Privacy Policy

1. Data Controller

Gianluca Iacona (infinitecodes)
Rolshover Straße 70
51105 Cologne, North Rhine-Westphalia
Germany
Email: info@infinitecodes.de

2. Data Collected

DiscountComposer stores only technical session data required for authentication via Shopify OAuth:

Shop domain
Shopify access token
Session ID, status, and validity period
Optional Shopify user info (first/last name, email of the app installer)

If a merchant restricts a discount to customer tags, the app reads the customer IDs carrying those tags from the Shopify Admin API and writes them into the discount configuration. No other customer data is read - the app does not access names, addresses, phone numbers or email addresses.

Discount configurations, including any customer IDs, are stored as metafields directly in Shopify - not on our servers. Our own database holds nothing but session data.

3. Purpose and Legal Basis

Session data is used exclusively to authenticate against the Shopify Admin API in order to provide the app's functionality. The legal basis is Art. 6(1)(b) GDPR (performance of a contract).

4. Retention Period

Session data is automatically deleted when the app is uninstalled. Discount configurations stored in Shopify metafields remain within the Shopify system and are subject to Shopify's own data protection terms.

5. Disclosure to Third Parties

Data is never sold or passed on for third-party purposes. The app communicates exclusively with the Shopify Admin API of the respective shop. The following processors are engaged under Art. 28 GDPR:

Shopify Ireland Ltd. - shop, discount and customer data
STRATO GmbH, Berlin - hosting of the application (engages IONOS SE as a sub-processor)
Hetzner Online GmbH, Gunzenhausen - storage of encrypted backups (Falkenstein, Germany)

Backups contain session data only and are encrypted before they leave our server; the storage provider has no access to the plaintext.

6. Hosting

The app is hosted on servers within the European Union (STRATO GmbH). Encrypted backups are stored in Falkenstein, Germany (Hetzner Online GmbH). All processing is based on data processing agreements under Art. 28 GDPR.

7. Your Rights

Under GDPR, you have the following rights:

Right of access (Art. 15)
Right to rectification (Art. 16)
Right to erasure (Art. 17)
Right to restriction of processing (Art. 18)
Right to data portability (Art. 20)
Right to object (Art. 21)
Right to lodge a complaint (Art. 77) with your local data protection authority

To exercise your rights: info@infinitecodes.de

8. Cookies

DiscountComposer does not use tracking cookies. Technically necessary session cookies for Shopify authentication are permitted under Art. 6(1)(f) GDPR.