Privacy Policy

1. Who We Are

echomate is a Shopify app developed by Valerian Huber, operating under the brand Alpin-Code (alpin-code.de) and the Shopify-app studio shopforge.studio. echomate provides store health monitoring, QR code generation, short link tracking, link-in-bio pages, loyalty stamp cards, wallet passes, and analytics for Shopify merchants.

2. What Data We Collect

Merchant Data (Shopify Store Owners)

• Shop domain — Your myshopify.com domain, used to identify your store
• Session tokens — Encrypted Shopify session data for authentication
• Settings — Your app configuration (scan frequency, QR branding, stamp-card mechanics, etc.)
• QR codes, short links & bio pages — The QR codes, short links, and bio-page content you create
• Stamp-card configuration — Reward thresholds, trigger modes, discount-code names you select

End-User Data — Anonymous Tracking (QR scans & link clicks)

• IP address — Hashed (SHA-256) and truncated daily for privacy. We never store raw IP addresses.
• Country — Derived on our own server from a local IP-to-country database. The IP address is never sent to a third party for this.
• Device type, browser, OS — Extracted from the User-Agent header
• Referrer — Sanitized (query params and fragments stripped)
• Timestamp — When the scan or click occurred

End-User Data — Loyalty Program (Stamp Cards)

When a merchant activates the stamp-card / loyalty feature, the following data is processed per customer for the purpose of running the merchant's loyalty program:

• Customer e-mail address — Provided by the customer during checkout in the merchant's shop. Used as the unique identifier of the customer's stamp card. We store both the cleartext e-mail (for the merchant to communicate with the customer) and a SHA-256 hash (for the unique constraint).
• Order metadata — Shopify Order ID, order name (e.g. #1001), order value, order currency, order timestamp. We do not store line items, shipping addresses, or payment details.
• Stamp count — How many stamps the customer has collected toward the next reward.
• Reward status — Whether a reward (discount code) has been issued, whether it has been redeemed, when it expires.
• Refund events — If a stamping order is later cancelled or refunded, we log the event for transparency and (depending on merchant configuration) reverse the stamp.

End-User Data — Wallet Pass (Apple Wallet / Google Wallet)

This feature is currently not active. As long as it is not enabled, no wallet passes are issued and no data is transmitted to Apple or Google. The description below applies from the moment the feature goes live; we publish it in advance so that the processing is documented before it starts, not after.

If a customer chooses to add an echomate stamp-card to Apple Wallet or Google Wallet:

• Pass-personalisation data — Merchant's shop name & brand color, customer's current stamp count, the customer e-mail (used as the pass' unique serial token). This data is embedded in the pass itself.
• Device registration token (Apple only) — When the customer adds the pass to Apple Wallet, Apple sends us a device-token via the PassKit Web Service so we can notify the device when the stamp count changes. We do not receive any other Apple-account information.
• Pass identifier & auth token — Stored server-side in our wallet_pass_registration table so we can authenticate pass-update requests from Apple/Google.
• Transfer to Apple / Google — Pass-personalisation data is transmitted to Apple Inc. (USA) and Google LLC (USA) when the pass is downloaded / updated. These transfers happen under the EU-US Data Privacy Framework. Customers can remove the pass from their wallet at any time, which deletes the device-side data.

3. What Data We Do NOT Collect

• We do not use cookies on redirect pages
• We do not collect names, e-mail addresses, or personal identifiers of end-users outside the explicit loyalty / wallet-pass features (which are merchant-activated and customer-triggered by placing an order or adding a pass)
• We do not sell data to third parties
• We do not use the data for advertising
• We do not store raw IP addresses (only daily-rotated hashes)
• We do not read order line items, shipping addresses, or payment-card data — only order total + currency + ID

4. How We Use Data

• Analytics — Aggregate scan/click counts, device breakdowns, country distribution
• A/B Testing — Random variant selection (no user profiling)
• Rate Limiting — Prevent abuse (IP-based, in-memory only)
• Store Health — Google PageSpeed API calls on merchant's behalf
• Loyalty Program — Track stamp count per customer, issue reward discount codes when threshold is reached, send reward / status e-mails to the customer on the merchant's behalf
• Wallet Pass — Generate Apple-Wallet (.pkpass) and Google-Wallet pass objects when a customer requests one, push updates to the customer's device when the stamp count changes

5. Legal Basis for Processing (GDPR Art. 6)

• Merchant data — Art. 6(1)(b) GDPR (contract performance: the merchant installed the app to receive the service)
• Anonymous tracking data (QR / link) — Art. 6(1)(f) GDPR (legitimate interest of the merchant in measuring the effectiveness of their own marketing materials, balanced against the customer's privacy via the anonymisation measures listed in § 2)
• Loyalty program data — Art. 6(1)(b) GDPR (pre-contractual / contractual measure: the customer participates by placing a qualifying order in the merchant's shop, in accordance with the merchant's loyalty terms and conditions which the merchant publishes separately)
• Wallet-pass data — Art. 6(1)(b) GDPR (the customer triggers the pass creation by tapping “Add to Apple/Google Wallet”, expressing their wish to receive the loyalty benefit through their wallet)

