Privacy Policy

Last updated: August 4, 2026

This Privacy Policy is issued by Matrix Horizon Limited, trading as MYRO (Omar Hodge Building, 4th Floor, Unit 3a, 325 Waterfront Drive, Road Town, Tortola VG1110, British Virgin Islands) (referred to as "MYRO", "we", "us", or "our").

MYRO operates this store and website, including all related information, content, features, tools, products, and services, in order to provide you, the customer, with a curated shopping experience (the "Services"). MYRO is powered by Shopify, which enables us to provide the Services to you. For the purpose of applicable data protection laws, including the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, Matrix Horizon Limited, trading as MYRO, is the data controller responsible for your personal information.

Please read this Privacy Policy carefully. By using and accessing any of the Services, you acknowledge that you have read and understood the collection, use, and disclosure of your information as described in this Privacy Policy.

1. Personal Information We Collect or Process

When we use the term "personal information," we refer to information that identifies or can reasonably be linked to you or another person. Depending on how you interact with our Services, we collect and process the following categories of personal information:

  • Contact & Identity Details: Your name, billing address, shipping address, phone number (+44 or international), email address, and date of birth (collected specifically for mandatory age verification).

  • Financial & Payment Information: Payment method, transaction history, and payment confirmations. (Note: Payment details are processed securely via Shopify Payments; MYRO does not store full credit/debit card numbers).

  • Account Information: Email address, username, authentication credentials, preferences, and account settings.

  • Transaction & Purchase History: Products viewed, items added to cart or wishlist, purchase history, returns, exchanges, and cancellations.

  • Hardware & Device Binding Data (SPACE Linking): 14-digit SPACE device serial/anti-counterfeiting codes, device activation timestamps, warranty status, loyalty points balance, and flavor unlocked badges.

  • Communications & Customer Support Records: Information you provide when contacting customer support, submitting an inquiry via our contact forms, using live chat (powered by Chatty), or interacting with our AI features.

  • MYRO AI Prompts & Queries: Free-text inputs submitted to MYRO AI prompts. (Notice: Please do not enter payment-card details, identity documents, health information, or other unnecessary sensitive personal information into AI fields).

  • Technical & Usage Information: IP address, device type, browser details, network connection, unique identifiers, and interaction logs.

  • Marketing & Preference Data: Email marketing subscription preferences, opt-in timestamps, referral codes (GxGx data), and campaign interaction history.

2. How We Collect Personal Information

We collect personal information from the following sources:

  • Directly from you: When you create an account, complete age verification, place an order, bind a SPACE device, submit a customer support form, query MYRO AI, or subscribe to our newsletter.

  • Automatically through the Services: Via your device when you browse our website, using cookies and similar access technologies (strictly subject to your choices via our Cookie Banner).

  • From Service Providers & Third Parties: Including authorized age verification service providers, identity authentication services (Shopify), customer service system providers, and logistics partners.

3. Purposes, Lawful Bases, and Retention Periods

Under UK GDPR, we process your personal information under specific lawful bases. Below is a breakdown of our processing activities, lawful bases, and actual retention periods:

  • Order Processing & Delivery

    • Data Processed: Contact, Financial, Transaction, and Shipping details.

    • Lawful Basis: Contract Performance (Executing your order).

    • Retention Period: Retained for 6 years following transaction completion to comply with UK tax, statutory accounting, and legal requirements.

  • Mandatory Age Verification (18+)

    • Data Processed: Name, address, date of birth, and verification status log.

    • Lawful Basis: Legal Obligation (UK legislation prohibiting sales of nicotine products to minors).

    • Right to Appeal/Review: Age verification is partially automated. If your verification fails automatically, you have the right to request a manual review by contacting customer support at info@myro.global.

    • Retention Period: Verification status logs retained for 7 years for regulatory audit purposes. Raw identity verification documents are purged immediately after check.

  • Account Management & Authentication

    • Data Processed: Email address, account credentials, and login timestamps.

    • Lawful Basis: Contract Performance (Providing user account features).

    • Retention Period: Duration of active account lifecycle. Account profile details are deleted within 30 days following an account closure request (excluding transactional records required by law for 6 years).

  • Customer Support & Service Enquiries

    • Data Processed: Name, email address, order details, and support messages.

    • Lawful Basis: Legitimate Interests (Resolving customer enquiries and maintaining service records).

    • Retention Period: Support tickets and logs retained for 24 months from ticket closure.

  • MYRO AI Feature

    • Data Processed: Free-text prompts and queries.

    • Lawful Basis: Contract Performance (Providing interactive assistance requested by the user).

    • Retention Period: Prompts are processed temporarily and auto-deleted within 30 days. Prompts are not used for public AI model training.

  • Hardware Binding & Warranty (SPACE)

    • Data Processed: 14-digit device code, activation date, and account ID.

