Privacy Policy

1. Who We Are

echomate is a Shopify app developed by Valerian Huber, operating under the brand Alpin-Code (alpin-code.de). echomate provides store health monitoring, QR code generation, short link tracking, link-in-bio pages, loyalty stamp cards, wallet passes, and analytics for Shopify merchants.

2. What Data We Collect

Merchant Data (Shopify Store Owners)

• Shop domain — Your myshopify.com domain, used to identify your store
• Store contact email — The public contact address from your Shopify settings. We set it as the reply address of stamp-card emails, so your customers' replies reach you, not us. If you have not set your own alert address, we also send important notices about your account to this address, for example when a reward code stops working, at most once every seven days.
• Session tokens — Encrypted Shopify session data for authentication
• Settings — Your app configuration (scan frequency, QR branding, stamp-card mechanics, etc.)
• QR codes, short links & bio pages — The QR codes, short links, and bio-page content you create
• Stamp-card configuration — Reward thresholds, trigger modes, discount-code names you select

End-User Data — Anonymous Tracking (QR scans & link clicks)

• IP address — Hashed (SHA-256) and truncated daily for privacy. We never store raw IP addresses.
• Country — Derived on our own server from a local IP-to-country database. The IP address is never sent to a third party for this.
• Device type, browser, OS — Extracted from the User-Agent header
• Referrer — Sanitized (query params and fragments stripped)
• Timestamp — When the scan or click occurred

End-User Data — Loyalty Program (Stamp Cards)

When a merchant activates the stamp-card / loyalty feature, the following data is processed per customer for the purpose of running the merchant's loyalty program:

• Customer e-mail address — Provided by the customer during checkout in the merchant's shop. Used as the unique identifier of the customer's stamp card. We store it in cleartext because we send the stamp and reward e-mails to the customer on the merchant's behalf (through our e-mail delivery provider Resend), and because the merchant sees the address in their stamp-card overview — for example to resend a reward. A SHA-256 hash of the address is used for unambiguous matching and lookup.
• Order metadata — Shopify Order ID, order name (e.g. #1001), order value, order currency, order timestamp. We do not store line items, shipping addresses, or payment details.
• Address per stamp event — Each stamp event records the e-mail address that particular order was stamped with. This lets us answer access and erasure requests (Art. 15 / 17 GDPR) in full, even after the stamp card has followed a change of the customer's account address. This address is anonymised after 18 months.
• Stamp count — How many stamps the customer has collected toward the next reward.
• Reward status — Whether a reward (discount code) has been issued, whether it has been redeemed, when it expires.
• Refund events — If a stamping order is later cancelled or refunded, we log the event for transparency and (depending on merchant configuration) reverse the stamp.

End-User Data — Wallet Pass (Apple Wallet / Google Wallet)

Google Wallet is active; Apple Wallet is currently not active. Until Apple Wallet is enabled, no Apple Wallet passes are issued and no data is transmitted to Apple. The parts of the description below that concern Apple apply from the moment Apple Wallet goes live; we publish them in advance so that the processing is documented before it starts, not after.

If a customer chooses to add an echomate stamp-card to Apple Wallet or Google Wallet:

• Pass-personalisation data — Merchant's shop name & brand color and the customer's current stamp count; this data is embedded in the pass itself. As its serial number the pass carries a card number derived from the stamp card — not the customer's e-mail address, which is not embedded in the pass.
• Device registration token (Apple only) — When the customer adds the pass to Apple Wallet, Apple sends us a device-token via the PassKit Web Service so we can notify the device when the stamp count changes. We do not receive any other Apple-account information.
• Pass identifier & auth token — Stored server-side in our wallet_pass_registration table so we can authenticate pass-update requests from Apple Wallet (once it is enabled) and send stamp updates to Google Wallet.
• Transfer to Apple / Google — Pass-personalisation data is transmitted to Apple Inc. (USA) and Google LLC (USA) when the pass is downloaded / updated. These transfers happen under the EU-US Data Privacy Framework. Customers can remove the pass from their wallet at any time, which deletes the device-side data.

