Privacy policy
Last updated: 28 September 2026
This policy explains what personal data we collect when you visit or buy from MemeJunx (memejunx.com) or YepThatsMe (yepthatsme.shop), including our company website and Shopify checkout at maxmirgroup.com, why we collect it, and what you can do about it. Both are brands of MaxMir Group Ltd.
1. Who is responsible for your data
The controller of your personal data is:
MaxMir Group Ltd
1053 Budapest, Kecskeméti utca 13, Hungary
Email: support@maxmirgroup.com
We are based in the EU, so we handle everyone's data under the EU General Data Protection Regulation (GDPR), wherever you live.
2. What we collect and why
When you place an order
- What: your name, email address, phone number, delivery and billing address, the items you ordered, and the amounts paid. Payment is processed by Shopify and its payment providers. We receive confirmation of payment and limited details such as the card type and last four digits, never your full card number.
- Why: to take your order, have it produced and delivered, send you order and shipping emails, handle returns and complaints, and keep the accounting records the law requires.
- Legal basis: performing our contract with you (Art. 6(1)(b) GDPR) and complying with legal obligations such as tax and accounting law (Art. 6(1)(c)).
When you contact us
- What: your messages, your email address, and any details you give us.
- Why: to answer you and resolve your request.
- Legal basis: performing our contract, or our legitimate interest in answering enquiries (Art. 6(1)(b) and (f)).
When you browse our sites
- Country: our hosting providers derive an approximate country from your IP address. Our storefront reads the country code to show appropriate prices, currency and delivery options; the country-preference cookie stores a country code, not your IP address. Hosting, security and permitted analytics or advertising services may separately process your IP address.
- Your preferences and basket: we store the country you choose and your basket in cookies (see section 5).
- Legal basis: providing the basket and checkout is necessary to perform our contract or take steps at your request (Art. 6(1)(b)); operational security is based on our legitimate interest in keeping the service secure (Art. 6(1)(f)).
Where we use analytics and advertising tools
Whether we use any optional analytics or advertising tools depends on where you are browsing from, as determined by our hosting provider from your IP address. Choosing a different shopping country or currency does not change this.
- In the United States (the market where we have assessed these tools for use without consent): we use the tools described below, unless you switch them off in Privacy settings (linked at the bottom of our pages), your browser sends a Global Privacy Control signal, or you have objected (section 7).
- In the EU, the EEA, the UK and Switzerland: we use them only with your consent. A banner asks you when you first visit; you can accept or reject analytics and advertising separately, and nothing optional runs until you choose. You can change or withdraw your choice at any time in Privacy settings. If your browser sends Global Privacy Control, we treat that as no and do not ask.
- Everywhere else, and whenever we cannot determine your location: we do not use usage analytics, advertising pixels or campaign attribution, and we do not store any optional identifiers in your browser. Only the essential basket, country-preference and privacy-choice cookies are used.
We check your choice again when you go to checkout, and again before any purchase event is sent, so a change made after you started shopping is respected. Withdrawing a choice also removes the related identifiers from your browser. You can shop in full whatever you choose.
Usage analytics
- What: we use PostHog to understand how our sites are used: pages viewed, the searches you make on our sites, products opened, basket activity and purchases, including order identifiers, value and currency. Please do not enter personal or sensitive information into product searches. Data can include a browser identifier, referring websites or campaigns, device and browser information and IP-derived location. Routing PostHog requests through our domain does not prevent PostHog from receiving the data.
- What we don't collect: we do not record sessions or automatically capture clicks, and we remove search terms from page addresses before they are sent to analytics.
- Purchases: a purchase is sent to analytics only if analytics still applied to you when you went to checkout, and you have not objected since.
-
Campaign tags: if you arrived through one of our ad links, its campaign tags (
utm_parameters such as the campaign name and campaign ID) are kept in the page's memory while you browse and recorded with your basket and order, so we can see which campaigns lead to sales. Tags older than 30 days are ignored. - Legal basis: in the EU, the EEA, the UK and Switzerland, your consent (Art. 6(1)(a)); in the United States, our legitimate interest in understanding and improving our store (Art. 6(1)(f)), which you can object to at any time (section 7).
Advertising and measuring our ads
- Where you came from: we store campaign tags and ad click identifiers in your browser for 30 days, and attach them to your basket and order to measure which campaigns lead to purchases and so the ad platforms can match a purchase to an ad click. Browser retention and order-record retention are separate (sections 5–6).
- Meta (Facebook/Instagram) and TikTok: where these tools are enabled, browser pixels and server-side events measure visits, product views, additions to the basket, checkout starts and purchases. Depending on the event and provider, data includes product and order identifiers, value and currency, IP address, browser information, referring page, ad click and browser identifiers, and customer-matching data such as email address, phone number, city, postcode and country. Matching fields are hashed where the provider requires it. Hashing is pseudonymisation, not anonymisation: the provider may match these identifiers to its users.
- Regional restrictions: as set out above, none of this applies without your advertising consent in the EU/EEA, UK or Switzerland, outside the markets listed above, to visitors whose location we cannot determine, to browsers sending Global Privacy Control, or to anyone who has switched it off or objected. Purchase events for orders delivered to the EU/EEA, UK or Switzerland are sent only with advertising consent.
- Legal basis: in the EU, the EEA, the UK and Switzerland, your consent (Art. 6(1)(a)); in the United States, our legitimate interest in measuring our advertising (Art. 6(1)(f)), which you can object to at any time (section 7). Marketing email consent is separate.
Marketing emails
If you opt in at checkout, we send you emails about new designs and offers. You can unsubscribe at any time with the link in every email.
- Legal basis: your consent (Art. 6(1)(a)).
