Privacy Policy

Struxify Inventory & PO (website inventory.struxify.io and Shopify app) · Last updated: 21 October 2026

This English translation is provided for convenience. The German version is legally binding: German version.

Summary: I only process what is necessary for the waiting list or for operating the app. No advertising cookies, no tracking, no sale of data, no use of AI. From your Shopify orders the app reads only item, quantity and date – no names, addresses or payment data of your customers. You can request access, rectification and erasure at any time by email.

1. Controller

Struxify — Inh. Dávid-Dennis Warning
Bürgermeister-Steenbock-Straße 21 a, 24558 Henstedt-Ulzburg, Deutschland
Email: hello@struxify.io

I am not required to appoint a data protection officer. For data protection questions you can reach me at the address above.

2. Visiting the website

When you access inventory.struxify.io, my hosting provider processes technically necessary data (IP address, time, page accessed, browser identifier) in server logs in order to deliver the page and protect it against misuse. The legal basis is my legitimate interest in secure operation (Art. 6(1)(f) GDPR). The logs are deleted automatically by the hosting provider, after 30 days at the latest. I only keep individual entries longer where this is necessary to investigate a specific security incident.

Hosting: Railway Corporation (USA), data centre in the EU (Netherlands). I deliver the fonts, scripts and graphics of this website myself; your browser does not load any content from third-party servers when you visit.

I do not use any cookies or any analytics or advertising tools on this website and do not store anything on your device. A consent banner is therefore not required. The language (German/English) results solely from the address accessed.

Live demo on the home page

When you enter a store address plus stock, sales and lead time in the live demo, the app's server fetches the publicly visible product data of that store once (product name, variant, SKU, price – the same details every visitor sees in the store) and calculates an example with it. The store address, the numbers you enter and the product data are processed in memory only for the duration of that one calculation and are neither stored nor logged. To prevent abuse I limit the number of requests per IP address (truncated hash, in memory only). The legal basis is Art. 6(1)(f) GDPR (demonstrating the software at your request).

3. Waiting list (“Coming soon”)

If you sign up for the waiting list, I process your email address and – voluntarily – your name or company, shop address and the desired plan. The purpose is to inform you by email about the launch of Struxify Inventory & PO in the Shopify App Store. I also use the entry to allocate the early-access places (Terms of Use section 8.3): if a shop chooses the Pro plan in the app, I match the shop and contact email address stored at Shopify and the shop domain against the waiting list and note on the entry which shop redeemed the place.

Legal basis: your consent (Art. 6(1)(a) GDPR).
Double opt-in: After you sign up I send you a confirmation email. Only after your confirmation are you on the list. As proof I store the times of sign-up and confirmation, the language of your sign-up and a truncated hash value of your IP address (the IP address cannot be recovered from it).
Withdrawal: at any time via the “Delete my entry” (Eintrag löschen) link in every email or informally by email to me. Your data will then be deleted immediately. The lawfulness of processing up to the withdrawal remains unaffected.
Storage period: I automatically delete unconfirmed entries after 30 days. I delete confirmed entries once I have informed you about the launch and the early-access window (60 days after the launch notification) has ended, at the latest 30 days thereafter, and immediately upon your withdrawal. I use the order of confirmation to allocate the early-access places. The emails sent remain in the sending log of the email service Resend for up to 30 days.
I do not send a newsletter and do not pass the data on to third parties for advertising purposes.

4. Use of the Shopify app

4.1 Merchant (shop) data

For the app I process the shop domain, the access credentials provided by Shopify (access token), your settings (calculation rules, sender details and logo for purchase orders), your suppliers (company name, business contact data, lead time, MOQ, customer number), your mapping per item (supplier, supplier item number, purchase price, MOQ, pack size) and the purchase orders you create. The legal basis is the performance of the usage contract (Art. 6(1)(b) GDPR). As evidence I store the time, the version and the Shopify user ID of the person who accepted the Terms of Use. I do not process your supplier data, including the contact data of contact persons, for my own purposes but as a processor on your instructions (section 4.2 and DPA); you are responsible for the legal basis towards your suppliers.