3. What Data We Do NOT Collect

• We do not use cookies on redirect pages
• We do not collect names, e-mail addresses, or personal identifiers of end-users outside the explicit loyalty / wallet-pass features (which are merchant-activated and customer-triggered by placing an order or adding a pass)
• We do not sell data to third parties
• We do not use the data for advertising
• We do not store raw IP addresses (only daily-rotated hashes)
• We do not read order line items, shipping addresses, or payment-card data — only order total + currency + ID

4. How We Use Data

• Analytics — Aggregate scan/click counts, device breakdowns, country distribution
• A/B Testing — Random variant selection (no user profiling)
• Rate Limiting — Prevent abuse (IP-based, in-memory only)
• Store Health — Google PageSpeed API calls on merchant's behalf
• Loyalty Program — Track stamp count per customer, issue reward discount codes when threshold is reached, send reward / status e-mails to the customer on the merchant's behalf
• Wallet Pass — Generate Apple-Wallet (.pkpass) and Google-Wallet pass objects when a customer requests one, push updates to the customer's device when the stamp count changes

5. Legal Basis for Processing (GDPR Art. 6)

• Merchant data — Art. 6(1)(b) GDPR (contract performance: the merchant installed the app to receive the service)
• Anonymous tracking data (QR / link) — Art. 6(1)(f) GDPR (legitimate interest of the merchant in measuring the effectiveness of their own marketing materials, balanced against the customer's privacy via the anonymisation measures listed in § 2)
• Loyalty program data — Art. 6(1)(b) GDPR (pre-contractual / contractual measure: the customer participates by placing a qualifying order in the merchant's shop, in accordance with the merchant's loyalty terms and conditions which the merchant publishes separately)
• Wallet-pass data — Art. 6(1)(b) GDPR (the customer triggers the pass creation by tapping “Add to Apple/Google Wallet”, expressing their wish to receive the loyalty benefit through their wallet)

6. Data Storage & Security

• Data is stored in Supabase (PostgreSQL, EU region Stockholm) with Row-Level Security (RLS) enabled
• All connections use HTTPS/TLS
• API keys are stored as SHA-256 hashes (never in plain text)
• Shopify session tokens are encrypted
• Wallet-pass cryptographic certificates are stored as environment variables and never logged
• Our servers run on a dedicated VPS with Docker containerisation, hosted in the EU

7. Data Retention

• Analytics data: Free plan — 14 days; Growth plan — 180 days; Pro / Business plan — 400 days. A daily cron job removes expired records. Uninstalling the app deletes all data regardless of the period.
• Loyalty / stamp-card data: Deleted when the customer's stamp card is inactive for 24 months (no new order, no reward redemption) and there are no overriding merchant-side bookkeeping obligations. Audit-logs (stamp_event) are anonymised after 18 months.
• Wallet-pass registrations: Deleted together with the stamp card — after 24 months of inactivity, or earlier on a deletion request or when the shop uninstalls echomate. Removing a pass from Google Wallet is not reported to us. For Apple Wallet (once enabled) the removal is reported and the registration is deleted immediately.
• App uninstall: Merchant data is permanently deleted as soon as Shopify delivers the shop/redact request (48 hours after uninstalling); in any case, a daily run deletes the data of every store uninstalled for more than 7 days.
• Right-to-be-forgotten: On request via the customers/redact webhook (Shopify) or via direct contact, we delete the affected customer's data within 30 days, except where statutory retention obligations (e.g. tax/commercial law on the merchant side) require otherwise.
• Backups: Deleted data and files remain in our encrypted backup copies for up to 35 days and are then removed automatically. If a technical fault delays the deletion, we complete it as soon as the fault is resolved.

8. Third-Party Services (Sub-processors)

• Shopify — Authentication, billing, order webhooks, customer data requests
• Supabase — Database hosting (EU region)
• Hostinger (VPS) — Application hosting (EU region, Frankfurt)
• Alpin-Code Hub (our own, internal) — Routes all outbound transactional e-mails (reward e-mails, status e-mails, performance alerts) through a central proxy so we can rotate keys and apply consistent branding. The Hub is self-hosted in the EU and talks to Resend (EU region) for actual delivery. Only the recipient e-mail address, subject, and body are transmitted.
• Apple Inc. (not active — Apple Wallet is not enabled) — PassKit Web Service (USA, EU-US Data Privacy Framework). Would receive pass-update notifications for Apple-Wallet customers once Apple Wallet goes live. No data is currently transmitted.
• Google LLC — Google Wallet API (USA, EU-US Data Privacy Framework). Receives the pass data and pass updates for customers who add their stamp card to Google Wallet.
• Google PageSpeed Insights API — Store health scanning (merchant-initiated only)
• Google Analytics 4 — Optional, merchant-configured for their own GA4 property. Forwards anonymised aggregate events.
• Meta (Facebook Pixel) / Google Ads / TikTok Pixel — Optional retargeting, merchant-configured. Disabled by default. When a merchant enters a pixel ID, the corresponding provider receives scan/click events from the redirect page.

