Lektoro Privacy Policy: EU Product Compliance

This page shows the Lektoro Privacy Policy with the section for Lektoro: EU Product Compliance. Privacy policy →

Version: 1.0 · Last updated: 2026-10-08 · Applies to: all Lektoro apps for Shopify listed in section 2 and the website https://lektoro.pl.

This policy explains what personal data the Lektoro apps process, why, for how long, who receives it and what rights you have. Section 1–14 apply to all apps. Appendix A describes, app by app, exactly which data each app reads from Shopify, what it stores and how it handles the Shopify privacy webhooks. Each app's privacy page (https://lektoro.pl/apps/<app>/privacy/) consists of this policy plus that app's section of Appendix A.

1. Who we are

The apps are published by:

Maciej Kaczmarczyk (Lektoro), a natural person conducting unregistered activity (Art. 5 of the Polish Entrepreneurs' Law; no entry in CEIDG, no NIP or REGON), not registered for VAT Address: ul. Warszawska 87/16, 66-400 Gorzów Wielkopolski, Poland E-mail (privacy and data protection): legal@lektoro.pl · Support: support@lektoro.pl

("Lektoro", "we", "us"). We are registered with Shopify as an individual Shopify Partner and are established in the European Union (Poland). We have not appointed a Data Protection Officer because we are not required to do so (Art. 37 GDPR) . Contact us about privacy at legal@lektoro.pl.

2. Apps covered by this policy

3. Our role: controller or processor

The apps are business tools for Shopify merchants ("Merchant", "you").

• We act as controller for data about the Merchant as our customer: the shop identity, the staff members who contact us, support correspondence, plan and subscription status, and technical/security logs of our services.
• We act as processor on behalf of the Merchant for personal data contained in the Merchant's shop and in the data the Merchant puts into an app – e.g. order references and country codes, a customer ID linked to a deposit payout, identifiers of staff members recorded in audit logs, contact details of suppliers and economic operators, data submitted by the Merchant's suppliers, e-mail addresses of product owners who register a product with the Merchant's brand (EU Product Compliance). The Merchant is the controller of that data. Our processing is governed by the Data Processing Agreement (https://lektoro.pl/legal/dpa/), which forms part of our Terms of Service.

If you are a customer of a Shopify store (a shopper), the store is responsible for your data. Please contact the store directly; we will assist the store in answering your request. The same applies if you registered a product with a brand on a page of EU Product Compliance: the brand is responsible for your data; you can delete the registration yourself with the link in every e-mail you received (Appendix A.13).

4. What data we process

4.1 Installation and account data (all apps). When a Merchant installs an app, Shopify provides us with the shop domain (*.myshopify.com), an API access token (stored to call the Shopify API on the Merchant's behalf), the granted access scopes, and the shop's Shopify ID. We record installation and uninstallation dates. The apps use Shopify "offline" access tokens; we do not receive the name or e-mail address of the staff member using the app from the session . Some apps store the Shopify user ID of the staff member performing an action (see Appendix A).

4.2 Plan and subscription status (all apps). Charges are handled by Shopify (Shopify App Pricing). We do not receive or store payment card or bank details. We query Shopify's Partner API for the shop's active plan, its status (e.g. trial, active) and the date it was checked, and store the last verified result.

4.3 Shop data read through the Shopify API. Each app reads only the data covered by its access scopes. Most apps read product and inventory data only, which normally contains no personal data. Some apps read order or fulfillment data (EU Product Compliance only after the Merchant turns on "Order data"), and one app stores a customer ID – see Appendix A. No app reads customer names, e-mail addresses, phone numbers or street addresses.

4.4 Data the Merchant enters. Settings, rules, mappings, notes, uploaded CSV files and documents, alert e-mail addresses, contact details of suppliers or economic operators, and similar data entered in an app.

4.5 Data from other people. Only where described in Appendix A:

• Storefront visitors: aggregated, anonymous event counts from the Feed & Pixel Guard heartbeat pixel (only with the visitor's analytics consent); requests to public product passport pages (Textile Passport DPP, EU Product Compliance) and to public document files (EU Product Compliance).
• Suppliers of the Merchant who submit data through the supplier portal of Textile Passport DPP or EU Product Compliance.
• Owners of the Merchant's products who register a serialised item on a registration page of EU Product Compliance (e-mail address, serial number, consent, language) and receive the confirmation e-mails and recall notices the Merchant sends – processed on the Merchant's behalf (Appendix A.13).

