Privacy Policy

1. Who we are

This privacy policy describes how we, the data controller, process personal data in connection with the Shopify application "Covex CRO" (the "App").

Controller (within the meaning of Art. 4(7) GDPR):
A.B. Digital Solutions UG (haftungsbeschränkt)
Hartweg 39, 72793 Pfullingen, Germany
Represented by: Alexander Bossert, Managing Director
Email: alex@bossert.digital

We have not appointed a data protection officer because we are not required to do so under Art. 37 GDPR.

2. What Covex does

Covex is a Shopify app that lets merchants add conversion-rate optimisation widgets (announcement bar, social proof badge, flash sale section, and similar) to their storefronts. The widget configuration is stored on our servers and delivered to merchant storefronts via Shopify-managed metafields.

3. Categories of personal data we process

We process two distinct sets of data:

3.1 Merchant account data

• Shop domain (e.g. my-shop.myshopify.com)
• Shopify Admin API access token (encrypted at rest with AES-256-GCM)
• Plan / billing status as returned by the Shopify Billing API
• Widget configurations created by the merchant
• Contact email of the merchant where supplied directly (e.g. for support)

3.2 Storefront event data (visitors of merchant shops)

• A random pseudonymous session identifier (cro_session_id), stored in the visitor's browser localStorage
• Widget event type (impression, click, dismiss) and the associated widget ID
• The page URL on which the event occurred
• The visitor's IP address — used only transiently for rate-limiting and not persisted in our database

We do not collect names, email addresses, postal addresses, phone numbers, payment information, or any other directly identifying information from storefront visitors.

4. Purposes and legal bases (Art. 6 GDPR)

• Providing the App to merchants — performance of a contract, Art. 6(1)(b) GDPR. Without the data listed in §3.1 we cannot authenticate the merchant against Shopify or store their widget configuration.
• Storefront event aggregation — legitimate interest of the merchant in measuring widget performance, Art. 6(1)(f) GDPR. Data is pseudonymous; the merchant remains responsible for obtaining any visitor consent required by their local law (e.g. § 25 TTDSG in Germany).
• Compliance with legal obligations — Art. 6(1)(c) GDPR, in particular responses to Shopify's mandatory GDPR webhooks and tax/accounting record-keeping duties.
• Security, fraud prevention, and abuse mitigation — legitimate interest, Art. 6(1)(f) GDPR (e.g. IP-based rate limiting on the storefront tracking endpoint).

5. Cookies, localStorage, and similar technologies

The App itself sets no cookies. The storefront widget script does write two values to the visitor's localStorage:

• cro_session_id — random pseudonymous identifier used to deduplicate impressions and attribute clicks. Persists until the visitor clears their browser storage.
• cro_dismissed, cro_recently_viewed and similar keys — used to remember which widgets the visitor has dismissed and which products they have viewed. Read on the visitor's device only; never transmitted to us.

Under § 25 TTDSG (Germany) and the ePrivacy directive, storing information in a visitor's terminal device for purposes that go beyond what is strictly necessary requires the visitor's consent. The obligation to obtain that consent lies with the merchant operating the storefront; merchants must include Covex's storefront script in their cookie/consent management solution where applicable.

6. Recipients and sub-processors

We do not sell personal data. We share data only with the following sub-processors, each of which acts on documented instructions and is bound by a data processing agreement:

• Shopify International Limited (Ireland) / Shopify Inc. (Canada) — platform on which the App runs; receives widget configuration via the Shopify Admin API.
• Vercel Inc. (USA, EU region fra1 Frankfurt) — hosting of the application backend and storefront tracking endpoint.
• Supabase, Inc. (USA, EU region eu-central-1 Frankfurt) — managed PostgreSQL database storing merchant data and widget events.

An up-to-date list of sub-processors is maintained at /dpa#sub-processors.

7. International data transfers

Our hosting infrastructure is configured to keep merchant and storefront data within the European Union (Vercel Frankfurt region and Supabase eu-central-1). The legal entities operating these services are, however, established in the United States and may access EU-resident data for technical support purposes. Such access is governed by the European Commission's Standard Contractual Clauses (Module 2 / Module 3, Commission Implementing Decision (EU) 2021/914) included in each sub-processor's data processing agreement.

Shopify operates globally; data transmitted via the Shopify Admin API is processed in accordance with Shopify's Data Processing Addendum.

8. Retention periods

• Merchant account data: for the duration of the merchant's installation of the App, plus 48 hours after uninstallation, after which Shopify delivers the shop/redact webhook and we permanently delete all associated records.
• Storefront event data: retained for up to 24 months for aggregate analytics, then deleted or fully anonymised.
• Webhook logs and audit data: up to 12 months for security and debugging.
• Accounting / tax-relevant records (invoices): retained for the statutory period under § 147 AO and § 257 HGB (currently up to 10 years).

9. Your rights as a data subject

Under the GDPR you have the right to:

• request information about your data we process (Art. 15)
• request rectification of inaccurate data (Art. 16)
• request erasure of your data (Art. 17)
• request restriction of processing (Art. 18)
• data portability (Art. 20)
• object to processing based on legitimate interests, including profiling, on grounds relating to your particular situation (Art. 21)
• withdraw consent at any time where processing is based on consent

To exercise these rights, email alex@bossert.digital. We will respond within 30 days.

You also have the right to lodge a complaint with a supervisory authority. The competent authority for our establishment is: Landesbeauftragter für den Datenschutz und die Informationsfreiheit Baden-Württemberg, Lautenschlagerstraße 20, 70173 Stuttgart, Germany — baden-wuerttemberg.datenschutz.de.

10. Shopify mandatory GDPR webhooks

In line with Shopify's privacy requirements, the App is subscribed to the three mandatory compliance webhooks:

• customers/data_request — fulfilled by confirming that we do not store storefront-visitor personal data beyond a pseudonymous session ID
• customers/redact — likewise; no customer PII is stored
• shop/redact — triggers full erasure of all merchant data within 30 days of receipt (in practice: on receipt)

11. Security

We apply state-of-the-art technical and organisational measures including TLS 1.2+ for all data in transit, AES-256-GCM encryption of Shopify access tokens at rest, HMAC validation of all incoming Shopify webhooks, App Bridge session-token-based authentication for the admin UI, IP-based rate-limiting on public endpoints, and least-privilege database access. A summary of the measures is set out in Annex 2 of our Data Processing Agreement.

12. Automated decision-making

We do not use automated decision-making (Art. 22 GDPR), including profiling, that produces legal effects concerning you or similarly significantly affects you.

13. Children

The App is offered to Shopify merchants, who must be at least 18 years of age under Shopify's Terms of Service. We do not knowingly process data of children under 16.

14. Changes to this policy

We may update this policy from time to time. Material changes will be reflected in the "Last updated" date at the top of this page. Significant changes affecting merchants will be communicated by email.

15. Contact

For any privacy-related question, contact us at alex@bossert.digital.