9. GDPR Compliance

We comply with the General Data Protection Regulation (GDPR):

• We process data based on the legal bases listed in § 5
• We act as processor for the merchant's loyalty / wallet-pass data (the merchant is the controller of their own customers' data).
• We support Shopify's mandatory GDPR webhooks:
  • customers/data_request — We respond with any data we hold about the customer (stamp count, reward status, anonymised tracking) within 30 days
  • customers/redact — We delete the customer's stamp card, wallet-pass registration, and any tracking entries we can resolve to them within 30 days
  • shop/redact — We delete all shop data within 48 hours of receiving the webhook (Shopify-mandated 48-hour window)
• End-users (customers) request deletion of their data from the merchant whose shop they used. The merchant is the controller and passes the request on to us.
• Two transfers to the USA do take place. (1) E-mail delivery: Our e-mail delivery provider Resend (Plus Five Five, Inc., USA) sends the transactional e-mails. Delivery itself runs on EU servers, but the provider is based in the USA, and what matters legally is potential access — not where the data sits. The transfer is covered by the EU-US Data Privacy Framework (Resend is certified) with Standard Contractual Clauses (Module 2) as a fallback. Only the recipient address, subject and body are transmitted.
• (2) Google Wallet (§ 8): When a customer adds the stamp card to Google Wallet, we transmit the pass data (card identifier, stamp count, shop name, once a reward is issued its discount code; no customer name) to Google and update it whenever the stamp count changes. The recipient for data from the EEA is Google Ireland Limited (Dublin). Further processing by Google LLC in the USA relies on the EU-US Data Privacy Framework (Google LLC is certified), with the Standard Contractual Clauses of the Google Controller-Controller Data Protection Terms as a fallback. Google processes this data as an independent controller. The transfer only takes place for customers who add the pass themselves. Apple Wallet is not enabled; no data is transmitted to Apple.

10. Your Rights

As a merchant or end-user, you have the right to:

• Access the data we hold about you (Art. 15 GDPR)
• Request correction of inaccurate data (Art. 16)
• Request deletion of your data (Art. 17 — subject to retention obligations in § 7)
• Object to data processing (Art. 21)
• Restrict processing (Art. 18)
• Export your data in a machine-readable format (Art. 20 — available via CSV export and REST API for merchants; via “customers/data_request” for customers)
• Withdraw consent at any time, where consent is the legal basis
• Lodge a complaint with a supervisory authority (the data-protection authority of your habitual residence)

11. Loyalty Program — Information for Customers

If you have collected stamps on a merchant's shop powered by echomate:

• The merchant is the controller of your data — questions about “Why did I lose a stamp?” or “When does my reward expire?” should go to the merchant.
• echomate is the processor — we run the technical system on the merchant's behalf under a Data Processing Agreement.
• You can request deletion of your stamp card at any time from the merchant who issued it.
• If you add the stamp card to Google Wallet, you can remove it there at any time. We do not learn of this removal; our assignment is deleted together with the stamp card. For Apple Wallet (once enabled), removing the pass also removes the device registration on our side.

12. AI Connections (Claude, ChatGPT)

If you connect echomate to an AI assistant — for example Claude (Anthropic) or ChatGPT (OpenAI) — we process the following data about you as the merchant:

• Consent records: the store, the assistant, the rights you granted, when you granted, restricted or revoked them, and the Shopify user who approved the connection.
• Call log: for every request the assistant makes, the endpoint, the result, the time and the connection it came from. The log contains neither the content of the request nor an IP address.

Purpose: proof of your consent, detecting and clarifying misuse and disputes, and the overview of what the assistant did in your echomate settings. Legal basis: Art. 6(1)(b) GDPR (providing the connection you requested) and Art. 6(1)(f) GDPR (legitimate interest in security and proof).

Retention: call-log entries are deleted 90 days after they were written. Consent records are kept for 3 years after the end of the calendar year in which the connection ended, then deleted. You can end a connection at any time in the echomate settings (AI connections) or in the assistant.

The AI provider: while the connection is active, the assistant receives the store data it requests from echomate (for example QR codes, links and analytics) on your instruction. The provider (Anthropic PBC or OpenAI, L.L.C., both USA) processes this data under its own terms and is itself responsible for it; it is not a sub-processor of echomate.

13. Contact

For privacy inquiries, data requests, or questions:
Email: support@echomate.shop
Developer / Operator: Valerian Huber
Address: Dahlienweg 11, 83109 Großkarolinenfeld, Germany
Brand: Alpin-Code (alpin-code.de)