4.6 Support and communication. When you contact us: your name, e-mail address, shop domain, the content of the correspondence and any attachments.

4.7 Technical logs. Our servers and our hosting provider record technical request data (IP address, date and time, requested URL, user agent, response code) for security and troubleshooting. Some public endpoints use the IP address for rate limiting only, without storing the address itself: most keep it only in memory, EU Product Compliance keeps only a keyed one-way hash of it for the length of the limit window (see Appendix A).

4.8 Website. The website https://lektoro.pl is a static site without accounts or contact forms. Fonts and all other files are served from our own server; without your consent the website does not connect to any third-party server.

• Server logs of our hosting provider (as in 4.7).
• Browser storage (localStorage), strictly necessary or set at your request, not sent to us: your colour theme choice (lektoro-theme) and your cookie choice (lektoro-consent). They stay until you clear browser data.
• Language cookie (lektoro_lang), set only when you choose a language in the language menu: it remembers EN, PL, DE or FR so the home page opens in that language. Functional, strictly necessary for the requested function, no personal data, valid 1 year. Without it, the home page follows your browser's language setting.
• Google Analytics 4 – only with your consent. If you click "Accept" in the cookie banner, the website loads Google Analytics 4, which sets cookies (_ga, _ga_<ID>) and sends Google information about your visit: pages viewed, referring page, approximate location derived from the IP address (GA4 does not store IP addresses), device, browser and language. Advertising features, Google signals and ad personalisation are switched off. Without consent (or after "Reject") Google Analytics is not loaded at all. You can change your choice at any time with the "Cookie settings" link in the website footer.

4.8a Free Green Claims check (lektoro.pl → tools.lektoro.pl). When you use the free check on our website, your browser sends the store address you enter to our server tools.lektoro.pl (hosted by SEOHOST in Poland); like any web server it also receives your IP address. We use the store address only to fetch that store's publicly available data: its robots.txt file and its public product list (/products.json, up to 500 products, titles and descriptions); we respect robots.txt. The result is kept only in the server's memory for up to one hour, so that a repeated check of the same store is not run again; it is not written to disk. Your IP address is used only to limit the number of checks (5 per 10 minutes) and is kept in memory only as a salted one-way hash. We keep anonymous daily statistics that contain only numbers (checks, results, error types, store languages, clicks to the app and an approximate number of distinct visitors and stores, counted with hashes whose random salt exists only in memory for the current day); these totals are kept for up to 400 days. Store addresses, IP addresses and results are not logged or stored, no cookies are set and no account is needed. Legal basis: Art. 6(1)(f) GDPR — our legitimate interest in providing the check you request and in anonymous usage statistics. The result is an automated wording check, not legal advice.

4.8b Other free store checks (lektoro.pl/tools → tools.lektoro.pl). The duplicate SKU check, the Google Shopping product data check and the accessibility check work the same way as the Green Claims check in section 4.8a (same server, the IP address used only for a limit of 5 checks per 10 minutes per check and kept in memory only as a salted one-way hash, results only in memory for up to one hour, no logs of store addresses, IP addresses or results, no cookies, no account). They fetch only publicly available data of the store you enter, respecting its robots.txt: the SKU check reads the public product list (/products.json, up to 500 products with their variants and SKUs); the product data check reads up to 50 products from that list and opens up to 5 public product pages; the accessibility check reads up to 10 products from that list and opens the home page and up to 2 product pages. The anonymous daily statistics count these checks per tool (requests, checks, results with and without findings, number of checked products or pages, error types, clicks to each app) as numbers only. The HS code checker and the GTIN checker run entirely in your browser: what you paste or type there is not sent to us. Legal basis as in section 4.8a. The results are automated checks, not legal advice.

4.9 Shopify App Store listings. When you view a Lektoro app listing in the Shopify App Store, Shopify sends our Google Analytics 4 property events about that visit: listing view, click on "Install", installation, click on an App Store ad, and the traffic source within the App Store (e.g. search phrase or category). Shopify collects this data under its own privacy policy and cookie choices on apps.shopify.com; we receive it in Google Analytics and use it only in aggregated reports, without identifying individual visitors.

