Data flows & storage

This is an overview of data flows between Mapp Fashion, the retailer, and various technology partners. Depending on the service level, not all of these will apply.

Retailer to Mapp Fashion

Retailers collect & provide multiple types of data to Mapp Fashion as files that are transferred periodically.

Product Feed

The retailer provides a Product Feed. This information is effectively public (i.e., it could be scraped from the website). Although we stored it encrypted at rest, it is not always protected in transit.

Transaction Data

This is information about items purchased via the retailer. This generally includes:

• Information about items bought

• A user identifier of some sort (for example, a SHA256 hash of an email address or account ID)

• Occasionally, information such as name

In general, this is transaction data for all the retailer’s customers. The retailers usually try to filter this to only products relevant to us (e.g., Womenswear or, if supported, Menswear).

Method of transfer

We provide access to an S3 bucket where files can be uploaded. The policy only allows HTTPS connections and enforces encryption at rest. Alternatively, we can provide SFTP credentials or poll for files on an SFTP server provided by the retailer.

Unsubscribe Data

For retailers using our style quiz with login, retailers can send us a list of users who have indicated to the retailer that they no longer wish to receive emails from the retailer. This list may include email addresses that we do not know. We mark all these users as opted out (if known to us). We can also receive this data in real time via an API.

Event Tracking

Retailers may send Mapp Fashion the following events to aid personalization and analysis. These are stored against non-PII identifiers like a UUID or retailer's customer database number.

• Information about products viewed or interacted with (liked, scanned, added to wishlist)

• Purchase data

• The user’s current location

Browser to Mapp Fashion

Tracking Data

The retailers place our JavaScript on their pages. This JavaScript captures information such as which pages users have viewed or what items they have ordered. The captured information does not, in general, include Personal Data; however, it contains enough for us to link to personal data that we do hold.

In general, tracking data is collected for all users.

Mapp FashionWebsites & Mobile Application

The Mapp Fashion-operated websites and mobile capture a range of data. This includes Mapp Fashion content embedded within the retailer's site (hub pages, widgets).

Quiz Answers

For retailers who use our quiz product, our web pages allow users to enter answers to quiz questions. If the user starts the signup process, then we store their answers

Usage Data

We may also capture interactions performed by the user, such as:

• Liking/disliking items

• Adding items to a wishlist

• Scanning items

• Location

If users complete a Mapp Fashion signup, we may capture extra preferences from them (e.g., verdicts and updates to quiz data).

Mapp Fashion to Retailer

We send data to retailers in some circumstances.

Signup Data

For retailers using the quiz product, on request we will send retailers a list of email addresses that have completed signup, along with opt-in information and first name. Extra user information is included as agreed.

This information is transferred either:

• Via an API provided by the retailer

• Files sent to the retailer

Subscription Data

For retailers who have integrated with the quiz, we can collect non-Mapp Fashion opt-in preferences (i.e., opt-in to the retailer’s existing marketing scheme).

API Integrations

If the retailer integrates with Mapp Fashion via a server API Integration, then information that would normally be displayed directly in the customer’s browser/app (such as recommended items and outfits) are sent via the retailer’s servers.

Retailer Email Provider

We send information to the retailer’s email provider. In some cases, we send information directly to this provider, and in other cases, we send it to the retailer to later pass on to the email provider.

Subscription Data

We provide APIs to pass through any opt-ins or opt-outs we have collected. Opt-ins usually contain first name.

Campaign Data

For retailers using our quiz, we send our email provider lists of email addresses, first names, and details of recommended products. For those not using the quiz, we send recommendations against an identifier instead.This information is used to send the customer the Weekly Themed Emails.

Transaction Email Data

When the user completes certain actions (sign in, sign up, request password reset), we send the user’s email address to the email provider, to send the user the corresponding email.

Sign up data

Instead of being provided to the retailer, the sign-up data is sometimes provided directly to the retailer's email provider. This can trigger actions such as sending a welcome email or adding the user to a subscription list (when consent is given).

Mapp Fashion to Messaging providers

Mapp Fashion uses a range of providers to send messages to end users. In general, we send the provider information about what to send, and they may send us data about how the sent message was processed and interacted with

SendGrid

When emails are managed directly by us (this can either be transaction emails, weekly style emails, or both), we use SendGrid to send emails. SendGrid is a US-based provider.

We generate email messages and transmit them to SendGrid for delivery. The emails always contain the user’s email address and first name.

When emails are delivered by Sendgrid, they send tracking data back to Mapp Fashion when:

• A user opens an email

• A user clicks on a link in the email

• Retailer Mobile applications

• Retailer mobile applications may embed portions of the retailer’s website or the Mapp Fashion website, in which case data is collected as with  the customer’s browser.

Firebase Cloud Messaging

We use Firebase cloud messaging to send notifications to users of Mapp Fashion mobile applications, assuming they have opted into this.