ZuarbitoPrivacy policy
What data Zuarbito processes, why and for how long.
1. Controller
Engin Ucar, Overbruckstr. 73, 47166 Duisburg
Email: support@zuarbito.com, Support: https://zuarbito.com/support/
The operator is established in Germany.
2. What the app does
Zuarbito helps Shopify merchants with personalized orders: it detects missing details, sends protected links to customers, receives text and files, manages proofs and approvals, and provides the current working version for production.
3. Data we process
| Category | Examples | Source |
|---|---|---|
| Merchant data | Shop domain, shop name, shop email address, time zone, settings, subscription status | Shopify, merchant |
| Order data | Order number, line items, quantities, product references, order attributes | Shopify |
| Customer contact | Email address and name on the order, language, Shopify customer account ID | Shopify (protected customer data approved by Shopify) |
| Customer input | Text, selected options, uploaded files (JPEG, PNG, PDF), approval decisions, comments | Customer via portal or theme block |
| Technical data | Timestamps, event IDs, email delivery status, scan results, hashed access tokens | App |
We do not process payment data, address books, customer profiles or data from other orders.
The customer portal uses a technically necessary session cookie to protect forms. The app uses no analytics or advertising cookies and does not track store visits.
4. Purposes
- Completing and approving personalized orders (requests, reminders, proof approval).
- Providing production documents to the merchant.
- Security (malware scans of uploaded files, abuse protection through request limits).
- Fulfilling access and deletion requests through Shopify's privacy webhooks.
The data is not used for advertising, not sold and not used to train AI models.
5. Legal bases
We process the data of merchants who install Zuarbito to perform the usage agreement (Art. 6(1)(b) GDPR). We process the data of a shop's customers on behalf of the respective merchant under a data processing agreement (Art. 28 GDPR); the merchant is the controller for this data. Scanning uploaded files for malware, protecting against abuse and keeping technical logs are based on our legitimate interest in secure operation (Art. 6(1)(f) GDPR).
6. Recipients and processors
| Recipient | Purpose | Location |
|---|---|---|
| Shopify International Ltd. / Shopify Inc. | Platform, Admin API, Partner API | see Shopify's privacy policy |
| Contabo GmbH, München | Running web, worker, database, Redis, malware scanner | Lauterbourg, France (EU) |
| Hetzner Online GmbH, Gunzenhausen | Storing files, proofs and exports | Nuremberg, Germany |
| Resend (Plus Five Five, Inc.) | Sending transactional emails | USA, sending via Ireland |
Transfers outside the European Economic Area: When emails are sent through Resend, account and message data is stored in the United States. According to the provider, this is based on the EU standard contractual clauses and its certification under the EU-US Data Privacy Framework. Servers and database are hosted by Contabo in Lauterbourg (France, EU); uploaded files are stored by Hetzner in Germany.
7. Retention
- Active orders: for as long as they are being processed.
- Files of completed or cancelled orders: 90 days after completion (default, adjustable by the merchant).
- Exports: 24 hours. Unassigned pre-uploads: 24 hours.
- Customer links: valid for 7 days (default; the merchant can set 1 to 7 days), invalid afterwards.
- After uninstalling the app: all shop data is deleted once Shopify's request arrives, which according to Shopify happens 48 hours after uninstalling.
- Backups: 30 days; deletions take effect with the next backup cycle.
8. Security
Sensitive fields (customer contact, input, comments, tokens) are stored encrypted; access tokens are only kept as a hash. Files stay in quarantine until they pass the scan and are only delivered through short-lived signed addresses. Portal links can be revoked and expire.
9. Your rights
Access, rectification, erasure, restriction, data portability and objection can be directed to the controller: support@zuarbito.com. Requests from shop customers are also handled through Shopify's privacy webhooks within the 30-day period set by Shopify.
10. This website
This website is hosted by Contabo GmbH, München. When you visit it, the host processes technically necessary access data such as IP address, time and the page requested. The website sets no cookies, uses no tracking and loads no third-party content; fonts are served by this website. We only use details from emails you send us to handle your request.
11. Changes
Last updated: 2026-11-03. Changes are published on this page.