5. Purposes and legal bases

What we do not do. We do not sell or rent personal data. We do not use shop or customer data for advertising, for profiling, or to train machine-learning or AI models. The apps do not use external AI services (for example, HS code suggestions are computed by a rule-based algorithm on our server). We do not make decisions based solely on automated processing that produce legal or similarly significant effects (Art. 22 GDPR). Scores and suggestions shown in the apps are aids for the Merchant, who makes the decisions.

6. Recipients

• Shopify (Shopify Inc. and its affiliates, incl. Shopify International Limited, Ireland) – the platform the apps run on. Shopify processes data under its own terms and privacy policy.
• Our subprocessors – hosting and e-mail delivery providers listed at https://lektoro.pl/legal/subprocessors/.
• Destinations chosen by the Merchant – only if the Merchant configures them: Slack incoming webhook, the Merchant's own webhook endpoint, the Merchant's 3PL endpoint, Google Merchant Center (Google), eBay. These are services of the Merchant's choice, not our subprocessors; data is sent to them on the Merchant's instruction.
• Google (Google Ireland Limited, Ireland; Google LLC, USA) – Google Analytics 4 for the website (only with consent, 4.8) and for App Store listing statistics (4.9).
• Public: data the Merchant chooses to publish on the storefront (GPSR safety information, product passports, public lifecycle events of serial numbers).
• Product owners: the recall notices the Merchant sends to registered owners (EU Product Compliance, A.13).
• Authorities and courts, where we are legally required.

7. International transfers

We host the apps and the website at SEOHOST Sp. z o.o., ul. Obornicka 330, 60-689 Poznań, Poland (KRS 0000939910, NIP 9721323212), on servers in Poland (EU). Google Analytics data may be transferred to Google LLC in the USA under the EU–US Data Privacy Framework (Google LLC is certified) and Google's Standard Contractual Clauses. Where a subprocessor or a recipient is located outside the EEA, the transfer is based on an adequacy decision (e.g. the EU–US Data Privacy Framework, where the recipient is certified) or on Standard Contractual Clauses (Commission Decision (EU) 2021/914) . Shopify transfers data under its own terms. Details: https://lektoro.pl/legal/subprocessors/.

8. Retention

• While the app is installed: as long as needed for the app's function, subject to the retention periods in Appendix A (e.g. plan-dependent history).
• Uninstallation: on uninstall we delete the Shopify access tokens (sessions) immediately and stop all scheduled jobs, alerts and data collection, but keep the Merchant's business data for 48 hours, so that an accidental uninstall does not destroy compliance records; reinstalling within this period restores access.
• Full deletion: Shopify sends the shop/redact webhook 48 hours after uninstallation. On receipt we delete all data of that shop from the app database. Copies in backups are overwritten within 30 days.
• Fallback deletion: each app records the uninstallation date. If shop/redact is never received, an automatic clean-up deletes all data of the shop once 90 days have passed since uninstallation (unless the app was reinstalled). The clean-up runs once a day – with the app's scheduled jobs where the app has them, otherwise together with the app's regular activity (webhooks, admin page loads).
• Customer redaction: on customers/redact we delete or anonymise data about the indicated customer or orders, where an app holds any (Appendix A).
• Support correspondence: 3 years from the end of the conversation (limitation period for claims).
• Technical logs: 14 days, unless needed longer to investigate a security incident.
• Accounting records : 5 years from the end of the calendar year in which the tax obligation arose (Polish tax law).

Important for compliance records: some apps hold records the Merchant may be legally required to keep (e.g. EPR packaging ledger, GPSR incident register, product passports, deposit ledger). Our deletion after shop/redact does not extend the Merchant's own retention obligations. Export your data before uninstalling – each app provides CSV/JSON export or printable reports.

Website and listing statistics: Google Analytics 4 data (4.8, 4.9) is kept for 14 months (GA4 data retention setting) and then deleted automatically by Google; the _ga cookies expire after 2 years or when you withdraw consent and clear cookies.

9. Security

We use measures appropriate to the risk, including: TLS encryption for all traffic; verification of Shopify session tokens and HMAC signatures of Shopify webhooks and App Proxy requests; minimum necessary access scopes, read-only by default, with write scopes requested only when the Merchant uses a writing feature; encryption of third-party credentials stored by the apps (AES-256-GCM for the storefront password and Google refresh token in Feed & Pixel Guard and for marketplace tokens in Oversell & Sync Watch); storing only hashes of supplier access links (Textile Passport DPP, EU Product Compliance); protection of outbound requests against server-side request forgery; rate limiting of public endpoints; separation of data per shop; restricted administrative access to production systems (only the publisher) ; regular backups kept for 30 days . See also Annex II of the DPA.

