Privacy policy for Codefaden Store Monitor
As of November 10, 2026, version 2. The German version is authoritative; this translation is provided for convenience.
Who is responsible
Codefaden
Najim Belhaj
Teutoburger Str. 10
46145 Oberhausen
Germany
kontakt@codefaden.de
This policy covers the Shopify app Codefaden Store Monitor and these pages on apps.codefaden.de. We have not appointed a data protection officer; there is no legal obligation to do so.
What the app processes, and why
When you install and use the app, Shopify sends us your store's myshopify domain and an access token for the app; we store both to keep the app connected (Art. 6(1)(b) GDPR, providing the app you installed). The app requests no access permissions to orders, customers or products. Through Shopify's default shop query it reads your store's name, contact email and primary domain.
For the checks, we store your store's primary domain and contact email as well as the check results: reachability, response times, outages, certificate data, links found on the homepage and their status, third parties loaded, and the SPF and DMARC records of your domain. The results are technical data about your store, not about people; the contact email can be personal data, for example if it contains a name (Art. 6(1)(b) GDPR).
Email alerts are off by default. If you turn them on, we store your store's contact email as the alert address and send an email when your store goes down and when it's back. We send these emails via SMTP through our netcup mailbox (netcup GmbH, Emmy-Noether-Straße 10, 76131 Karlsruhe, Germany). netcup processes the recipient address and message on our behalf under our data processing agreement (Art. 28 GDPR). If you change the contact address in Shopify, enabled alerts follow the new address during the next sync.
Data of your customers is not processed by the app. It has no access to orders, customer accounts or checkout, and it adds no code to your storefront.
Billing for the app is handled by Shopify. We only learn whether a subscription is active; payment details stay with Shopify, which acts as its own controller for this.
These pages
When you open apps.codefaden.de, our web server logs your IP address, date and time, request method, response status and response size, to keep the service secure and to investigate errors (Art. 6(1)(f) GDPR). The logs contain no query strings and are deleted after 14 days. These pages set no cookies, use no tracking and load fonts from our own server.
Where the data is stored
The app runs on a server of netcup GmbH, Emmy-Noether-Straße 10, 76131 Karlsruhe, Germany, in its data centre in Vienna (Austria, EU), on our behalf (Art. 28 GDPR). Encrypted backups are kept with Hetzner Online GmbH, Industriestraße 25, 91710 Gunzenhausen, Germany; Hetzner only sees encrypted data. We do not transfer data to countries outside the EU.
How long we keep it
As long as the app is installed. When Shopify notifies us of an uninstall, we durably queue deletion of your store, results, alert address and access token. Processing normally starts within a minute; temporary failures are retried automatically. A new installation is handled separately. Shopify also sends a deletion request after 48 hours. Event IDs and installation counters are kept for up to 90 days to recognize duplicate deliveries; they contain no check results or contact address. Copies in backups expire after 14 days on the server and after 90 days at the second location at the latest. Web server logs: 14 days.
Your rights
You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21). Just email us at kontakt@codefaden.de. You can also lodge a complaint with a supervisory authority, for example the one responsible for us: Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen, Kavalleriestraße 2–4, 40213 Düsseldorf, Germany.
Providing the data is necessary to use the app; without it the checks can't run. We do not use automated decision-making within the meaning of Art. 22 GDPR.