Privacy policy

Who is responsible

Our operator details are also listed in the Impressum.

Data we use and why

• Website visits. Serving the website involves processing connection data, such as your IP address, requested page, browser information, and request time. Hosting and security services may log this information to deliver the site and investigate problems.
• Shopify installation. We receive your shop ID, domain, shop name, contact email, permissions, and authentication information from Shopify to install, authenticate, and operate LinkStock. Stored Shopify access tokens are encrypted.
• Inventory synchronization. We process product and variant details, inventory item identifiers, SKUs, locations, quantities, linked stock groups, preferences, and activity records to keep shared inventory aligned.
• Billing. We use plan, subscription, trial, and billing-event information to manage access and usage limits. Shopify handles plan selection and payment. LinkStock does not collect payment-card details.
• Support. When you contact us, we process your contact details, message, and any information you choose to include to respond and resolve your request.

The app does not request access to Shopify customers or orders. Shopify may send customer identifiers in mandatory privacy requests; these are handled for the purpose of responding to the request.

Service processing is based on performing our contract with you (Article 6(1)(b) GDPR), or our legitimate interest in providing the service to your business where you act on its behalf (Article 6(1)(f)). Website delivery, security, and troubleshooting rely on our legitimate interest in operating a reliable service. Processing required by law relies on Article 6(1)(c).

Analytics and browser storage

We use PostHog on the marketing site to understand page views and installation-button clicks. Our configuration uses cookieless mode, disables session recordings and automatic interaction capture, and does not create person profiles. This does not mean that no personal data is processed: a request to an analytics service can still reveal connection data such as an IP address.

Analytics events are retained for up to one year under our PostHog Free plan.

[Confirm the PostHog hosting region and the legal basis and any consent mechanism before publishing.]

Within the Shopify app, a short-lived authentication cookie supports signed-in navigation. Authentication can also use verified Shopify session tokens when cookies are unavailable. Shopify operates its own authentication and browser storage.

[Confirm whether Sentry or another diagnostics service is active, and document its provider, processing location, collected data, retention, and legal basis.]

Service providers and international transfers

We use Hetzner Online GmbH to host LinkStock. Hetzner provides the server infrastructure used to deliver the website and app. PostHog provides marketing analytics as described above.

Shopify provides the commerce platform, app authentication, and hosted app billing. See Shopify’s privacy policy for its processing. Our hosting, email, and any enabled analytics or diagnostics providers process the data needed to provide their services. We may also disclose information where legally required.

[Confirm the Hetzner server location, PostHog region, and any separate backup, email/support, or diagnostics providers. Confirm the contractual safeguards for any transfers outside the EEA, and how a copy can be requested.]

How long data is kept

Shop and inventory information is needed while you use the app. Inventory activity history uses a 30-day retention window. Uninstalling ends the app’s access; it does not necessarily erase every record immediately. Shopify’s shop-redaction request triggers cleanup of shop details, credentials, inventory, and billing data, subject to any documented legal retention requirement.

• Marketing analytics: up to one year.
• Database backups: 30 days. Deleted data may remain in backup copies until those copies expire.
• Server logs: 30 days.
• Support emails: one year.

We do not use Hetzner server backups. Our database backups are managed separately.

[Confirm whether any billing records require separate legal retention, including the applicable obligation and duration, or remove this field if no exception applies.]

Your choices and rights

You may request access, correction, deletion, restriction, or portability of your personal data where applicable. You may object to processing based on legitimate interests. Where processing relies on consent, you may withdraw it for the future. Contact the operator above to make a request; we may need to verify your identity.

You can also complain to a data protection authority, including the authority where you live, work, or believe an infringement occurred.

Shop and inventory data are necessary to provide synchronization. If you do not provide the required permissions, the app cannot deliver that functionality. We do not use your personal data to make automated decisions producing legal or similarly significant effects.

Changes to this notice

We will update this page when our processing changes. The final publication date will be added when the processing arrangements have been confirmed.