Privacy Policy

For the Shopify apps Hand-E AI Discounts and Hand-E Checkout Rules and for this website.
Version 1.11 · As of: October 7, 2026
This English version is a convenience translation. Only the German version is legally binding; in case of any discrepancy, the German version prevails.

1. Controller

Max Handrik, Hand-E Solutions
c/o flexdienst - #22000
Kurt-Schumacher-Straße 74
67663 Kaiserslautern
Germany

E-mail: info@hand-e.de

Full provider identification in the legal notice.

2. Processing on behalf of the merchant

The processing of order data on behalf of the merchant is governed by the data processing agreement pursuant to Art. 28 GDPR. It governs instructions, technical measures, subprocessors, deletion periods and audit rights. When the app is first started, it is presented to you for your consent together with the terms and conditions and this policy; the time and version are logged (see section 4, "Consents").

The role is not the same for all data. For the discount analytics, we act as the merchant's processor: the merchant determines the purpose and means. For error reports, usage counters, settings, the session and support communication, we act as controller; these are our own operational purposes. There is no joint controllership pursuant to Art. 26 GDPR.

For the personal data of end customers, the respective merchant is the controller; the merchant provides information about this in the privacy policy of their shop.

3. What this is about

Hand-E AI Discounts is an app for Shopify shops. It helps merchants create and analyze discounts. The app runs in the merchant's Shopify admin.

Hand-E Checkout Rules is a second app for Shopify shops. With it, merchants set rules for which payment and shipping methods appear at checkout, what they are called and in what order they are listed, and under which conditions an order is held up with a notice (checkout block). This app also runs in the merchant's Shopify admin.

Neither app stores names, addresses, e-mail addresses or payment data of the shop's end customers. Order data is processed only in the narrow extract required for the discount analytics (see section 4). Hand-E Checkout Rules stores no order data at all; what this app evaluates at checkout is described in section 5.

4. What data the app stores

Hand-E AI Discounts keeps exactly eight data sets. This list is complete:

On consents in detail

We store the shop domain, the time and one version number each; no name, no IP address. The contracting party is the merchant, not the person at the screen. If one of the documents changes, another row is added; the previous one remains, so that it stays traceable what applied when.

On the session in detail

The session table provided by Shopify technically also contains fields for first and last name and the e-mail address of the logged-in Shopify account. The app works exclusively with so-called offline sessions; these fields therefore remain empty. They exist only because the program library provided by Shopify includes them in the database schema.

On the discount analytics in detail

We store the ID of an order, not its content. No items, no customer data and no delivery addresses are taken over. An order in which no discount of this app applied is not stored at all.

What is not stored

The history of the support chat and of the discount assistant is not stored on our servers. It exists only in the browser and is gone after the page is reloaded.

Hand-E Checkout Rules

This app keeps five of the data sets listed above: session, error reports, usage counters, settings and consents. Content and purpose are the same as described above.

Code campaigns and the discount analytics do not exist there. Hand-E Checkout Rules stores no order IDs and no amounts from orders.

The rules themselves are not stored with us either: they are stored at Shopify on the respective payment customization.

5. Access to Shopify data

Hand-E AI Discounts requests exactly five permissions upon installation:

• Write discounts: to create and change discounts
• Read products: to display products and collections for selection
• Read orders: to create the discount analytics and to count the number of orders of the last 60 days, on which the plan is based
• Write files: so that you can upload your own images for the widgets on the product page. The images are then stored in your shop's files at Shopify, not with us; we only store their address in the widget's settings.
• Read rollouts: so that the app recognizes whether you give a discount via a rollout only to part of your customers. Widgets and the gift block then do not advertise such a discount to everyone. We read the name, schedule and share of the rollout as well as which discounts it changes; it contains no personal data, and none of it is stored.

No further permissions are requested. Orders are stored only in the extract described in section 4.

Hand-E Checkout Rules

This app requests three permissions: write payment customizations, delivery customizations and checkout validations. It has no access to orders, customer records or the product catalog.

The rules are evaluated at checkout, and specifically at Shopify. Shopify runs a small program component of this app there and provides it with the following information for the duration of this evaluation:

• cart total, number of items and currency
• the delivery country
• whether the buyer is logged in
• how many orders have been placed so far and how much has been spent so far
• whether certain customer tags named by the merchant are present
• which items in the cart carry certain product tags named by the merchant, belong to named collections or contain certain words in their title
• the shipping methods offered at checkout, with name and price
• the local time of the shop

None of this leaves Shopify, and none of it is stored by us. Name, address, postal code, e-mail address and phone number are not queried. The result of the evaluation is solely the information which payment and shipping methods are displayed, renamed or reordered, and whether the notice set by the merchant appears and the order is held up.

