App Privacy Policy

Effective date: 17 August 2026 · Version 1.0

This privacy policy explains how Sharobella e.U. (“we”, “us”) processes personal data in connection with the apps we publish on the Shopify App Store (the “Apps”). It applies to all our Shopify apps; app-specific details are set out in the annex at the end of this policy (currently: ZipGo Express Delivery). Data processing on our website is governed separately by our Website Privacy Policy and is not restated here.

The key fact first: no buyer data on our servers

Personal data of your store's end customers (buyer, checkout or order data) never reaches our servers and is never stored or otherwise processed by us. Our Apps are built on Shopify Functions: the app logic (for ZipGo Express Delivery, evaluating the buyer's shipping city at checkout) runs entirely on Shopify's own infrastructure. Our systems have no server-side access to checkout data. Our Apps do not request or process protected customer data under Shopify's Protected Customer Data requirements.

Controller

Sharobella e.U.
Owner: Michael Elyav
Praterstrasse 66, 1020 Vienna, Austria
VAT ID: ATU73071025
Email: office@sharobella.com
Phone: +43 1 3940 098

No data protection officer has been appointed; the statutory conditions requiring one are not met.

Scope and roles

This policy is addressed to merchants who install and use our Apps. For the merchant and shop data processed in that context, we act as controller within the meaning of Art. 4(7) GDPR. We do not process end-customer data on behalf of merchants on our systems. Should that ever change, we would act as processor (Art. 28 GDPR); a data processing agreement is available on request.

What data we process

On our servers (database) we store only the following shop/business data:

your store's myshopify domain,
a Shopify API access token (offline session) and the OAuth scopes you granted.

Your app configuration (e.g. shipping-option rules and city lists) is not stored on our servers: it lives as app metafields directly inside your own Shopify store and never leaves Shopify. When you uninstall the app, Shopify removes these metafields automatically. We store no subscription or billing status; billing is handled exclusively by Shopify – payment or card data never reaches us.

The only personal data involved is the merchant's own contact data as provided to us by Shopify during installation (e.g. the shop owner's email address, where transmitted to us) and your support correspondence with us. Operating the app servers also generates technical server logs (e.g. IP address, timestamps); these are retained for no more than 90 days.

Purposes and legal bases

Providing and operating the App, billing, support – performance of contract, Art. 6(1)(b) GDPR;
Security, abuse prevention, error analysis and service improvement – legitimate interest, Art. 6(1)(f) GDPR;
Compliance with legal obligations (in particular tax and commercial retention duties, 7 years under Austrian BAO/UGB) – Art. 6(1)(c) GDPR.

Providing the shop data is technically required for using the App; without it the App cannot be provided. No automated decision-making within the meaning of Art. 22 GDPR takes place.

Recipients and processors

Shopify International Ltd. (Ireland) and Shopify Inc. as operator of the Shopify platform, through which installation, authentication and billing run;
Hosting: Hetzner Online GmbH, Germany (EU hosting);
our email provider for the support channel.

International transfers

We host app data in the EU and do not plan any transfer to countries outside the EU/EEA. Should we ever engage a service provider outside the EU/EEA, this will only happen on the basis of appropriate safeguards (in particular EU Standard Contractual Clauses, Art. 46 GDPR). Shopify processes platform data under its own responsibility on the basis of its own data-protection safeguards; Shopify Inc. is based in Canada, which is covered by an EU adequacy decision.

Retention

Session data (myshopify domain, API access token, scopes): for the lifetime of the installation; after uninstallation it is deleted via the Shopify shop/redact webhook (sent by Shopify roughly 48 hours after uninstall; deletion completed within 30 days at the latest). Your app configuration (metafields) is removed by Shopify already upon uninstallation of the app;
accounting and billing records: 7 years (Austrian BAO/UGB);
support correspondence: until your request is resolved, or earlier on request where no retention duty applies;
technical server logs: no more than 90 days.

Cookies and tracking

The embedded admin UI of our Apps inside the Shopify admin uses only technically required session mechanisms. We set no analytics or tracking cookies and embed no ad pixels; no consent banner is required for this.

Your rights

You have the rights of access, rectification, erasure, restriction of processing, data portability and objection (Art. 15–21 GDPR). To exercise them, an informal email to office@sharobella.com is sufficient. We respond to requests within 2 business days (Mon–Fri, Vienna time).

Right to object: You may object at any time to processing based on Art. 6(1)(f) GDPR.

Right to lodge a complaint

You have the right to lodge a complaint with a supervisory authority – in Austria the Austrian Data Protection Authority (Österreichische Datenschutzbehörde, DSB), Barichgasse 40–42, 1030 Vienna, www.dsb.gv.at – or with the supervisory authority competent for you in your EU member state.

Shopify compliance webhooks

All our Apps implement the privacy webhooks mandated by Shopify:

customers/data_request – an end customer's access request: we store no end-customer data and answer the request accordingly.
customers/redact – an end customer's erasure request: there is no end-customer data to delete.
shop/redact – sent by Shopify roughly 48 hours after uninstallation: we then delete the shop's session data (myshopify domain, API access token, scope grants). The app configuration (metafields) has already been removed by Shopify together with the app.

Annex: app-specific details – ZipGo Express Delivery

Shopify App Store listing name: “ZipGo Express Delivery” (shown in the Shopify admin as “Express Delivery”).

Function: The app hides the merchant's own express shipping rates at checkout when the buyer's shipping city (in Israel) is outside the city list the merchant configured. It is built on a Shopify “Delivery Customization Function” that runs entirely on Shopify's infrastructure – the shipping-city check happens there; our servers never receive this data.
Permissions (scopes): only read_delivery_customizations and write_delivery_customizations. No customer, order or product scopes.
Billing: exclusively via Shopify Billing (App Pricing): USD 19 per 30-day billing interval, 7-day free trial, free on development stores. We never receive or store payment or card data.
Data categories: none beyond those listed under “What data we process”.

Information for California / U.S. Residents (CCPA/CPRA)

We do not sell or share personal information as defined by the California Consumer Privacy Act (CCPA) as amended by the CPRA, and have not done so in the preceding 12 months. We also collect no “sensitive personal information”; because nothing is sold or shared, no “Do Not Sell or Share My Personal Information” link is required. To the extent we were ever deemed to handle personal information on behalf of a merchant, we would act as a “service provider” under the CCPA/CPRA. The categories we collect are limited to identifiers and business contact information of merchants (shop domain, shop owner email where received, support correspondence) and internet activity data in technical server logs. California residents have the rights to know/access, correct and delete their personal information, and the right not to be discriminated against for exercising these rights. To exercise them, contact office@sharobella.com. Note: as a small Austrian sole proprietorship, Sharobella e.U. likely falls below the CCPA's “business” thresholds; this section is provided voluntarily for transparency.

Changes to this privacy policy

We may update this privacy policy, for example when the law changes or app features are added. The current version is always available at this address; we will notify you of material changes via the app UI in the Shopify admin or by email.

Version 1.0 – effective 17 August 2026.