Section Store: privacy notice and data processing terms

1. Who is responsible

BrandUp Factory GmbH
Tilsiter Str. 174, 22047 Hamburg, Germany
Managing director: Tim Meyer
Commercial register: HRB 186196, Amtsgericht Hamburg
Privacy contact: info@brandupfactory.com

2. In short

• The app stores data about your shop and the sections you build, not about your customers.
• Section statistics are off by default. When you switch them on, a Shopify web pixel counts views, clicks, add-to-carts and orders per section, only when the visitor's privacy choices allow analytics, and we store only daily totals per section.
• We do not sell data, do not use it for advertising, and do not build profiles of visitors or make automated decisions about them.

3. Data about your shop

When you install and use the app we process:

• Shop details from Shopify: shop domain, shop name, the shop's e-mail address, Shopify plan, timezone and store languages. The shop currency is read when needed and not stored.
• App use: app language, date of installation and of the last visit, onboarding progress, the app pages opened in the first 14 days after installation (page addresses and times only, to improve getting started), the state of the review prompt including private feedback and a rating if you send them, and whether statistics are switched on.
• Your sections: what you enter in the builder (texts, links, image addresses, colours, translations, visibility rules, store addresses for the store locator), the last 25 saved versions per section, whether a section is placed in your theme, and fonts and colours read from your theme so sections match it. The generated section code is stored at Shopify as app data of your shop.
• Purchases and subscriptions: which sections you bought, the Shopify charge ID, price, currency, status and dates; the Shopify subscription ID, its status and dates. Payments are handled by Shopify; we never see payment details.
• Store analysis (Enterprise): scores, findings and examples such as page addresses or product titles, for the last 20 analyses.
• Section wishes and votes you submit.
• AI pages (Enterprise), when you use them: the checked draft (chosen sections and their texts), the chosen product's ID and title, the language, token counts and a cost estimate. Your brief, the product's description and price and the text sent to the AI service are not stored as such, but the stored draft can quote them.

Purpose: providing the app and its features, access to purchased sections, billing and support. Legal basis: Art. 6(1)(b) GDPR (contract); for purchase and subscription records also Art. 6(1)(c) GDPR (statutory accounting obligations).

4. Access tokens

Shopify issues access tokens (OAuth) to the app so it can work on your shop with the permissions you granted. We store them with the session in our database: an access token valid for one hour, a refresh token valid for 90 days that changes with every refresh, and the granted permissions. If Shopify issues a user-specific session, it can also contain the staff member's user ID, name, e-mail address and locale. Sessions are deleted when the app is uninstalled. Legal basis: Art. 6(1)(b) GDPR.

5. Getting-started e-mails

Shops that installed the app on or after 3 November 2026 and have no section live yet receive at most three e-mails about getting started at the shop's e-mail address: about 1, 3 and 7 days after installing, at least 40 hours apart. None are sent once a section is live or later than 14 days after installing. They name your shop and, if you saved one, your newest section.

Every e-mail contains an unsubscribe link (and a one-click unsubscribe header); after unsubscribing no further e-mails of this kind are sent. We store when each e-mail was sent and when you unsubscribed. The e-mails are delivered by Resend. Legal basis: Art. 6(1)(f) GDPR (our legitimate interest in helping merchants use an app they installed); you can object at any time with the unsubscribe link.

6. Support, help and feedback

When you write to us through the support form, the help widget, the review feedback or a section wish, the message is sent by e-mail (delivered by Resend) to info@brandupfactory.com together with your shop domain and, where you provide them, your name and e-mail address. We use it to answer you. Review feedback and section wishes are also stored in our database. Legal basis: Art. 6(1)(b) and (f) GDPR.

7. Section statistics (optional, visitors of your store)

Statistics are off until you switch them on on the Performance page. Switching them on asks Shopify for two additional permissions (write_pixels, read_customer_events) and adds our web pixel to your store; switching them off removes it.

When the pixel runs

The pixel is registered with Shopify as an analytics pixel (not marketing, no sale of data). Shopify runs it only when the visitor's privacy choices allow analytics, according to your store's customer privacy settings. If a visitor withdraws consent during a visit, the pixel stops sending and discards counters not sent yet. It runs in Shopify's sandbox and sets no cookies of its own.

What it reads in the visitor's browser

• Events of Section Store sections: the section's identifier, template ID and variant when the section is seen (at least half visible for one second), clicked, or its add-to-cart form is used.
• Shopify's standard events: the page path, the product ID on product pages, the product ID and line total of an add-to-cart, and the order ID and order total of a completed checkout.

What it keeps in the browser

In the browser's session storage (key ss_seen, removed when the browser session ends; entries older than 12 hours are dropped): the sections seen with time, page path and product ID, up to 10 order IDs (so that an order is counted once) and counters not sent yet.

What it sends to us

Batches of counters: your shop's ID in our database and, per event, its type (view, click, add-to-cart, order), the section identifier, template ID, variant, time, amount and currency (add-to-carts and orders) and the order ID (orders only). It sends no names, e-mail addresses, postal addresses, phone numbers, customer IDs, page paths or product IDs.

