Privacy policy

Last updated: October 2026 · EU legal guarantee label (Shopify app)

1. Controller

2. Overview

EU legal guarantee label is an app for Shopify merchants. It shows the harmonised legal guarantee notice and the GARAN label under Regulation (EU) 2025/1960 in the merchant’s store. We process data of the merchant (the store and its staff) only as far as needed to provide the app. The app does not process data of store visitors or buyers: the components in the storefront, checkout and order email run on Shopify’s infrastructure, read only data stored in the shop and send nothing to our servers. They set no cookies and do no tracking. The app has no access rights to orders or customers.

3. Data we process

• Store data received from Shopify on installation and use: store domain, store name, time zone, published languages.
• Access data: the access token for the Shopify API, needed to run the app for the store.
• Product data as far as needed: product and variant IDs, titles, tags, SKUs (for the CSV import), the GARAN details entered (brand, model, period), guarantee terms and app settings. Most of this is stored as metafields in the merchant’s own store.
• Change log and compliance records: changes to settings and GARAN details with time stamps, the result of the setup self-check and the PDF records created by the merchant.
• CSV import: the content of an uploaded file, only until the check is finished.
• Images: the official graphics and GARAN labels are stored in the merchant’s Shopify Files.
• Technical access data when the app is opened or Shopify sends webhooks (IP address, time, requested URL), for operation, error analysis and security.

4. Purposes and legal bases

• Providing the app and its functions, including the compliance records: Art. 6(1)(b) GDPR (contract).
• Billing of paid plans is handled by Shopify; we receive the active plan: Art. 6(1)(b) GDPR.
• Security, error analysis and abuse prevention: Art. 6(1)(f) GDPR (legitimate interest in a secure, reliable service).

5. Recipients and processors

• Shopify (Shopify International Limited, Dublin, Ireland): platform on which the app runs; data is exchanged via the Shopify API.
• Fly.io (Fly.io, Inc., USA): hosting of the app server and the database, region Frankfurt am Main, Germany.

We have concluded a data processing agreement with the processor. The data is stored in the EU. As the provider is a US company, access from the USA cannot be ruled out; transfers are based on the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR) and, where the provider is certified, on the EU-U.S. Data Privacy Framework (Art. 45 GDPR).

6. Retention and deletion

We store the data as long as the app is installed. After uninstalling, Shopify sends a deletion request (usually 48 hours later); we then delete all store data held by us – access data, settings, change log, compliance records, import data and the file index. Metafields and files stored in the merchant’s own store are managed by Shopify and the merchant; images in Shopify Files remain in the store until the merchant deletes them. Technical access data is kept for at most 30 days.

7. Your rights

You have the right to access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object (Art. 21). Contact us at info@upscale-it.de. You can also lodge a complaint with a supervisory authority, e.g. the Hamburg Commissioner for Data Protection and Freedom of Information.

8. Cookies

Inside the Shopify admin the app uses Shopify’s session tokens and sets no tracking cookies. The storefront components set no cookies.