← Back to Levamio Rechts-Check

Privacy Policy – "Levamio Rechts-Check" (Shopify app)

Version 1.0 – release candidate 1.0 – not yet approved. Internal header, as of 20 Oct 2026: launch version; approval by Tassilo pending; law-firm review after first revenue. Release lock: DRAFT until approval („Freigabe Rechtstexte Levamio 1.0“) – do not publish. This header (all „>“ lines below the title) is removed after approval; publicly only “As of: 20 October 2026” remains at the end. Created with AI assistance following the structure of the "Unser Dubai" template; not legal advice, not reviewed by a lawyer. Open wording and missing details: FREIGABE_KOMPAKT.md. English version of datenschutz-shopify-app.md; in case of discrepancies the German version prevails. Planned URL: https://levamio.com/apps/rechts-check/privacy (use this as the "Privacy policy URL" in the Shopify App Store listing).
Based on a code review of apps/shopify-rechtscheck/ on 20 Oct 2026. Hosting per README.md, DEPLOY.md, wrangler.jsonc, workers/app.ts: app on Cloudflare Workers (Paid, Smart Placement, cron triggers in the Worker), database Supabase Postgres (Frankfurt, eu-central-1) connected via Cloudflare Hyperdrive; Workers logs (observability) enabled. Not Fly.io (the Dockerfile is unused). A demo mode with fixture data exists only for store screenshots and is disabled in production (404). Hosting decided; nothing deployed yet.

1. Controller

NEXTLEVEL CORPORATE SERVICE PROVIDER - FZCO, Building A1, IFZA Business Park, Dubai Digital Park, Dubai Silicon Oasis, Dubai, United Arab Emirates (DIEZ License No. 67837), represented by Tassilo Peter Seitz. Levamio is an offering of NEXTLEVEL CORPORATE SERVICE PROVIDER - FZCO ("we", "us").
Privacy contact: [email protected] (general support: [email protected])

EU representative (Art. 27 GDPR): We are not established in the EU. If we appoint a representative under Art. 27 GDPR, we will name them here. You can always contact us directly with any data protection matter.
Data protection officer: none appointed at present.

2. Who this policy applies to

"Levamio Rechts-Check" (the "app") is an embedded app for merchants on Shopify. It reviews shop settings, product data and publicly accessible storefront pages for indications relating to mandatory legal information (e.g. legal pages, unit prices, product safety under the GPSR, strike-through prices, image alt text, an accessibility self-assessment) and shows recommendations. This policy addresses merchants and their staff who use the app.

3. Our role – and why the app processes practically no data of your customers

Merchant data: For the data we process about your shop and your use of the app (section 4), we act as controller (Art. 4(7) GDPR).

Your end customers' data: The app is designed not to process any data of your customers:

• It does not request customer or order permissions (no read_customers, no read_orders) and does not request access to Shopify "protected customer data".
• It only reads products, variants, product images, app-owned metafields and your legal policies, and fetches publicly accessible storefront pages (home page and one product page) without any customer login.
• We therefore answer the Shopify privacy webhooks customers/data_request and customers/redact without returning or deleting data, because none is held (section 7).

In our assessment a data processing agreement for end-customer data is not required. Where your shop content exceptionally contains personal data (e.g. a manufacturer's or EU responsible person's name and address in GPSR fields, your name in your legal notice, people in product photos), we process it only to run the feature you use, on your instructions and within Shopify's developer terms; we will conclude a data processing agreement under Art. 28 GDPR on request.

4. What we process, why, and on what legal basis

Not processed: customers, orders, carts, payment data, theme files (no theme access), names or email addresses of your staff (the app does not use online tokens carrying user details).

What the app writes to your shop: app-owned product metafields ($app:gpsr, $app:pricing), an app-data metafield on the app installation (GPSR shop default) and – only with the additional write_files permission and after your approval – the alt attribute of product images. The app does not change product titles, prices or descriptions.

We do not make automated individual decisions under Art. 22 GDPR. We do not sell data or use it for advertising.

Obligation to provide data: You are not obliged to provide data. Without the permissions granted on installation and the shop data described, however, the app cannot be used.