4.2 Data from your shop (processing on behalf)

Items and inventory: The app reads the active product variants of your shop (title, SKU, product type, inventory, selling price, cost, product image URL) and stores them to calculate velocity, reorder points and suggestions.

Orders: To calculate sales velocity the app reads the line items of your Shopify orders of the last 90 days – exclusively item, quantity and order date. Names, addresses, e-mails and payment data of your customers are neither read nor stored; only totals per item are stored (units sold in 30/60/90 days).

The app writes no data to your shop. For the data read you are the controller; I process it as a processor only on your instructions (Art. 28 GDPR) and exclusively for the functions of the app. Details are governed by the Data Processing Agreement (DPA).

Purchase order by e-mail: If you send a purchase order from the app to your supplier, I transmit the supplier e-mail address you entered, the PO PDF (with your sender details and logo), a short cover text and, as reply address, the e-mail address stored in your settings or your shop e-mail address to my e-mail service provider (section 5). The sender is an address of my domain under your name.

4.3 Billing

The subscription is billed via Shopify. I do not receive or store any payment data (credit card, bank details), only the plan booked, the subscription's identifier at Shopify and the start of the billing period, in order to provide the plan's scope (Art. 6(1)(b) GDPR).

5. Recipients and service providers

Shopify (Shopify International Ltd., Ireland) – the platform on which the app runs; billing is handled via Shopify.
Railway (Railway Corporation, USA) – hosting of app and database, data centre in the EU (Netherlands).
Resend (Resend Inc., USA) – sending the waiting-list emails (confirmation, launch notification) and – when you trigger it – your purchase orders to suppliers (supplier address, PO PDF). Your customers' data is not transmitted to Resend. Sent e-mails including attachments remain in Resend's sending log for up to 30 days.

Data processing agreements are in place with the service providers. I base transfers to the USA on the EU Standard Contractual Clauses, which form part of the data processing agreements of Railway and Resend (Art. 46 GDPR); where a provider is certified under the EU-US Data Privacy Framework, additionally on that (Art. 45 GDPR). I do not sell any data and do not pass it on for advertising purposes. The app does not use artificial intelligence; there is no automated decision-making within the meaning of Art. 22 GDPR – calculations are based exclusively on fixed formulas over your Shopify data and settings.

Railway and Resend are companies based in the USA and are in this respect also subject to US law. To protect against unlawful access from third countries, I store the app and database in the EU, encrypt all transmissions, transmit to the email service only the waiting-list details and – when you trigger it – your purchase orders to suppliers, and base transfers on the EU-US Data Privacy Framework or the EU Standard Contractual Clauses (information pursuant to Art. 28 of Regulation (EU) 2023/2854).

6. Storage period and erasure

As long as the app is installed: settings, suppliers, item data and purchase orders remain stored until you change or delete them; item data is overwritten with every sync, variants that no longer exist are removed.
Uninstallation: If you uninstall the app, I delete all of your shop's data (settings, suppliers, item data, purchase orders) from the app's database – immediately upon uninstallation, at the latest upon Shopify's deletion request (48 hours afterwards).
Access and erasure requests from your customers: If Shopify forwards such a request to me, I confirm receipt. Since the app does not store any data attributable to a customer, there is nothing to disclose or delete.
Server logs: automatic deletion after 30 days at the latest (clause 2); for the waiting list see clause 3.
Email enquiries to me: If you write to me directly, I delete the message as soon as your matter has been dealt with, after 12 months at the latest. I keep business correspondence relating to a contract for 6 years and documents relevant to billing for 8 years (§ 147 German Fiscal Code, § 257 German Commercial Code), in each case from the end of the calendar year.

7. Your rights

You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21 GDPR). You can withdraw consent you have given at any time with effect for the future (Art. 7(3) GDPR). Simply write to me at hello@struxify.io. If you are a customer of a shop that uses the app, please contact that shop first as the controller; I support it in responding.

You also have the right to lodge a complaint with a data protection supervisory authority, for example the one responsible for me: Unabhängiges Landeszentrum für Datenschutz Schleswig-Holstein (ULD), Holstenstraße 98, 24103 Kiel, Germany.

8. Changes

I adapt this policy when the app or the legal situation changes. The version published here applies.