6. Artificial intelligence

The app contains two AI features: a support chat and an assistant that suggests discounts. Both use language models from Anthropic, PBC (USA).

The following is transmitted: the text entered, the previous history of the respective conversation and, for the discount assistant, names and IDs of the products and collections that were searched to answer. Customer data and order data are not transmitted.

Please do not enter any personal data into these input fields. Anthropic acts as a processor; the transfer to the USA takes place on the basis of the EU standard contractual clauses.

7. Recipients and processors

No disclosure for advertising purposes takes place. The data is not sold.

The EU standard contractual clauses apply to Anthropic. According to Anthropic's contractual terms, content transmitted via the interface is not used for training the models and is retained only to a limited extent for security purposes.

8. Legal bases

Processing takes place for the performance of the contract with the merchant (Art. 6(1)(b) GDPR); if the merchant is a company, the processing of the data of its employees is based on our legitimate interest in performing this contract (Art. 6(1)(f) GDPR). For the error reports and the usage counters, we additionally rely on our legitimate interest in a functioning and affordable operation (Art. 6(1)(f) GDPR). Providing a contact address with an error report is voluntary and is based on your consent (Art. 6(1)(a) GDPR). The log of consents is based on our legal obligation to be able to prove the conclusion of a data processing agreement (Art. 6(1)(c) in conjunction with Art. 28(9) GDPR).

9. Storage period and deletion

Entries of the discount analytics are automatically deleted after 90 days. The dashboard shows at most the last 60 days; anything older is no longer needed and is therefore not kept any longer (Art. 5(1)(e) GDPR). The deletion runs along whenever a new order is recorded.

In addition, the app implements the privacy interfaces required by Shopify:

• Information about a customer: the app stores no identifying customer data such as names, addresses or e-mail addresses. However, analytics entries may exist for the orders named in the request (order ID, time, amounts). Information about these is provided.
• Deletion of a customer: the associated entries in the discount analytics are deleted. The figures in the dashboard drop as a result retroactively; this is intended.
• Deletion of a shop: 48 hours after the app is uninstalled, Shopify sends a deletion request (shop/redact). All data of this shop is then deleted from all eight data sets listed above, including the log of consents. The session with the access token is already deleted at uninstallation.

Error reports are deleted as soon as the reported case is closed, but at the latest when the shop is deleted.

10. Automated decisions

No automated decision-making, including profiling, pursuant to Art. 22 GDPR takes place. The suggestions of the AI assistant are non-binding drafts; whether a discount is created is decided solely by the merchant.

Regarding Hand-E Checkout Rules: At checkout, this app automatically evaluates which payment and shipping methods are displayed and whether an order can be completed. The rules for this are set solely by the merchant; the app executes them on the merchant's behalf. For payment and shipping methods, at least one always remains: if all rules together would hide the last one, all hidings are discarded. A checkout block, on the other hand, can hold up an order as long as its condition applies, for example below a minimum order value; the buyer sees the merchant's notice. If a condition cannot be decided, the app does not block. Whether such a rule is a decision within the meaning of Art. 22 GDPR depends on what the merchant ties it to; the merchant is responsible for this decision.

11. Your rights

You have the right to access, rectification, erasure, restriction of processing, data portability and objection. You can withdraw any consent given at any time with effect for the future.

To do so, contact info@hand-e.de.

You also have the right to lodge a complaint with a data protection supervisory authority.

12. This website

When this page is accessed, our provider ALL-INKL.COM processes technically necessary access data (IP address, time, page visited, browser identifier) in server log files. The basis is our legitimate interest in secure operation (Art. 6(1)(f) GDPR). Without your consent, this page does not embed any third-party services and does not set any cookies; fonts and icons are delivered from our own server. This also applies to the product video on the pages of our apps: it is only loaded when you start it yourself (see "Videos from YouTube" at the end of this section).

Reach measurement with Google Analytics 4. If you consent, we use Google Analytics 4 to understand how this website is used. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

Only after consent. Before your consent, nothing is loaded, nothing is stored and nothing is transmitted to Google. You decide via the notice at the bottom edge; "Decline" and "Accept" are designed equivalently and cost the same single click. The legal basis for storing and reading information on your terminal device is § 25(1) TDDDG (German Telecommunications Digital Services Data Protection Act), for the subsequent processing of your data your consent pursuant to Art. 6(1)(a) GDPR.