    • Lawful Basis: Contract Performance (Honoring 365-day warranty & CRM benefits).

    • Retention Period: Duration of active product warranty + 12 months.

  • Email Marketing & Newsletters

    • Data Processed: Name, email address, and marketing opt-in logs.

    • Lawful Basis: Consent (Clear, active opt-in).

    • Retention Period: Retained until consent is withdrawn via the unsubscribe link in any marketing email.

  • Analytics & Site Optimization

    • Data Processed: Device info, IP address, usage data, and analytics cookies.

    • Lawful Basis: Consent (Obtained via Cookie Banner).

    • Retention Period: Retained up to 12 months maximum for analytics cookies, matching technical settings.

4. How We Disclose Personal Information

We disclose your personal information only for legitimate operational, contractual, or legal purposes:

  • Shopify: Our core e-commerce platform host, authentication service provider, and checkout infrastructure processor.

  • Age Assurance Partners: Authorized UK third-party age verification service providers to verify that customers are 18+ prior to purchase.

  • IT, Communications & Service Providers: Third-party cloud providers, email marketing services (Klaviyo), customer chat systems (Chatty), search & review tools (Algolia, Judge.me), store locator services (Google Maps), and support ticket systems.

  • Logistics & Fulfillment Partners: Postal couriers and UK fulfillment warehouses.

  • Corporate Transactions: Corporate affiliates or in connection with a merger, acquisition, or restructuring.

  • Legal & Regulatory Compliance: To comply with valid legal obligations, subpoenas, or requests from UK law enforcement or regulatory authorities.

5. Cookies and Access Technologies

We use necessary storage technologies to operate and secure this site. With your explicit consent, we also use optional analytics and advertising technologies.

  • Strictly Necessary Cookies: Essential for navigation, cart functionality, security, and age gate status memory. Prior consent is not required.

  • Optional Analytics & Marketing Cookies: Used to measure site usage and deliver relevant advertising. These are blocked by default until you grant explicit consent via our Cookie Banner.

Managing Preference: You can update or withdraw your consent at any time by clicking the "Cookie Settings" link located in our website footer.

6. International Data Transfers & UK Representative

Matrix Horizon Limited, trading as MYRO, is registered in the British Virgin Islands, and our technology infrastructure operates globally. When transferring personal data outside the UK, we ensure an equivalent level of protection by implementing recognized UK transfer mechanisms, such as International Data Transfer Agreements (IDTA) or UK Addendums to Standard Contractual Clauses (SCCs).

UK GDPR Representative:

In accordance with Article 27 of the UK GDPR, Matrix Horizon Limited has designated an official representative in the United Kingdom to act as a contact point for UK individuals and the Information Commissioner's Office (ICO) regarding data protection matters.

Our appointed UK GDPR Representative is:

  • Full Legal Name: Vape Supplier Ltd

  • Company Registration Number: 10873335

  • Registered Office Address: 33 Bennetts Hill, Birmingham, B2 5SN, United Kingdom

  • Telephone: +44 121 663 1339

  • Privacy Contact Email: info@vapesupplier.co.uk / info@myro.global

UK residents may contact our UK Representative directly regarding any requests to exercise their data protection rights or for enquiries regarding our data processing practices.

(Note: Where Vape Supplier Ltd also acts as our UK Importer for product distribution and commercial compliance, please note that their role as a commercial product importer is legally separate from their role as our designated UK GDPR Representative.)

7. Children's Data & Age Limits

Our Services and products are strictly intended for adult smokers and nicotine users aged 18 or older. We do not knowingly collect personal information from individuals under 18. If a minor has provided us with personal data, please contact us immediately to request deletion.

8. Security and Safeguards

We implement appropriate technical and organizational safeguards (including SSL encryption and access controls) to protect your data. You remain responsible for keeping your login credentials secure.

9. Your Rights under UK GDPR

If you reside in the UK, you have the following rights:

  • Right to Access / Know: Request a copy of the personal information we hold about you.

  • Right to Rectification: Request correction of inaccurate personal information.

  • Right to Erasure: Request deletion of your personal data, subject to legal retention duties.

  • Right to Restrict or Object to Processing: Object to processing for direct marketing or specific legitimate interest grounds.

  • Right to Data Portability: Request transfer of your data in a structured format.

  • Right to Withdraw Consent: Withdraw consent at any time where processing is consent-based.

To exercise your rights, email us at info@myro.global or contact our UK Representative above.

10. Complaints & Contact Details

If you have concerns regarding our data practices, please contact us first. You also have the right to lodge a complaint with the UK data protection supervisory authority:

Data Controller Contact:

  • Entity: Matrix Horizon Limited, trading as MYRO

  • Email: info@myro.global

  • Postal Address: Omar Hodge Building, 4th Floor, Unit 3a, 325 Waterfront Drive, Road Town, Tortola, VG1110, British Virgin Islands