10. Shopify privacy webhooks

All apps subscribe to Shopify's mandatory privacy webhooks:

• customers/data_request – apps that hold data linked to the customer or to the orders listed in the request (3PL Case-Pack Picker, DRS Deposit & Returns, EPR Packaging Report) record the request and show the Merchant a notice in the app with a CSV/JSON download of the matching records, which the Merchant passes to the customer (Shopify expects a response within 30 days); the Merchant marks the request as fulfilled. The stored request contains only identifiers (customer ID, order IDs, request ID) – not the customer's e-mail or phone – and is deleted on customers/redact for that customer or together with the shop's data. The other apps hold no customer data: the request is acknowledged and logged (Appendix A);
• customers/redact – we delete or anonymise data about the customer, where the app holds any;
• shop/redact – we delete all data of the shop (48 hours after uninstallation).

11. Your rights

Under the GDPR you have the right to access your data, to rectification, erasure, restriction of processing, data portability, and to object to processing based on legitimate interests (Art. 15–21). Write to legal@lektoro.pl. We will answer within one month (extendable by two months in complex cases). Shoppers and suppliers of a Merchant: the Merchant is the controller – please contact the Merchant; we will forward requests we receive to the Merchant and assist them.

You have the right to lodge a complaint with a supervisory authority, in Poland: Prezes Urzędu Ochrony Danych Osobowych (President of the Personal Data Protection Office), ul. Stawki 2, 00-193 Warszawa, www.uodo.gov.pl, or the authority in your EU country of residence or work.

Providing data is voluntary but necessary to use the apps; without the installation data an app cannot work.

12. Cookies and tracking

• Inside Shopify admin: the apps run embedded in Shopify admin and authenticate with Shopify session tokens. The apps do not set advertising or analytics cookies. The only cookie set by an app is a strictly necessary, HttpOnly security cookie valid for 10 minutes during the optional eBay connection in Oversell & Sync Watch. Shopify may set its own cookies in the admin under its own policy.
• On the storefront (visible to shoppers): only the components listed below. None of them sets cookies or uses browser storage.

• Website: see 4.8. Cookies only from Google Analytics 4 and only after you click "Accept" in the banner:

• Shopify App Store: apps.shopify.com is operated by Shopify; its cookies and the consent for them are governed by Shopify's policy. See 4.9 for the statistics we receive.

13. Children

The apps are intended for businesses. We do not knowingly collect data of children.

14. Changes to this policy

We will publish any change on this page with a new date. We will inform Merchants of material changes by e-mail or in the app at least 30 days before they take effect, unless the change is required by law sooner.

Appendix A – App-specific information

Legend: PCD = Shopify "protected customer data" (data about the store's customers). "Read-only" = the app does not change anything in the store unless stated. Common to all apps (not repeated below): installation data, plan status and the shop/redact deletion described in sections 4.1, 4.2 and 8; webhooks app/uninstalled (deletes access tokens, keeps business data until shop/redact) and app/scopes_update (records granted scopes).

