Privacy Policy

1. Data the app processes

Store data: store domain, settings you choose (markets, business role, languages, notification e-mail), economic operators you enter (company names, addresses, contact details), product compliance information, green-claim findings and evidence, passport data, packaging data and an audit log of changes.

Staff data: for each staff member who opens the app, the Shopify user ID, name, e-mail address, whether they are the store owner, their role in the app and when they were first and last seen. Changes in the audit log are recorded with the staff member's name and e-mail.

Order data (packaging module only): order ID, destination country, product and variant IDs, quantities, and fulfilment and cancellation dates. The app does not store customer names, addresses, e-mail addresses, phone numbers or payment details.

Public passport pages: no cookies, no analytics and no tracking. The server keeps ordinary technical request logs for security and troubleshooting.

2. Roles and purposes

For staff and order data processed to provide the app, the merchant is the controller and we are the processor under the Data Processing Agreement. The purposes are: running the app's features, showing who changed what (accountability), access control, calculating packaging volumes per country for producer-responsibility reporting, and sending notifications the merchant has enabled.

We act as controller only for account administration, billing records received from Shopify, support correspondence and security logs. The legal basis is performance of the contract with the merchant and our legitimate interest in operating a secure service.

3. Sub-processors

Shopify Inc. / Shopify International Ltd – the platform the app runs on and reads data from.

Railway Corp. (EU West, Amsterdam, Netherlands) – app hosting and PostgreSQL database – hosting of the app and its database.

Anthropic PBC (USA) – AI features (Pro plan only, and only when an AI feature is used). Receives product, page and passport text, never order data or customer details. Transfers are covered by the EU Standard Contractual Clauses.

E-mail delivery provider (SMTP) – only if e-mail notifications are enabled; receives the store's notification address and the notification content.

4. Retention and deletion

Data is kept while the app is installed. When Shopify sends a shop/redact request (48 hours after uninstallation) all data for the store is deleted, normally within 48 hours. When Shopify sends a customers/redact request, the order records for the listed orders are deleted. Technical webhook logs are deleted after 30 days. Backups held by the hosting provider expire according to its schedule (at most 30 days).

5. Security

All traffic is encrypted with TLS. Data at rest is encrypted by the hosting and database provider. Access in the app is controlled by roles (admin, editor, viewer), every change is logged, access tokens are stored server-side only, and Shopify webhooks are verified by signature.

6. Your rights

Customers of a store should contact the store, which is the controller; we assist the store. Staff members and merchants can request access, correction or deletion of their data at igorkazazic1989@gmail.com. You may also complain to the Swedish Authority for Privacy Protection (IMY) or your local supervisory authority.

7. Changes

We announce material changes in the app at least 30 days in advance. The version date is shown at the top of this page.