5. Storefront fetch

To check whether your shop shows a withdrawal button or function, our server fetches your home page and one product page as a visitor would, identified by its own user agent. We only evaluate the text and store the result, not the fetched HTML. If your shop is password-protected (e.g. a development store), you can enter the storefront password in the settings; it is stored encrypted, used only for this fetch and deleted with your other data.

6. AI alt-text suggestions (Anthropic)

Only when you request a suggestion in "Alt texts" does our server send the product image URL (Shopify CDN), the product title and the desired language to Anthropic (Anthropic PBC, USA, provider of the "Claude" language model). Anthropic retrieves the image via the URL and returns a suggested text. No customer data and no other shop data is sent. Our server loads the image URL and title itself via the Shopify API and checks that the image belongs to your shop.

• The suggestion is saved as a draft and applied in Shopify only after you review and approve it. It is AI-generated and may be inaccurate.
• Anthropic acts as our processor under its commercial terms and Data Processing Addendum. According to Anthropic's current information, API data is not used for model training and is usually deleted within 30 days; longer only in exceptional cases (e.g. content flagged for usage-policy violations or legal obligations).
• Transfers outside the EU: see section 9.
• Please do not request suggestions for images showing identifiable people unless you have a legal basis to do so.

7. Shopify privacy webhooks and uninstalling

All privacy webhooks are verified using Shopify's HMAC signature. Metafields created in your shop by the app remain in Shopify until you or Shopify remove them.

8. Storage location and retention

Location: database at Supabase in the EU region Frankfurt (AWS eu-central-1). The app itself runs as a Cloudflare Worker on Cloudflare's global network; with "Smart Placement" it preferably runs close to the database. The database connection uses Cloudflare Hyperdrive (connection pooling). The Worker's execution location is not limited to the EU. Hyperdrive may briefly cache database queries to speed up responses. Your shop content itself stays with Shopify.

Retention:

• All shop data in the app: while the app is installed; after uninstalling until the shop/redact webhook (usually 48 hours), then complete deletion.
• Audit history: while the app is installed and the history is needed for display; usually no longer than 24 months. Deleted at the latest on shop/redact.
• Price history: while the app is installed and the history is needed to calculate the 30-day lowest price (for long-running promotions up to one year and 30 days back); older entries are usually deleted. Deleted at the latest on shop/redact.
• Alt-text suggestions: until applied or rejected, then usually no longer than 90 days; at the latest on shop/redact.
• Server logs: usually no longer than 30 days.
• Support requests: up to 3 years after closure.
• At Anthropic: according to Anthropic's current information usually no longer than 30 days, longer in exceptional cases (section 6).

9. Recipients and international transfers

Transfers: Anthropic processes data in the USA. The EU-US Data Privacy Framework adequacy decision applies only to certified recipients; otherwise we rely on the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR) in the provider's DPA. On request we tell you which safeguard applies.

United Arab Emirates: We are established in the UAE; there is no EU adequacy decision for the UAE. We apply the GDPR to the extent it applies to our services and access EU-stored data only via encrypted, authenticated connections.

10. Security

HTTPS in transit, AES-256-GCM encryption of the storefront password, signature verification of all webhooks, per-shop data separation, access only via Shopify session tokens, scheduled jobs as Worker cron triggers (manual calls only with a secret key), database access only via Hyperdrive with row level security enabled (Supabase's public data API returns no data), demo mode disabled in production, minimal permissions (optional scope requested only when needed).

11. Your rights

Under the GDPR you have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21). The quickest way to delete all data is to uninstall the app (section 7). Contact [email protected]; we usually respond within one month. You may lodge a complaint with a data protection supervisory authority, in particular in the EU/EEA member state of your habitual residence, place of work or the alleged infringement; in the UK with the ICO, in Switzerland with the Federal Data Protection and Information Commissioner (FDPIC).

Right to object (Art. 21 GDPR): Where we process data on the basis of legitimate interests (Art. 6(1)(f) GDPR, e.g. operation and security, third-party GPSR contact details), you may object at any time on grounds relating to your particular situation. We will then stop processing unless we demonstrate compelling legitimate grounds which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims. An informal message to [email protected] is sufficient.

12. Changes

We update this policy when features, service providers or the law change and inform you of material changes in the app. The current version is at https://levamio.com/apps/rechts-check/privacy.

As of: 20 October 2026