Privacy policy

1. Who is responsible

Kai Weiß
Klingenstraße 4
74081 Heilbronn
Deutschland
Email: weissskai@gmail.com

These details apply to our website, business correspondence and merchant account administration. For purchase approval data, the installing merchant is responsible and we process it on the merchant's instructions.

2. Website access

Render Services, Inc., USA, hosts this website and the app. When you visit, Render processes connection data such as IP address, request URL, time, browser information and any referring URL to deliver pages and protect the service. The legal basis is Article 6(1)(f) GDPR: our legitimate interest in secure, reliable operation. Technical logs are retained as needed to investigate faults or abuse, within the provider's configured retention and backup cycles; incident records may be kept longer where needed for legal claims.

The public website uses no visitor analytics, advertising trackers or tracking cookies. Linked services, including Shopify and the demo store, have their own privacy notices.

3. Contact and support

We use your email address, subject, message and optional name to answer your enquiry. In-app support also includes your shop identifier and request category. Article 6(1)(b) GDPR applies to your own contract or pre-contractual enquiry; otherwise Article 6(1)(f) applies, based on our legitimate interest in handling correspondence and support. Required form fields let us route and answer your message; you can also contact us by email or post.

The form runs on Render and sends your message through Resend (Plus Five Five, Inc., USA) to our Gmail inbox. Google Ireland Limited and Google LLC process email contents and metadata, including in the USA; see Google's privacy policy and transfer information. Public form messages are not stored in our app database. A hash of the sender's email is held in memory for up to 15 minutes to limit abuse. In-app support requests are stored with the shop's records.

Correspondence is retained as needed to resolve the enquiry and any follow-up, then deleted unless statutory retention duties (Article 6(1)(c) GDPR) or specific legal claims require continued retention. Resend's standard Free, Pro and Scale plans retain emails and delivery logs for 30 days, with a separate seven-day backup cycle.

4. Shopify app

Shopify, merchants and their users supply shop, company and customer identifiers, names, email addresses, roles, spending limits, cart items, approval rules, decisions, notes, order references and session data. On the merchant's instructions, we use these to route purchase approvals, check carts before checkout, maintain approval history and send transactional notifications. Merchants configure rules and assign human approvers. Workflow data is not sold or used for advertising.

Render runs the app, Neon stores its database and Resend delivers notifications. The app and database regions are Germany. Neon's current contracting party is Databricks, Inc., USA, with Neon, LLC involved in the service. Shopify provides the platform, authentication and billing under its own privacy notice. Our merchant account administration relies on Article 6(1)(b) GDPR for individual contractual partners, Article 6(1)(f) for business contact and operational administration, and Article 6(1)(c) for statutory duties. Merchants determine the legal basis and retention instructions for their workflow data.

Workflow records remain as needed for the service and the merchant's instructions. Uninstallation deletes stored sessions and queued emails, but does not immediately erase all approval history. Customer-redaction requests anonymise structured customer fields; personal data in free-text notes needs separate review. Shop-redaction requests delete shop records from the active database. Provider backups expire under their backup cycles. Merchants can contact us to arrange access, return or deletion, including relevant support correspondence.

5. International processing

German app and database regions do not exclude global website delivery or processing and support access outside the EEA. Render, Resend and Databricks provide transfer safeguards, including EU standard contractual clauses, in their Render, Resend and Databricks data processing terms. Information and copies of applicable safeguards can be requested using the contact details above.

6. Your rights

Subject to the GDPR's conditions, you can request access, correction, deletion, restriction and data portability. You can object to processing based on Article 6(1)(f) GDPR on grounds relating to your situation. We then stop unless overriding compelling legitimate grounds or legal claims justify continued processing. Contact us using the details above; for data controlled by a merchant, contact that merchant, whom we assist.

You can complain to a supervisory authority, particularly where you live or work or where the alleged infringement occurred. German authorities are listed by the Datenschutzkonferenz.