Privacy policy for the Mapasso app

This privacy policy applies to the Mapasso Shopify app. The website is covered by our website privacy policy.

1. Controller

Maik Gossen, DD-Gossen
Im Siekertal 6, 32545 Bad Oeynhausen, Germany
Email: info@mapasso.de

2. What data we process

Your store domain and Shopify access credentials, product data from your store that you assign to a passport, and the content of your passports: manufacturer with address and contact details, materials, suppliers, care, repair and recycling. The manufacturer's address and contact details appear on the public passport page. Suppliers don't. When someone opens a passport page, we store the time, country, device type, language and the host name of the website the visit comes from. We don't store the IP address. For service emails, we use the store owner's email address and your store name from Shopify, and we store which email we sent and when.

3. Purposes and legal bases

Running the app and creating your passports: to perform our contract with you (Art. 6(1)(b) GDPR).
Publishing passports with manufacturer details: on your behalf and according to your instructions.
Delivering passport pages: when a page is opened, Cloudflare and Fly.io process the visitor's IP address to deliver the page and protect it from abuse. The legal basis is our legitimate interest in secure operation (Art. 6(1)(f) GDPR). We only store the details listed in section 2, without the IP address.
Service emails: after installation, we send you a welcome email and a setup tip, based on our legitimate interest in making it easier for you to get started (Art. 6(1)(f) GDPR). Shortly before your trial ends and when your plan is almost used up, we inform you about your contract (Art. 6(1)(b) GDPR). You can unsubscribe using the link in every email. You'll still get the email about the end of your trial, because it's about charges. We don't track whether you open an email or click links.

4. Hosting

App server: Fly.io Inc., Frankfurt region
Database: Supabase, Frankfurt region
Published passport pages, earlier versions and print versions: Cloudflare R2. The location set is Europe. Cloudflare does not guarantee a storage location in the EU for this.
Delivery of passport pages at mapasso.de/01/…: Cloudflare, global network

Fly.io, Supabase and Cloudflare are companies based outside the EU. Transfers rely on the EU-US Data Privacy Framework for Fly.io and Cloudflare, additionally on standard contractual clauses for Cloudflare, and on standard contractual clauses for Supabase. Mailjet stores the data in the EU. For support and operations, Mailjet also uses service providers in the USA. These transfers rely on standard contractual clauses.

5. Recipients and subprocessors

Shopify (platform and billing, separate controller)
Fly.io Inc. (app server, Frankfurt)
Supabase (database, Frankfurt)
Cloudflare Inc. (DNS, website, storage and delivery of passport pages)
Mailjet, an email service of the Sinch group (sending service emails, storage location according to the provider: Frankfurt and Belgium)
Hostinger (mailbox info@mapasso.de, which receives replies to service emails, storage location according to the provider: France and Germany)
Google (Google Ireland Limited): we forward replies to service emails to a mailbox at Google. According to Google, it also processes data outside the EU.

Google Analytics in the Shopify App Store: on our page in the Shopify App Store (apps.shopify.com/mapasso), Google Analytics 4 measures for us how visitors find and use the page, such as where they come from, which pages they view and clicks on ‘Install’. Shopify adds the code and asks for your consent first; without consent, nothing is measured. The legal basis is your consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG). You can withdraw it via ‘Your privacy choices’ in the Shopify App Store. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google also processes data in the USA. The transfer is based on the European Commission's adequacy decision (Art. 45 GDPR). Google deletes event data after 2 months and user-level data after 14 months.

6. Retention

We store your data as long as you use the app and delete it after you uninstall, as described in section 7.

7. Deletion after you uninstall

48 hours after you uninstall, we delete all of your store's data from our database: access credentials, drafts, master data, suppliers and scan statistics. If you reinstall the app before then, the data is kept. We delete the published passport pages and their earlier versions and print versions in the passport archive at Cloudflare no later than 30 days after you uninstall. After that, your passports can no longer be accessed, not even through printed QR codes. Before you uninstall, you can export all passports as CSV or JSON-LD in the settings. If you want individual passports or earlier versions removed sooner, email info@mapasso.de and we'll do it within one month. Together with your store's data, we also delete the list of emails sent and your address at our email service Mailjet.

8. Your rights

You have the right to access, rectification, erasure, restriction of processing and data portability at any time. Send requests to info@mapasso.de.

You can object at any time to processing based on our legitimate interest (Art. 21 GDPR). You also have the right to lodge a complaint with a data protection supervisory authority, for example the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia.

9. Obligation to provide data, no automated decision-making

The details are required to use the app. Without them, we can't create passports. No automated decision-making takes place.

Last updated: 5 November 2026