Privacy Policy

GARAN Label & EU Warranty · Last updated: October 2026

1. Controller

Maik Gossen
Im Siekertal 6
32545 Bad Oeynhausen, Germany
Phone: +49 15168487847
Email: [email protected]

This privacy policy applies to the Shopify app "GARAN Label & EU Warranty" (German listing name "Gewährleistungslabel & GARAN", the "App") and to this website, garanlabel.app.

2. Roles: no data processing agreement needed

The App displays the official EU legal guarantee notice and, where applicable, the GARAN label in Shopify stores. To do so it does not store or process any personal data of the merchant's customers (end customers) on the merchant's behalf. The App does not read orders or customer records.

For data about merchants and their staff (see section 3) we are the controller within the meaning of Art. 4(7) GDPR. Because we do not process end-customer data on the merchant's behalf, a data processing agreement (DPA) under Art. 28 GDPR is not required to use the App.

3. Data the App processes

3.1 Merchant data

When the App is installed and used, Shopify provides or the App stores:

• the shop domain (myshopify.com address) and the Shopify session including the access token, so the App can use the Shopify APIs it has been granted
• the name, email address and locale of staff members who open the App in the Shopify admin, as delivered by Shopify in the OAuth session
• App settings (e.g. display, language, exclusions, design)
• an audit log of setting changes (which setting was changed and when)
• the plan status (Free or Pro, trial). Billing is handled entirely by Shopify; we do not receive payment details.

The GARAN data per product (guarantee duration, brand, model identifier) is stored as product metafields in your own Shopify store, not on our server.

3.2 End customers on the storefront

The notice box, graphics and scripts of the App are delivered through Shopify's content delivery network as part of your theme. The App sets no cookies, uses no local storage for tracking and embeds no analytics or advertising services. Processing in the course of delivery by Shopify is governed by the privacy policy of the respective store and of Shopify.

3.3 Images in the order confirmation email

If a merchant adds the App's snippet to the order confirmation, the image of the EU notice is loaded from our app server (garan-label-app.fly.dev). When a recipient opens the email and their mail client loads images, it requests the image from our server. For technical reasons the IP address, user agent (type of mail client), time and requested file are processed in the server logs.

We use this data solely to deliver the image and keep the server secure. We do not combine it with other data and do not use it to build usage or email-open profiles. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is the technical delivery and security of the service.

4. Purposes and legal bases

5. Hosting and recipients

Fly.io and Cloudflare are companies based in the USA, so access from the USA cannot be fully ruled out. Transfers rely on the European Commission's adequacy decision for the EU-US Data Privacy Framework where the provider is certified, and on Standard Contractual Clauses (Art. 46(2)(c) GDPR). Canada is covered by an adequacy decision of the European Commission.

We do not sell data or share it for advertising. Data is disclosed only to the providers listed above or, where required by law, to authorities.

6. Retention and deletion

• Shop, session and settings data is kept as long as the App is installed.
• After uninstalling, Shopify sends the privacy webhook shop/redact (usually 48 hours after uninstall). We then delete all data stored for that shop, including settings, audit log and sessions.
• The webhooks customers/data_request and customers/redact are implemented. Because the App stores no end-customer data, there is normally nothing to provide or delete.
• GARAN metafields live in your Shopify store and remain under your control.
• Support emails are kept as long as needed to handle the request and to meet statutory retention duties.

7. This website

This website is a static site hosted by Cloudflare, Inc. (Cloudflare Pages). When you visit it, Cloudflare processes technically necessary data (IP address, time, requested page, browser type) in server logs to deliver the site and protect it against attacks. The legal basis is Art. 6(1)(f) GDPR.

This website uses no cookies, no analytics, no tracking pixels and no embedded third-party content (no external fonts, videos or maps). Links to the Shopify App Store or EU websites only transfer data to those providers once you click them.

8. Contact by email

If you email us, we process the information you provide (email address, name, message, shop domain if given) to answer your request.

9. Your rights

Under the GDPR you have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21). Contact us at [email protected].

You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), for example the authority responsible for us, the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia (LDI NRW).

End customers of a store should contact that store with questions about their order data. The App itself holds no such data.

10. Requirement to provide data, no automated decisions

The data listed in section 3.1 is technically required to use the App. No automated decision-making, including profiling, within the meaning of Art. 22 GDPR takes place.

11. Changes

We update this privacy policy when the App, our service providers or the law change. The version published here applies.

Last updated: October 2026. German version: Datenschutzerklärung.