3. Who we share it with
We disclose data to the providers below as needed for the purposes described in this policy. Their roles vary: some act on our instructions as processors, while payment, platform and advertising providers may also act as independent controllers for their own purposes, as described in their privacy notices.
| Provider | What they do for us |
|---|---|
| Shopify | Store platform, checkout, payments, order emails |
| Payment providers (through Shopify) | Processing your payment |
| Printful | Producing and shipping your items (gets your name, delivery address and contact details) |
| Shipping carriers | Delivering your parcel |
| Vercel | Hosting our websites |
| Cloudflare | Content delivery and file storage |
| Neon | Database holding our order-processing records |
| PostHog | Usage analytics, where it applies (see section 2) |
| Meta, TikTok | Ad measurement, where it applies (see section 2) |
We may also disclose data where the law requires it, for example to tax authorities or courts. We do not sell personal data for money. Advertising disclosures may nevertheless qualify as a sale, sharing or targeted advertising under some US state laws (section 8).
4. International transfers
Some providers may process data outside the EEA. Transfers must have an applicable legal safeguard, such as an adequacy decision covering the recipient or European Commission Standard Contractual Clauses with any necessary supplementary safeguards. The EU–US Data Privacy Framework applies only to recipients with an active certification covering the relevant data; it does not cover every US provider. You can contact us for information about the safeguards relevant to your data and how to obtain a copy.
5. Cookies and browser storage
| Name | What it's for | How long |
|---|---|---|
cart |
Remembers your basket | 30 days |
buyer_country |
Remembers the country you chose | 1 year |
consent |
Remembers your privacy choices (analytics, advertising) and when you made them | 6 months, then we ask again |
attribution (local storage) |
Campaign measurement — only where advertising applies (section 2) | Used for 30 days, then deleted on your next visit |
PostHog (ph_… cookies and/or browser storage) |
Usage analytics — only where analytics applies (section 2) | Set by PostHog — see its cookie policy |
Meta / TikTok (including _fbp, _fbc, _ttp where set) |
Ad measurement — only where advertising applies (section 2) | Set by the provider — see its cookie policy |
The cart, buyer_country and consent cookies are essential: they provide the basket, the country you asked for, and the privacy choices you made. The other entries are only set where section 2 says these tools apply to you. Local storage has no built-in expiry, so the 30-day attribution entry is removed the next time you visit after it expires.
Shopify sets its own cookies on the company website and checkout pages; see Shopify's cookie policy. You can also clear or block storage through your browser settings, although blocking essential cookies can stop the basket from working.
6. How long we keep it
- Accounting documents subject to Hungarian retention requirements: retained for the applicable statutory period, generally at least 8 years. This does not mean every browsing identifier or piece of order metadata needs to be kept for 8 years.
- Customer service and complaint records: kept for the period required to resolve the request, meet complaint-record obligations and establish or defend legal claims.
- Analytics events and identifiers: kept only as long as needed to analyse how our store is used, then deleted.
- Advertising and attribution records: browser attribution is used for 30 days.
- Marketing lists and consent evidence: marketing stops when you unsubscribe. Limited consent evidence and suppression records may be retained to demonstrate compliance and avoid contacting you again.
- Security logs, backups and legal holds:
7. Your rights
You have the right to:
- access your data and get a copy;
- correct inaccurate data;
- delete your data, where we have no legal reason to keep it (order records we must keep for accounting stay until that period ends);
- restrict or object to our processing, including processing based on legitimate interest, and object to any use of your data for marketing at any time;
- data portability, for data you gave us;
- withdraw consent (for example to marketing emails) at any time, without affecting what happened before.
To withdraw consent or object to analytics and advertising while you browse, use Privacy settings at the bottom of our pages, or enable Global Privacy Control in your browser (section 2); we then stop using those tools for you. You can also object by email: we record your objection against your email address, and no analytics or advertising purchase events are sent for orders placed with that address from then on. Email support@maxmirgroup.com to use any of these rights, including to object or to ask us to delete data already collected. Rights apply subject to the conditions and exceptions in applicable law; portability generally applies to data you provided that we process automatically on the basis of consent or a contract. We may request proportionate information to verify your identity. We normally respond within one month; where legally permitted for complex or numerous requests, we may extend by up to two further months and explain the extension within the first month.
You can also complain to a data protection authority. Ours is the Hungarian National Authority for Data Protection and Freedom of Information (NAIH, 1055 Budapest, Falk Miksa utca 9–11, ugyfelszolgalat@naih.hu, naih.hu). You can also go to the authority in your own country.
8. If you live in the United States
We do not sell personal information for money. Advertising disclosures may be considered a sale, sharing or targeted advertising under applicable state laws. Where these laws apply, you may have rights to access, correct, delete or obtain a copy of your information and to opt out of sale, sharing or targeted advertising. To opt out while you browse, switch analytics and advertising off in Privacy settings at the bottom of our pages, or enable Global Privacy Control in your browser: we honour both for all our analytics and advertising tools. You can also email support@maxmirgroup.com with the subject "Privacy request." We will not discriminate against you for exercising applicable privacy rights.
9. Children
Our sites are not directed at children under 16, and we don't knowingly collect their data. If you think a child has given us personal data, contact us and we'll delete it.
10. Security
We use encrypted connections, access controls, and providers with strong security practices. No system is completely secure, but we work to protect your data and limit who can access it.
11. Changes
We may update this policy. The date at the top shows when it last changed. If a change significantly affects how we use your data, we'll tell you on our sites or by email.
12. Contact
support@maxmirgroup.com · MaxMir Group Ltd, 1053 Budapest, Kecskeméti utca 13, Hungary