Privacy

Controller and scope

Golden Web Age GmbH, Reiterweg 9a, 82178 Puchheim, Germany, represented by managing director Christian Waske, is responsible for operating the app, its own contractual relationships with app users and handling support requests. Privacy contact: hallo@goldenwebage.de. Further company details appear below.

This notice covers the app and its information pages. The separate labelklar.de website hosted by IONOS has its own privacy notice. Merchants remain responsible for their stores, product and guarantee information and their customers’ personal data. Processing personal data on their behalf is distinct from our own contract and support administration. This notice is not a data processing agreement.

Data from Shopify and its use

• For sign-in and API access, Labelklar processes shop domains, shop and session identifiers, permissions, expiry times, access tokens and refresh tokens. Depending on the Shopify session, records can also contain a user identifier, name, email, language and owner or collaborator attributes.
• Product management reads product identifiers, titles, handles and status. GARAN details supplied by you include producer, model, guarantee duration, terms URL, confirmations and review time. Display settings and GARAN details are stored as Shopify metafields. The local database holds sessions, not a separate product catalogue.
• To control access to the public app, Labelklar queries the shop association, active plan and any trial, billing period or scheduled cancellation through the Shopify Partner API. The result is used for the current access check and is not kept as a separate local subscription database. Shopify handles plan approval and billing; Labelklar receives no credit card details from this process.
• Labelklar does not retrieve customer or order records. Privacy webhooks from Shopify may include customer identifiers. The app validates these messages but does not persist or log their content.

Purposes, legal bases and required information

We use necessary account and connection data to provide the app, perform the contract, verify the selected plan and respond to contractual enquiries. Article 6(1)(b) GDPR applies where the individual is the contracting party. Contact and employee data belonging to a business customer is processed under Article 6(1)(f); our legitimate interest is reliable delivery and communication of the business relationship.

Necessary technical processing for delivery, troubleshooting and abuse prevention relies on Article 6(1)(f) GDPR. Our interest is a secure and available service. Applicable statutory retention duties rely on Article 6(1)(c). The app processes product and guarantee details for the display configured by the merchant.

The necessary Shopify permissions and connection data are required to install and use the app; without them Labelklar cannot access authorised settings and products. Support information is voluntary, but insufficient contact or issue details may prevent us from answering.

Hosting, browser storage and recipients

App and file requests involve technical connection data such as IP address, time, requested resource and browser information. Our hosting provider is Fly.io, Inc. The app instance and data volume are in Frankfurt am Main, Germany. A data processing agreement with Fly.io is in place. This deployment location does not restrict every platform, support or subprocessor operation to Germany.

Our application logs contain fixed operational and error event codes. The production server does not write URL access logs; tokens, shop domains, form contents and raw error messages are excluded from these app logs. Fly.io also processes its own infrastructure and security data under its terms.

Shopify supplies the store platform, APIs, billing, embedded authentication and theme-file delivery. Checkout artwork can also be requested from the app server. These requests expose the connection data needed for delivery to the relevant provider. Fonts are served with the app. Labelklar adds no advertising or analytics trackers of its own.

The admin language you choose is saved in local browser storage as labelklar-admin-language-v1 to restore that preference. You can delete it using your browser settings. The local development demo is not part of the public app. Shopify’s notices also apply to authentication and platform functions.

Email support processes your sender and contact details, message content and attachments you choose to provide. We use Gmail from Google for this purpose. Do not send passwords, API tokens or customer/order information that is unnecessary to explain the issue. Access is available to personnel handling operations and support and the providers used for those purposes.

• Fly.io privacy information ↗
• Shopify privacy for merchants ↗
• Google privacy policy ↗

Processing outside the European Economic Area

Fly.io, Shopify and Google operate internationally. Their services may process data in the United States, Canada or other countries identified in their provider information. We therefore do not promise that all storage and processing takes place in the EEA.

Fly.io publishes its participation in the EU-U.S. Data Privacy Framework and information about subprocessors. Google identifies adequacy decisions, the Data Privacy Framework and Standard Contractual Clauses as transfer mechanisms for its services. Its Cloud Data Processing Addendum describes additional contractual arrangements for Google Workspace.

Shopify’s data processing terms describe transfers between its entities, the adequacy decision for Canada and Standard Contractual Clauses for other covered transfers. Applicable safeguards depend on the service and the particular transfer. Published terms and clauses are linked below; contact us for further information about our processing.

• Fly.io data processing agreement ↗
• Fly.io subprocessors ↗
• Google international transfer frameworks ↗
• Google Workspace Cloud Data Processing Addendum ↗
• Shopify Data Processing Addendum ↗

Retention and deletion

• Session records are retained for app access. After an app/uninstalled or shop/redact webhook is successfully processed, local sessions for that shop are deleted. Contact our privacy address if delivery fails or you have a deletion request.
• Fly volume snapshots are retained for five days. Existing backups expire within that period; deletion from the active database does not immediately remove earlier backup copies.
• Fly Grafana app log search retains application logs for seven days. This is specific to that log search, not a general retention period for all provider, contract or security data.
• Closed support requests are retained for one year after closure and then deleted unless statutory retention duties or the necessary preservation of specific legal claims apply. Such exceptions are limited to the affected records and the necessary period.
• Product and settings metafields reside at Shopify. Local session deletion does not explicitly delete those metafields; their continued availability depends on Shopify and the app installation. Shopify handles its own platform and billing data under its terms. The local language preference remains until deleted in the browser.

• Fly.io log retention ↗

Your rights and complaints

Subject to legal conditions, you may request access, rectification, erasure, restriction of processing and data portability. Where processing relies on legitimate interests, you may object on grounds relating to your particular situation. Any consent can be withdrawn for the future. Contact hallo@goldenwebage.de. Requests about a merchant’s processing should be directed to that merchant; we can help identify the appropriate contact.

You may complain to a supervisory authority, particularly where you live, work or believe an infringement occurred. The Bavarian State Office for Data Protection Supervision (BayLDA) supervises private businesses based in Bavaria: Promenade 18, 91522 Ansbach; postal address Postfach 1349, 91504 Ansbach, Germany; poststelle@lda.bayern.de.

Labelklar makes no automated decisions with legal or similarly significant effects on individuals and does not create buyer profiles. We update this notice when the described processing changes.

• BayLDA contact and complaints ↗
• General Data Protection Regulation ↗