This privacy policy explains which personal data we process on the website preorderflow.com and in the Shopify app PreorderFlow (the “app”), for which purposes, and on which legal basis. Section 2 is about visitors of the website. Section 3 is about merchants who install the app and their customers (“buyers”).
1. Controller
Eze Solutions UG (haftungsbeschränkt)Jorker Straße 6b
21614 Buxtehude
Germany
Email: support@preorderflow.com
We have not appointed a data protection officer because the law does not require one for us. Please send privacy questions to the email address above.
2. This website
2.1 Hosting
The website is hosted by Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA. Cloudflare delivers the pages from the data center of its global network that is nearest to you. On every request, Cloudflare processes:
- the IP address of the requesting device,
- the date and time of the request,
- the requested address and the HTTP status code,
- the amount of data sent,
- the page you came from (referrer), if your browser sends it,
- your browser and operating system (user agent).
Cloudflare needs this data to deliver the website and to fend off attacks. We do not keep server log files of the website. The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest is a secure, fast, and stable service. Cloudflare processes the data on our behalf under a data processing agreement under Art. 28 GDPR. Access from the USA cannot be ruled out. Cloudflare, Inc. is certified under the EU-U.S. Data Privacy Framework. The European Commission’s Standard Contractual Clauses apply in addition. Cloudflare’s privacy policy: cloudflare.com/privacypolicy.
2.2 No cookies, no tracking
The website sets no cookies, uses no analytics or marketing services, and loads no content from third parties. The fonts are part of the website and load from the same address. Your browser may keep technical data in its local storage, such as its cache. We have no access to it.
2.3 Links to the Shopify App Store
The install buttons lead to the Shopify App Store. The links contain UTM parameters that only say which part of this website you came from. They contain no information about you. Once you follow a link, Shopify processes your data under its own privacy policy: shopify.com/legal/privacy.
2.4 Contact by email
When you write to us, we process your email address, your name, and the content of your message to answer your request. The legal basis is Art. 6(1)(b) GDPR if the request concerns a contract or steps before a contract, and Art. 6(1)(f) GDPR otherwise. Our legitimate interest is to answer requests. Apple Distribution International Ltd., Hollyhill Industrial Estate, Hollyhill, Cork, Ireland runs the mailbox on our behalf. We delete the messages once the request is closed and no statutory retention period applies.
3. The app PreorderFlow
3.1 Roles
- Merchant data. For the data we need for our contract with you as a merchant, we are the controller.
- Buyer data. We process the data of your buyers only on your behalf and on your instructions. For this data, you as the merchant are the controller and we are your processor under Art. 28 GDPR. The data processing agreement (DPA) is part of our terms (section 7) and counts as concluded when you install the app.
3.2 Which data the app processes
Shop data:
- the shop domain (such as xyz.myshopify.com) and the Shopify shop ID,
- the install and uninstall times,
- the admin language of the person who last opened the app, the app’s handle in the Shopify admin, and whether the shop is a development store,
- a copy of the current plan (plan, billing period, trial end, last check) and the period of the last allowance email,
- the Shopify session with the offline access token, the granted scopes, and the shop domain,
- the name and email address of the shop owner, which the app reads from Shopify at most once an hour for its emails to you.
Offers and access:
- your offers with your own settings (name, status, trigger, ship date, button and note texts, limits) and, per variant, the product and variant ID and the original inventory policy,
- API keys with a name, a prefix, and a hash of the key, plus the Shopify user ID of the person who created the key.
The app does not store the shop name, the shop address, or the names or email addresses of other staff.
Preorder data, per preordered order line:
- the shop, the order ID, and the order name (such as #1042),
- the line item ID, the variant ID, the quantity, and the fulfilled quantity,
- the ship date at the time of the order and, if cancelled, the time of the cancellation.
Ship Date Notices, per notice:
- the shop, the order ID, and the offer ID,
- the old and the new ship date,
- the send time, the number of attempts, and the last error,
- the message ID of the email service and the delivery status, such as delivered or bounced.
The app does not store the buyer’s name, email address, language, or customer ID in its database. It reads the email address from Shopify only when it sends a notice and passes it to Cloudflare Email Sending (section 3.6). When a buyer cancels in the customer account, the app checks their customer ID at that moment against the customer account’s session token. The app does not process your buyers’ card or bank account data. Payment runs entirely through the Shopify checkout.