A.13 Lektoro: EU Product Compliance

• Access scopes: read_products, read_locales. Optional (requested only when the feature is used): read_markets ("Import from Shopify Markets"), write_products ("Publish to storefront": the app's own product and variant metafields and app-owned metaobjects), read_themes ("Check my theme": reads the product templates of the live theme, read-only), read_orders and read_fulfillments ("Order data" in Settings, Pro and Scale plans: order register used for batch and serial-number tracking, the packaging ledger and the affected orders of a recall incident).
• Webhooks: products/create, products/update, products/delete, bulk_operations/finish, plus the common and mandatory privacy webhooks. Only while "Order data" is on (subscribed for that shop when the Merchant turns it on, deleted when it is turned off or the order scopes are removed): orders/create, orders/updated, orders/cancelled, fulfillments/create, fulfillments/update, refunds/create – the payload is limited to identifiers and is not stored; the app re-reads the order.
• Data read from Shopify: products and variants (title, handle, vendor, type, category, tags, collections, status, image, SKU, barcode/GTIN, country of origin, HS code, whether shipping is required), store languages; if granted: markets, product templates of the live theme. No customers or addresses. Only with "Order data" on: order ID and name, order dates, test flag, line items (product and variant ID, SKU, quantities), fulfillments (ID, status, date, quantities), refunds (ID, date, quantities, restock type) and the delivery country code – no customer name, e-mail, phone number or address (Shopify protected customer data, Level 1). When turned on, the orders of the last 60 days are read once.
• Data entered by the Merchant: economic operators (name, trade name, postal address, e-mail, phone, contact URL, contact name, EORI/GLN/VAT and other register numbers – may identify a natural person), assignments and product profiles, warnings and their translations, documents with uploaded files (PDF/PNG/JPEG/WebP up to 20 MB; files may contain personal data), suppliers (company name, contact name and up to 5 contact e-mail addresses, country, notes), data requests, passport content, production batches (code, dates, quantity, linked documents) and serial numbers with their status; packaging data (materials, packaging components, packaging bills of materials per variant, shipping packaging profiles, EPR registration numbers per country); recall incidents (title, type, status, risk level, description, hazard, corrective action, authority reference, affected products and batches, timeline entries with links and Vault documents – the forms ask not to enter customer names or contact details); lifecycle events of serial numbers (type, date, a short public detail of up to 80 characters that the app refuses when it looks like an e-mail address, a phone number or a link, and an internal note); warranty settings (brand name, link to the brand's privacy policy, reply-to e-mail address, link to the brand's own warranty claim form) and the text of recall notices to registered owners. CSV imports (batches, serial numbers, 3PL shipment files, packaging shipment files) keep only the values the app needs and the order number of a shipment; other columns (names, addresses, e-mails) are ignored and not stored. From a Shopify order export only the columns Name, Created at, Fulfilled at, Fulfillment status, Lineitem quantity, Lineitem sku, Lineitem requires shipping, Lineitem fulfillment status, Shipping Country, Source, Shipping Method, Cancelled at and Id are read. Data Hub imports (operators and product data from CSV files or from files exported by Lektoro GPSR Safety Desk and Textile DPP): the validated rows waiting for "Import" are stored encrypted and removed when the import ends (at the latest after 24 hours).
• Supplier portal: the Merchant shares a link /supplier/<token> on the app domain (we store only a SHA-256 hash of the token, its expiry and last use). The supplier sees only the requested products and sections (on the Pro and Scale plans also packaging components per variant), can submit data and upload files (up to 10 per request); nothing is applied before the Merchant approves it. The supplier's IP address is used for rate limiting only: the app keeps a keyed one-way hash (HMAC-SHA256) of it in its database for the length of the limit window (at most 10 minutes), never the address itself. The portal sets no cookies and loads no third-party resources or analytics. The portal itself sends no e-mails (supplier e-mails: see "E-mail" below).
• Files: stored on our server's file storage (SEOHOST, Poland), outside the Shopify store, under a separate folder per shop; type checked by file content; downloaded only through the authenticated app or, for documents the Merchant marks "Show on storefront", through a public link with a random token (removed when the document is made private).
• Packaging ledger (Pro and Scale; helps prepare packaging reports under national EPR schemes and Regulation (EU) 2025/40 (PPWR) – not legal advice): once the Merchant opens Packaging, every shipment, cancellation and return (restocked refund) in the order register creates an entry in an immutable ledger: order reference, fulfillment ID, destination country, shipping date, channel (shipping or pickup), SKUs, quantities and grams per material; corrections are reversal entries. Shipments can also be imported from CSV (shipment or tracking ID, date, country, SKU, quantity, packaging code, parcels, order reference). Reports cover EU/EEA destination countries only. Encrypted by the app before storage (AES-256-GCM): order reference, order ID, shipment / fulfillment ID, the stored copy of the source record, reconciliation state, notes, CSV file names and import error lists; the idempotency key and the normalised order reference are kept only as HMAC-SHA256 values. Country, dates, channel, SKUs, quantities and weights stay unencrypted because the reports add them up per country. The module writes no order numbers or file names to the (unencrypted) audit log. Admin blocks on the Shopify order and product pages show the packaging of that order / product.