What we store

Only daily totals per section: views, clicks, add-to-carts and their value, orders and revenue attributed to sections, and the number of orders in other currencies. We do not store order IDs or IP addresses. The order ID is kept in the server's memory for at most 48 hours so that each order is counted once. For rate limiting, the server computes a hash of the sender's IP address in memory; neither the address nor the hash is written to the database or to our application logs.

The figures are not used for profiling, advertising or automated decisions, and they are not sold. Daily totals are deleted after 13 months at the latest.

Roles

For this processing the merchant is the controller and BrandUp Factory GmbH is the processor (section 13). The merchant decides whether statistics are switched on and informs the visitors, for example in the store's privacy policy and consent banner.

8. Store analysis (Enterprise)

When you start a store analysis, or the weekly analysis runs (you can switch it off), the app reads data of your store through the Shopify Admin API (shop details, up to 250 newest products, up to 50 collections, the live theme), loads public pages of your storefront like a visitor (home page, a product page, a collection page, robots.txt, sitemap.xml and the policy pages) and sends the public addresses of these pages to Google's PageSpeed Insights API and your store's domain to Google's Chrome UX Report API. No visitor or customer data is involved. Legal basis: Art. 6(1)(b) GDPR.

9. Other services the app uses

• The app's interface loads Shopify App Bridge and the Inter font from Shopify's CDN (cdn.shopify.com).
• Builder previews and sample content can load sample images from Unsplash (images.unsplash.com) and, to show your theme's fonts, fonts from Google Fonts (fonts.googleapis.com, fonts.gstatic.com). Your browser connects to these services directly, which transmits your IP address to them.
• "Find missing coordinates" (store locator and other sections with addresses) sends the address you entered from our server to OpenStreetMap Nominatim (nominatim.openstreetmap.org).
• Sections can embed third-party content that you configure in your store, such as maps or videos (videos load only after a click). Embedding them is your choice as the store owner.

Sections are shown in your store by Shopify from the app data; visitors' browsers do not connect to our servers for them. The only exception is the statistics pixel, when you switch statistics on.

AI pages (Enterprise)

Only where this feature is switched on, and only when you ask for a draft: our server sends your brief, the title, URL handle, description and price of the product you chose (if any), the store language, your theme's fonts and colours, and our list of sections to the API of Anthropic PBC (Claude). The app sends no data about your customers or visitors; please do not enter personal data in the brief. The answer is a draft that the app checks; nothing is written to your store until you click Create, and adding sections to your theme stays your step in the theme editor. Legal basis: Art. 6(1)(b) GDPR.

10. Service providers

• Shopify: the platform the app runs on (installation, permissions, billing, app data, the web pixel).
• Heroku (Salesforce, Inc.): hosting of the app servers, including the statistics endpoint; data may be processed in the USA.
• Amazon Web Services: the database, region eu-central-1 (Frankfurt, Germany).
• Resend: delivery of e-mails (getting-started e-mails, support and feedback messages); USA.
• Google: PageSpeed Insights and Chrome UX Report for the store analysis; only public store addresses.
• OpenStreetMap Foundation (Nominatim): addresses for "Find missing coordinates", only when you use it.
• Anthropic PBC: writes the drafts for AI pages, as our processor; receives what section 9 lists, only when you ask for a draft. USA.

Where data is processed outside the EU/EEA, the transfer is based on the EU-US Data Privacy Framework where the provider is certified under it, and otherwise on the EU Standard Contractual Clauses (Art. 46 GDPR).

11. How long data is kept

• Sessions and access tokens: deleted when the app is uninstalled. Shopify deletes the app data in your shop (including the generated section code) at the same time.
• 48 hours after uninstalling, Shopify sends us a deletion request (shop/redact). We then delete section settings and versions, statistics and store analyses, and remove shop details, e-mail state, feedback and preferences from the shop record. Section wishes stay in the wish list without a link to your shop; your votes are deleted.
• Kept after that: the shop record reduced to its ID, shop domain and dates, with the purchase and subscription records, for statutory accounting retention and so that purchased sections are available again after a reinstall.
• While the app is installed: section versions: the last 25 per section; store analyses: the last 20 per shop; statistics: at most 13 months.
• Support e-mails: in our mailbox as long as needed to handle the request and as statutory retention rules require.
• Logs: server logs at Heroku, according to the provider's retention period.
• AI pages: the runs of the current month and the last 20 older ones per shop. When the app is uninstalled the drafts and product references are deleted; status, token counts and the cost estimate stay until the deletion request (shop/redact). Unsaved changes in the review stay in your browser's session storage. Sections you created stay like any other section.

12. Security

• All connections to the app and to the statistics endpoint use HTTPS (TLS).
• Access to production systems is limited to staff of BrandUp Factory GmbH who need it for their work.
• Requests from Shopify (webhooks) are verified by signature; purchase return addresses are signed.
• The statistics endpoint accepts only bounded counters for shops with statistics switched on, and it is rate limited.
• Connections from the app to the database are encrypted (TLS).

