel (LeadConnector) supports this site's SEO — it may use cookies or similar technology as part of how it works, though we have not independently confirmed exactly what it stores or collects
• Journal posts that embed YouTube videos are provided by Google/YouTube, which may set their own cookies when a video is played, under Google's own privacy practices

If we confirm additional detail about what these technologies collect, or adopt analytics or advertising technologies beyond this, we'll update this section to describe them accurately.

Depending on applicable law, you may have rights to access, correct, delete, or restrict/object to how we process your information, and to learn more about that processing.

Privacy requests can be submitted to team@missionmalama.com. Shopify customers may also submit requests through the Shopify merchant/store where they made their purchase.

Mission Mālama is based in Honolulu, Hawaiʻi, United States. We don't currently maintain a dedicated section for any specific state or country's privacy law, since we haven't verified that a particular law currently applies to Mission Mālama.

Individuals may have additional privacy rights depending on where they live, and Mission Mālama will honor applicable privacy rights as required by law. Privacy questions or requests can be sent to team@missionmalama.com.

Mission Mālama is based in Honolulu, Hawaiʻi, United States, and information may be processed in the United States or other locations where our service providers operate.

We haven't verified that a specific international-transfer legal mechanism currently applies to Mission Mālama, so this policy doesn't claim one. We'll update this section if that changes.

Mission Mālama's services are not directed to children under 13.

Mission Mālama does not knowingly collect personal information directly from children under 13.

If Mission Mālama learns that personal information from a child under 13 was collected in circumstances requiring parental consent, we will take appropriate steps to delete or otherwise address that information as required by applicable law.

A parent or guardian who believes we may have received such information can contact team@missionmalama.com.

This Privacy Policy may evolve as Mission Mālama changes. When we make a material revision, we'll update the "Last Updated" date above and, where appropriate, provide additional notice.

For privacy requests, merchant privacy or data-processing questions, or any general question about this policy, reach us at team@missionmalama.com.

Mailing Address

Mission Mālama Corporation, 200 N Vineyard Blvd Ste A325 #1306, Honolulu, HI 96817, United States.