3.3 Purposes and legal bases
- Providing the app. We process shop data to run the app, show preorders, count limits, check the plan, and email you when your allowance runs low. The legal basis is Art. 6(1)(b) GDPR.
- Preorders on behalf of the merchant. We process preorder data to show ship dates, notify buyers when a ship date moves later, and carry out cancellations in the customer account. Here we are the processor. The legal basis is the merchant’s, usually Art. 6(1)(b) GDPR.
- Support and security. We review the app’s server logs to fix errors and prevent abuse. They contain, for example, the time, shop domain, and error messages of requests, and can contain Shopify customer and order IDs. The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest is a secure and error-free service. We delete the logs after 7 days.
3.4 No sharing, no selling
We do not sell data, and we share it only with the recipients in sections 2.1, 2.4, and 3.5 to 3.7. We do not use merchant or buyer data to train AI models. We contact buyers only with emails about their preorders that the merchant sets up in the app.
3.5 Storage location and hosting
The app runs on Cloudflare Workers by Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA. It keeps its data in Cloudflare D1 (database), Workers KV, and Cloudflare Queues. The primary copy of the database is in Western Europe. Cloudflare keeps read copies of the database in other regions of its network, also outside the EU, so that the app answers fast everywhere. A request runs in a Cloudflare data center near you or near the database. Cloudflare encrypts the stored data. Connections between Shopify, the app, and your browser are encrypted over HTTPS.
Cloudflare processes the data under a data processing agreement. For buyer data, Cloudflare is our sub-processor, which the merchant authorises through our terms. Access from the USA cannot be ruled out. Cloudflare, Inc. is certified under the EU-U.S. Data Privacy Framework. The European Commission’s Standard Contractual Clauses apply in addition.
3.6 Emails through Cloudflare Email Sending
We send Ship Date Notices to your buyers through Cloudflare Email Sending by Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA. The sender is notifications@notify.preorderflow.com. For this, Cloudflare processes the buyer’s email address, the content of the email, and delivery data such as the time and the delivery status. The app itself keeps only the message ID and the delivery status. We also send emails to you as the merchant, such as about your allowance, through Cloudflare Email Sending. Section 3.5 describes how Cloudflare processes the data.
3.7 Shopify and Shopify Billing
The app runs on the platform of Shopify International Limited, Victoria Buildings, 2nd Floor, 1-2 Haddington Road, Dublin 4, D04 XN32, Ireland. We receive the data through the Shopify API. Shopify bills the app fees through Shopify Billing. We see your plan and the billing status, but no payment data. Shopify’s privacy policy applies to your use of Shopify: shopify.com/legal/privacy.
3.8 Retention and deletion
Shopify sends the app mandatory privacy webhooks:
- customers/data_request. A buyer asks you for their data. The app records a summary of the data stored about them in the server log. It does not send you the data automatically. Write to us, and we give you the preorder data of the orders concerned.
- customers/redact. A buyer asks for deletion. The app deletes the preorder lines and Ship Date Notices of the orders named.
- shop/redact. Shopify sends this webhook 48 hours after you uninstall the app. The app deletes all data of your shop when it arrives.
The app deletes a Ship Date Notice 180 days after it was sent or gave up. When Shopify cannot deliver a webhook to the app, the app keeps a record of it for 30 days to retry it. For order webhooks, the record holds only IDs. For the buyer privacy webhooks, it also holds the buyer’s customer ID and email address as Shopify sends them. We delete server logs after the period in section 3.3. Beyond that, we keep data only while the app is installed or while a statutory retention period applies, such as for accounting records under § 147 AO and § 257 HGB.
4. Your rights
You have the right of access (Art. 15 GDPR), rectification (Art. 16 GDPR), erasure (Art. 17 GDPR), restriction of processing (Art. 18 GDPR), and data portability (Art. 20 GDPR).
Right to object. Where we process data on the basis of Art. 6(1)(f) GDPR, you can object at any time on grounds relating to your particular situation (Art. 21 GDPR).
You can lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), in particular in the member state of your residence, your place of work, or the alleged infringement.
If you are a buyer in a shop that uses the app, please contact the merchant first. The merchant is responsible for your data. If your request reaches us directly, we forward it to the merchant.
5. Other information
You are not obliged to provide data to us. Without the shop data, however, the app cannot work. We do not use automated decision-making, including profiling, under Art. 22 GDPR.
We update this privacy policy when the website, the app, or the law changes. The version published here at the time of your visit applies. If this English version and the German version differ, the German version prevails.