• Safety Gate alerts (Pro and Scale): public product safety alerts of Safety Gate, the EU rapid alert system for dangerous non-food products operated by the European Commission. Two sources: (1) a weekly report file (XML) or a CSV that the Merchant downloads from the Safety Gate portal and uploads, (2) only when our server is configured with the address of the public weekly-report export (SAFETY_GATE_FEED_URL), an automatic HTTPS download from ec.europa.eu (the index at most every 6 hours, reports of the last 84 days, user agent "Lektoro-EU-Product-Compliance/1.0"). These requests contain no shop data and no personal data. Reports are stored once for all shops (deleted 182 days after publication) and copied to the shops that turned monitoring on. Alerts may name companies, brands and online traders as published by the Commission; pictures from alerts are not copied. The app shows the attribution "Source: Safety Gate … (European Commission) … CC BY 4.0" in the app and in every export. Alerts are matched to the shop's catalog (barcode, brand / vendor / manufacturer, model, name, batch) – a match is a hint to check, not a statement that a product is unsafe. Alerts of a shop are deleted 730 days after their report date unless they have a confirmed match or an incident.
• Recall incidents (Pro and Scale; viewing and exporting an existing incident works on every plan): numbered incidents with affected products, batches, serial numbers, timeline and Vault documents. Affected orders are calculated when the page or export is opened from the order register (order number with a link to the order in Shopify admin, delivery country, quantities, batches, serial numbers) and are not copied into the incident tables; no customer names, e-mail addresses, phone numbers or postal addresses (Level 2 protected customer data is not used). The Merchant downloads the evidence (ZIP with JSON, CSV files and Vault files, or single JSON/CSV files) through the authenticated app. The app reminds the Merchant of Art. 20 of Regulation (EU) 2023/988 (GPSR) and the Safety Business Gateway but sends nothing to authorities. Serial numbers of affected batches can be marked recalled; their public item page then shows the recall.
• Product owner registration (Scale plan): when the Merchant turns it on (brand name and a link to the brand's privacy policy are required), the owner of a serialised item can register it from the item's passport page on the app domain: serial number, e-mail address, consent (text naming the brand with a link to the brand's privacy policy; the version of the consent text and the time are stored) and the page language (en, de, pl, fr). Double opt-in: the app e-mails a confirmation link that opens a page with a button – only pressing the button confirms; unconfirmed registrations (and their links) are deleted after 7 days. The e-mail address is encrypted by the app (AES-256-GCM) with an HMAC-SHA256 blind index for look-ups; it is never written to the audit log or to the e-mail queue, and the admin shows it masked. Roles: the Merchant (the brand) is the controller of the owners' data, Lektoro processes it on the Merchant's behalf; the pages and e-mails say so ("processed by Lektoro on behalf of [brand]"). Registrations are not linked to Shopify customers or orders. The owner can delete the registration at any time with the link in every e-mail (also as one-click unsubscribe, List-Unsubscribe) – it is deleted at once; the Merchant can delete it in the app too. Ownership transfer: a one-time 10-character code, only its HMAC-SHA256 value is stored, valid 14 days; the new owner registers with the code and confirms by e-mail, the previous registration is then deleted; used and expired codes are deleted 30 days after use or expiry. Recall notices: the Merchant's text is e-mailed to the registered owners of affected serial numbers; the queue reads the address from the registration at sending time, so a deleted registration is skipped; delivery records (which registration received which notice) are deleted 90 days after they were created once sent, failed or skipped, only the counts remain. After a downgrade from Scale, new registrations stop, registered owners keep receiving recall notices and can manage or delete their registration.
• Stored: catalog mirror and scan results, Data Hub records with versions, Vault documents and file revisions, suppliers and requests with submissions and staged files, storefront publishing records, digital product passports with immutable versions (SHA-256), audit log (actor: Shopify user ID of the staff member, supplier:<id>, owner or system; supplier and owner e-mail addresses are not written to the audit log), batches, serial numbers, lifecycle events, packaging data and ledger, Safety Gate alerts and matches, incidents, owner registrations and recall notices and – with "Order data" on – the order register (orders, line items, shipped and refunded lines, which batch went into which shipment). Order IDs, order names, fulfillment and refund IDs, packaging ledger order fields, owners' e-mail addresses and customer data request identifiers are encrypted by the app before they are written to the database (AES-256-GCM); lookups use HMAC-SHA256 values instead of plaintext identifiers; the key is kept in the server environment, not in the database.
