Privacy Policy

1. Data Controller

Gianluca Iacona (infinitecodes)
Rolshover Straße 70
51105 Cologne, North Rhine-Westphalia
Germany
Email: info@infinitecodes.de

2. Data Collected

Selfix lets a shop's customers self-service edit their orders (change the shipping address, swap a variant) as long as the order has not already entered fulfillment. The following data is processed:

Shop domain, Shopify access token, and session metadata (to authenticate the merchant)
Order ID and order number of the edited order
Customer ID (if the change was made via the customer account extension)
Before/after state of the change (e.g. old and new shipping address, old and new product variant)
Optional merchant notification email address (for internal merchant notifications about order edits)

This data is stored as an audit log solely to track the change and to enforce the time-window and locking mechanism (e.g. locking orders that have already shipped).

3. Purpose and Legal Basis

Processing is carried out to provide the app's functionality (order edits by customers on behalf of the merchant) as well as fraud and abuse prevention (e.g. preventing edits to orders that have already shipped). The legal basis is Art. 6(1)(b) and (f) GDPR.

4. Retention Period

Session data is automatically deleted when the app is uninstalled. Audit log entries containing personal data (shipping addresses) are automatically anonymized after 90 days; the entry itself is kept without any personal reference for statistical purposes. Earlier deletion takes place upon a GDPR request or when the app is uninstalled. Encrypted backups are kept for 14 days and are then deleted automatically.

5. Disclosure to Third Parties

Data is never sold or passed on for third-party purposes. The app communicates exclusively with the Shopify Admin API of the respective shop. The following processors are engaged under Art. 28 GDPR:

Shopify Ireland Ltd. - shop and order data
STRATO GmbH, Berlin - hosting of the application (engages IONOS SE as a sub-processor)
Hetzner Online GmbH, Gunzenhausen - storage of encrypted backups (Falkenstein, Germany)

Backups are encrypted before they leave our server; the storage provider has no access to the plaintext.

6. Hosting

The app is hosted on servers within the European Union (STRATO GmbH). Encrypted backups are stored in Falkenstein, Germany (Hetzner Online GmbH). All processing is based on data processing agreements under Art. 28 GDPR.

7. Your Rights

Under GDPR, you have the following rights:

Right of access (Art. 15)
Right to rectification (Art. 16)
Right to erasure (Art. 17)
Right to restriction of processing (Art. 18)
Right to data portability (Art. 20)
Right to object (Art. 21)
Right to lodge a complaint (Art. 77) with your local data protection authority

To exercise your rights: info@infinitecodes.de

8. Cookies

Selfix does not use tracking cookies. Technically necessary session cookies for Shopify authentication are permitted under Art. 6(1)(f) GDPR.

9. Security

Shipping addresses in the audit log are encrypted (AES-256-GCM) before being stored. Every access to protected customer data is logged. Backups are encrypted with GPG (RSA-4096) before they leave the server and are stored exclusively within the EU.