6. Data Storage & Security

• Data is stored in Supabase (PostgreSQL, EU region) and a self-hosted PostgreSQL on our European VPS, both with Row-Level Security (RLS) enabled
• All connections use HTTPS/TLS
• API keys are stored as SHA-256 hashes (never in plain text)
• Shopify session tokens are encrypted
• Wallet-pass cryptographic certificates are stored as environment variables and never logged
• Our servers run on a dedicated VPS with Docker containerisation, hosted in the EU

7. Data Retention

• Analytics data: Free plan — 14 days; Growth plan — 180 days; Pro / Business plan — 400 days. A daily cron job removes expired records. Uninstalling the app deletes all data regardless of the period.
• Loyalty / stamp-card data: Deleted when the customer's stamp card is inactive for 24 months (no new order, no reward redemption) and there are no overriding merchant-side bookkeeping obligations. Audit-logs (stamp_event) are anonymised after 18 months.
• Wallet-pass registrations: Removed when the customer deletes the pass from their wallet (Apple/Google notifies us via webhook), or after 24 months of inactivity.
• App uninstall: Merchant data is retained for 30 days (to allow re-install), then permanently deleted via the shop/redact Shopify webhook.
• Right-to-be-forgotten: On request via the customers/redact webhook (Shopify) or via direct contact, we delete the affected customer's data within 30 days, except where statutory retention obligations (e.g. tax/commercial law on the merchant side) require otherwise.

8. Third-Party Services (Sub-processors)

• Shopify — Authentication, billing, order webhooks, customer data requests
• Supabase — Database hosting (EU region)
• Hostinger (VPS) — Application hosting (EU region, Frankfurt)
• Alpin-Code Hub (our own, internal) — Routes all outbound transactional e-mails (reward e-mails, status e-mails, performance alerts) through a central proxy so we can rotate keys and apply consistent branding. The Hub is self-hosted in the EU and talks to Resend (EU region) for actual delivery. Only the recipient e-mail address, subject, and body are transmitted.
• Apple Inc. (not active — wallet-pass feature is not enabled) — PassKit Web Service (USA, EU-US Data Privacy Framework). Would receive pass-update notifications for Apple-Wallet customers once the feature goes live. No data is currently transmitted.
• Google LLC (not active — wallet-pass feature is not enabled) — Google Wallet API (USA, EU-US Data Privacy Framework). Would receive pass-update notifications for Google-Wallet customers once the feature goes live. No data is currently transmitted.
• Google PageSpeed Insights API — Store health scanning (merchant-initiated only)
• Google Analytics 4 — Optional, merchant-configured for their own GA4 property. Forwards anonymised aggregate events.
• Meta (Facebook Pixel) / Google Ads / TikTok Pixel — Optional retargeting, merchant-configured. Disabled by default. When a merchant enters a pixel ID, the corresponding provider receives scan/click events from the redirect page.

9. GDPR Compliance

We comply with the General Data Protection Regulation (GDPR):

• We process data based on the legal bases listed in § 5
• We act as processor for the merchant's loyalty / wallet-pass data (the merchant is the controller of their own customers' data).
• We support Shopify's mandatory GDPR webhooks:
  • customers/data_request — We respond with any data we hold about the customer (stamp count, reward status, anonymised tracking) within 30 days
  • customers/redact — We delete the customer's stamp card, wallet-pass registration, and any tracking entries we can resolve to them within 30 days
  • shop/redact — We delete all shop data within 48 hours of receiving the webhook (Shopify-mandated 48-hour window)
• End-users (customers) can request data deletion by contacting the merchant (recommended, since the merchant is the controller) or us directly at support@echomate.shop
• One transfer to the USA does take place. Our e-mail delivery provider Resend (Plus Five Five, Inc., USA) sends the transactional e-mails. Delivery itself runs on EU servers, but the provider is based in the USA, and what matters legally is potential access — not where the data sits. The transfer is covered by the EU-US Data Privacy Framework (Resend is certified) with Standard Contractual Clauses (Module 2) as a fallback. Only the recipient address, subject and body are transmitted. The Apple/Google Wallet integrations (§ 8) would be a second transfer — that feature is not enabled, so it does not take place.

10. Your Rights

As a merchant or end-user, you have the right to:

• Access the data we hold about you (Art. 15 GDPR)
• Request correction of inaccurate data (Art. 16)
• Request deletion of your data (Art. 17 — subject to retention obligations in § 7)
• Object to data processing (Art. 21)
• Restrict processing (Art. 18)
• Export your data in a machine-readable format (Art. 20 — available via CSV export and REST API for merchants; via “customers/data_request” for customers)
• Withdraw consent at any time, where consent is the legal basis
• Lodge a complaint with a supervisory authority (the data-protection authority of your habitual residence)

11. Loyalty Program — Information for Customers

If you have collected stamps on a merchant's shop powered by echomate:

• The merchant is the controller of your data — questions about “Why did I lose a stamp?” or “When does my reward expire?” should go to the merchant.
• echomate is the processor — we run the technical system on the merchant's behalf under a Data Processing Agreement.
• You can request deletion of your stamp card at any time by contacting either the merchant or us at support@echomate.shop.
• If you add the stamp card to Apple Wallet / Google Wallet, you can remove it at any time by deleting it from your wallet app — this also removes the device-registration on our side.

12. Contact

For privacy inquiries, data requests, or questions:
Email: support@echomate.shop
Developer / Operator: Valerian Huber
Address: Dahlienweg 11, 83109 Großkarolinenfeld, Germany
Brand: Alpin-Code (alpin-code.de) / shopforge.studio