• Public pages and files (on the app domain, not the store): published passports at /dpp/<id> (HTML, JSON and QR code image) and GS1 Digital Link addresses /dpp/s/<shop key>/01/<GTIN>…; public document files at /public/documents/<token>. They show what the Merchant published, including the economic operator's name and postal and electronic address; supplier names and private documents are never published. A GS1 Digital Link with a registered serial number (…/21/<serial>) also shows that serial number, its batch, the public lifecycle events (type, month and short detail – never who; registration and transfer events are internal unless the Merchant makes them public) and – if the Merchant marked it recalled – a recall notice; never order or customer data and never whether the item has a registered owner. Product registration pages (/dpp/s/<shop key>/register, /transfer, /confirm/<token>, /owner/<token>) are HTML forms without JavaScript and without third-party resources. No cookies, no analytics, no access log kept by the app; the browser language (Accept-Language) chooses the page language; the IP address is used for rate limiting only: the app keeps a keyed one-way hash (HMAC-SHA256) of it in its database for the length of the limit window (at most 10 minutes), never the address itself; the registration form does the same with the e-mail address (limit window 1 hour). Requests also reach our hosting provider's technical logs (section 4.7).
• Data published to the store: after "Publish to storefront", the app writes its own metafields and metaobjects (operators, warnings with translations, public documents, model, batch/serial numbers, passport link) to the shop; the theme blocks display them. These values stay in Shopify after the app is uninstalled: Shopify revokes the app's access token on uninstall, so the app can no longer remove them. The Merchant removes them before uninstalling with "Remove all from storefront"; the app shows a notice about this.
• Retention: until shop/redact (48 hours after uninstallation; fallback 90 days), then all rows and files of the shop are deleted, including passports and their versions, packaging ledger, incidents, owner registrations and notices – public passport links and QR codes then return "not found". Before uninstalling, the Merchant can download the passport archive (JSON), the documents, packaging reports and incident exports. Passport pages keep working between uninstallation and deletion. The order register and the packaging ledger are kept while the app is installed (traceability and reports need the shipment history); the Merchant can delete all recorded orders at any time (Settings → Order data). Uninstalling stops reading orders (the order webhooks are removed by Shopify). Module-specific periods: unconfirmed owner registrations 7 days, transfer codes 30 days after use or expiry, notice delivery records 90 days, cached Safety Gate reports 182 days, a shop's Safety Gate alerts 730 days (see above).
• customers/data_request: recorded without the customer's e-mail or phone (identifiers encrypted) and answered at once. With "Order data" on, the records of the requested orders (order number, products, quantities, batches, serial numbers, delivery country, packaging ledger entries) are attached and the Merchant downloads them as JSON in Settings. If owner registrations were made with the customer's e-mail address (compared through the blind index), the request notes their number and the Merchant finds them in Warranty → Registrations. customers/redact: the stored requests of the customer are deleted; the order ID, order name and fulfillment / refund IDs of the listed orders are removed from the order register and the order references from the packaging ledger (anonymous quantities, weights, batches and countries remain); owner registrations made with the customer's e-mail address in that shop are deleted.
• PCD: Level 1 only when "Order data" is on (no Level 2 fields: name, e-mail, phone, address). The e-mail addresses of product owners are collected by the app's own registration form, not read from Shopify.
• Storefront / cookies: see section 12 – theme blocks and public pages without cookies or tracking. The blocks "Warranty registration" and "Product lifecycle" only contain links to pages on the app domain.
• E-mail (only when e-mail delivery is set up on the app server): (a) opt-in, Starter plan and above: one e-mail a day with the Vault documents due for renewal, to up to 3 addresses the Merchant enters in Settings; (b) at the Merchant's request, a new supplier portal link is e-mailed to the supplier contact addresses saved by the Merchant, and – while requests are open – one reminder 3 days before the link expires (the reminder does not repeat the link). Recipient addresses are stored encrypted; the delivery log keeps only the kind, time, status and number of recipients (180 days). The expiry e-mail and the reminder carry a one-click unsubscribe link. No tracking pixels or tracked links. Without e-mail delivery set up, nothing is sent (links and reminders are shown in the app).
• E-mail to product owners (module 10): registration and transfer confirmation e-mails and recall notices to product owners, sent through the SMTP mail server configured on our server (SEOHOST, Poland ); content: brand, product name, serial number, links to confirm / manage / delete the registration, the brand's privacy policy and warranty claim links and, for recall notices, the Merchant's text; replies go to the reply-to address the Merchant entered. Recall notices are sent in the background within an hourly limit. Without a configured mail server the app sends nothing and product registration is unavailable.