Privacy Policy

1. Controller and contact

Metacom Solutions, Gerald Kapp, Fasangasse 28/2, 8075 Hart bei Graz, Austria

Email: dev@metacom.at

For merchant data (store account, settings, uploaded blanks, motifs and scene images) we are the controller. For data of a store's customers (designs, uploaded images, order reference) we act as a processor on behalf of the merchant, who is the controller. Our data processing agreement (/dpa) applies.

2. Data we process

• Store data: store domain, access token for the Shopify API, chosen settings.
• Merchant content: photos of blanks and scenes, motifs, price and variant settings, product images generated by the app.
• Customer designs: entered text, uploaded images, placement, preview images and the print files created from them (PDF, PNG).
• Order reference: order name and internal order and line item IDs, so merchants can match print files to the right order.

We do not store customers' names, email addresses, postal addresses or payment details. Uploaded images may show people; please only upload images you have the rights to.

The app sets no cookies in the store, uses no browser storage and no tracking or analytics tools. Our server logs only method, path, status and response time of requests, no IP addresses.

3. Purposes and legal bases

• Providing the app features (product designer, print files, product generator) – performance of the contract with the merchant, Art. 6(1)(b) GDPR.
• Processing customer designs on behalf of the merchant – Art. 28 GDPR; the merchant relies on performing its contract with its customers.
• Operational security, backups and troubleshooting – legitimate interest, Art. 6(1)(f) GDPR.

4. Recipients and processors

• Shopify International Limited, Ireland: the platform through which the app is installed and exchanges data.
• Amazon Web Services EMEA SARL, Luxembourg: servers, file storage and backups in the Frankfurt region (eu-central-1).

Data is stored in the EU. Where providers involve group companies outside the EU, this is based on the EU-US Data Privacy Framework or standard contractual clauses. We do not sell data or share it for advertising.

5. Retention and deletion

• Designs that were not ordered and unused uploads are deleted automatically after 90 days.
• Designs and print files of orders are kept while the merchant uses the app or until the merchant deletes them.
• When a merchant requests deletion of customer data through Shopify (customers/redact), we delete the designs, uploads and print files of the affected orders.
• After the app is uninstalled, we delete all of the store's data and files on Shopify's request (shop/redact, 48 hours later).
• Database backups are deleted automatically after 30 days.

6. Security

All connections are TLS-encrypted. Database, files and backups are stored encrypted. Files are kept in private storage and can only be retrieved through random, unguessable addresses. Requests from the store go through the Shopify app proxy and are verified by their signature.

7. Your rights

You have the right of access, rectification, erasure, restriction of processing, data portability and objection. Customers of a store should contact the merchant first; we support the merchant. Requests to us: dev@metacom.at.

You can lodge a complaint with the Austrian Data Protection Authority: Barichgasse 40–42, 1030 Vienna, www.dsb.gv.at.

8. Changes

We update this policy when the app or the law changes. The version published here applies.