Legal
What Mobispark collects, what the app accesses in a merchant's store, and how long any of it is kept.
Last updated: 9 September 2026
Mobispark is built and operated by The Onyx Grid, the e-commerce software studio of BNB INVEST FZE. BNB INVEST FZE is the data controller for data collected through this website, and acts as a processor for merchant and shopper data handled by the Mobispark app. Contact support@theonyxgrid.com.
If you submit the demo request form, we collect your name, email address, store domain, the number of stores you run and any message you write, plus the IP address and user agent of the submission to prevent spam. We use these only to respond to your request.
We do not run advertising cookies or third-party behavioural tracking on this website, and we do not sell personal data. Demo requests are kept for 24 months from your last contact with us.
When a merchant installs Mobispark, the app requests the minimum Shopify API scopes it needs to function: reading products, collections, content and themes, and writing files. It uses this to build the mobile app's content, and it uploads images into the merchant's own Shopify Files rather than storage we control.
Mobispark stores the app configuration a merchant creates, published version history, mobile device push tokens and push campaign records. It does not copy the product catalogue or customer records into its own database.
The mobile app reads published configuration from a public endpoint that contains no personal data. Where a shopper enables push notifications, the app registers a device token so campaigns can be delivered; where a merchant uses location-triggered notifications, the geofence is evaluated on the shopper's device against coordinates published in the configuration. Push delivery goes through Expo's push service.
Mobispark honours Shopify's mandatory privacy webhooks for customer data requests, customer redaction and shop redaction. Store data is deleted within 30 days of uninstall unless a longer period is required by law. Device tokens are removed when they stop being valid.
Data is encrypted in transit using TLS and at rest by our providers. Credentials are held in managed secret storage, access is limited to personnel who need it, and changes go through code review. Draft configuration is only reachable with a secret preview token.
Subject to applicable law you may request access to your personal data, its correction or deletion, or object to our use of it. Write to support@theonyxgrid.com and we will respond within 30 days. Shoppers should contact the merchant whose app they are using in the first instance, since that merchant is the controller of their data.
We may update this policy as the product or the law changes. The date above shows when it was last revised.