13. Data processing terms for section statistics (Art. 28 GDPR)

These terms apply between BrandUp Factory GmbH (processor) and each merchant using Section Store (controller) for the personal data of store visitors processed through the statistics pixel. By installing and using the app and switching on statistics, the merchant agrees to these terms. They apply alongside the Shopify Partner Program Agreement and Shopify's API terms under which the app is provided.

• Subject matter and duration: counting section views, clicks, add-to-carts and orders for the merchant's store, from switching statistics on until they are switched off or the app is uninstalled and the data is deleted.
• Nature and purpose: collection in the visitor's browser by the web pixel, transmission, aggregation into daily totals per section, storage and display in the app, solely to show the merchant how its sections perform.
• Types of data: event data from the visitor's browser (section identifier, time, page path and product ID, which stay in the browser, order ID, cart and order amounts with currency) and the IP address of the request (used only for transmission and rate limiting, not stored).
• Data subjects: visitors and customers of the merchant's online store.
• Instructions: we process the data only as described on this page and as set by the merchant in the app (statistics on or off), unless the law requires otherwise. We tell the merchant if we believe an instruction infringes data protection law.
• Confidentiality: everyone authorised to process the data is bound to confidentiality.
• Security: we take the technical and organisational measures described in section 12 (Art. 32 GDPR).
• Sub-processors: the merchant authorises Shopify, Heroku (Salesforce, Inc.) and Amazon Web Services as listed in section 10. We bind sub-processors to equivalent data protection obligations. We announce changes by updating this page and its date before the change takes effect; a merchant who objects can switch statistics off or uninstall the app.
• Assistance: we help the merchant to answer data subject requests and to meet its obligations under Art. 32 to 36 GDPR, as far as the nature of the processing allows. Our data contains only daily totals without identifiers, so it cannot be linked to an individual visitor.
• Personal data breaches: we notify the merchant without undue delay after becoming aware of a breach affecting this data.
• Deletion: daily totals are deleted after 13 months at the latest, and completely after the deletion request Shopify sends 48 hours after uninstalling; earlier on request.
• Information: we make available the information needed to demonstrate compliance with these terms. Contact: info@brandupfactory.com.

14. Requests from your customers

Section Store stores no data about individual customers or visitors of your store: no customer profiles, names, e-mail addresses or order details, only daily totals per section. If a customer asks you for access to or deletion of their data, nothing in our systems relates to them. Shopify forwards such requests to us automatically (customers/data_request and customers/redact); we acknowledge them, and there is nothing to return or delete. You can forward other requests to info@brandupfactory.com.

15. Your rights

You have the right of access, rectification, erasure, restriction of processing, data portability and objection (Art. 15 to 21 GDPR), and you can withdraw a consent at any time with effect for the future. Write to info@brandupfactory.com. You can also lodge a complaint with a supervisory authority, for example the Hamburg Commissioner for Data Protection and Freedom of Information.

16. Changes

We update this page when the app changes. Changes to the sub-processors for statistics are announced here before they take effect. The date at the top shows the last change.

17. AI assistants (optional, Enterprise)

You can connect an AI assistant of your choice (for example Claude, ChatGPT or Cursor) on the page "AI assistant". Nothing happens until you click Connect in your Shopify admin; Disconnect ends the access at once.

What we store

• About the assistant: the name and return addresses it registered with. This record contains no data about your shop; if it never gets connected, it is deleted after 7 days.
• For each connection: your shop, the assistant's name and return address, when it was connected and last used, and the staff member who connected it (Shopify user ID, or the name if the session contains it).
• Only SHA-256 hashes of the connection's secrets, never the secrets themselves: access tokens (valid for 1 hour), refresh tokens (valid for 60 days, changing with every refresh), authorization codes (5 minutes) and confirmation tokens for changes (10 minutes, 30 minutes for changes waiting for your approval). Waiting changes also store the old and new values and who approved or rejected them. Expired hashes are deleted once a day.
• A log of what assistants changed: time, the assistant's name, which setting or deal, and the old and new values. It is used to undo changes and is deleted after 30 days.

What the assistant receives

When the assistant asks, it receives your shop's name, domain and currency, your plan and granted permissions, deals, section settings, and the titles, handles, status, images and variant prices of products and collections, read with the app's access to your shop. Customers and orders are not available to it. It cannot touch billing, section purchases or themes.

What the assistant receives goes to its provider. You choose that provider and use it under your own agreement with them; it is not a service provider of ours and we send it nothing on our own initiative. The app itself does not use any AI service.

Rate limits and deletion

For rate limiting, the server computes a hash of the sender's IP address in memory; neither the address nor the hash is written to the database or to our application logs. Disconnecting deletes the connection with its hashes. Uninstalling the app and the deletion request (shop/redact) delete all connections and the change log of your shop. Legal basis: Art. 6(1)(b) GDPR.