What is processed. A truncated IP address, information about browser and device, the approximate location at the level of country and region, the pages visited, the referring address as well as the time and duration of the visit. In addition, it is recorded whether you read a page to the end and whether you clicked a link to an external website. Your entries in the contact form and whether you submit it are not recorded. For this, Google assigns a pseudonymous identifier and stores it in the cookies _ga and _ga_<Kennung>; these expire after at most 24 months. We receive only aggregated analyses from this and cannot identify you with them. The data is deleted after 14 months.

Transfer to the USA. Google also processes the data in the United States through Google LLC. The basis is the standard contractual clauses of the EU Commission; in addition, Google relies on the adequacy decision on the EU-US Data Privacy Framework. In the USA, there is no level of data protection equivalent to European rules; in particular, it cannot be ruled out that authorities access the data without you having an effective legal remedy available against this. With your consent, you also consent to this transfer (Art. 49(1)(a) GDPR).

Withdrawal. You can withdraw your consent at any time with effect for the future. The link "Cookie settings" is permanently located in the footer of every page; upon withdrawal, we delete the cookies set. The lawfulness of the processing carried out up to that point remains unaffected. Further information from Google can be found at policies.google.com/privacy.

Your decision itself. So that we respect your choice and do not have to ask you again on every visit, we store it as a single word ("ja" or "nein") in your browser's local storage. This is strictly necessary to provide the service you have requested (§ 25(2) no. 2 TDDDG) and requires no consent. The entry does not leave your device.

Contact form. If you write to us via the form on this website, we process the information provided there: your name, your e-mail address, voluntarily the address of your shop and the text of your message. We use it exclusively to process your inquiry. The legal basis is Art. 6(1)(b) GDPR, insofar as your inquiry aims at the conclusion or performance of a contract, and otherwise our legitimate interest in answering inquiries (Art. 6(1)(f) GDPR).

The message is transmitted as an e-mail to our mailbox at ALL-INKL.COM and stored there; a data processing agreement is in place. We delete your inquiry as soon as it has been dealt with and no statutory retention periods prevent this, at the latest after twelve months. The form itself does not use a captcha. To protect against mass-sent messages, it merely stores on the web space how many messages were sent in the current hour, without your IP address and without any other reference to your person; if there are unusually many, it accepts no more until the end of that hour. Your entries are not passed on to the reach measurement. There is no obligation to use it; instead, you can send us an e-mail at any time.

Videos from YouTube

The pages of our apps contain a short product video. It is not loaded automatically: as long as you do not start it, you see a still image that comes from our own server, and no request is sent to Google.

Only when you click the play button is the video player of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, loaded. In doing so, Google learns your IP address, the page visited and technical information about your browser. We embed the video via the address youtube-nocookie.com; according to Google, cookies are only set there upon playback. If you are logged in to Google at the same time, Google can associate the visit with your account. We have no influence on this.

The legal basis is your consent pursuant to Art. 6(1)(a) GDPR, which you give by clicking the play button; the notice about this is located directly next to it. A transfer to the USA cannot be ruled out in this context; for this, Google relies on the EU-US Data Privacy Framework and on the EU standard contractual clauses. Information from Google can be found at policies.google.com/privacy.

13. Our listing in the Shopify App Store

Our apps are offered via the Shopify App Store. The pages of the App Store are operated by Shopify, not by us; Shopify is responsible for your visit there, and Shopify's privacy policy applies. What is stated here concerns exclusively the analytics that we ourselves receive about our listing.

Reach measurement of our listing. Shopify offers providers the option to report events relating to their own listing to their own Google Analytics 4 account. We use this to recognize through which paths in the App Store our listing is found and which of them lead to an installation. The provider of Google Analytics 4 is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

Two different paths, and legally they are not the same.

• In your browser. If you view our listing or click "Install", the App Store page reports this to our account (view_item, add_to_cart). This only happens if you have consented to the measurement on the App Store page; without your consent, the App Store loads nothing from Google and sets no cookies for this purpose. The consent is obtained by Shopify, not by us. The legal basis is your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG).
• From Shopify's servers. If you complete an installation or arrive via an ad in the App Store, Shopify reports this directly from its servers to our account (shopify_app_install, shopify_app_ad_click). These reports do not pass through your device and set no cookies. They contain the ID, the name and the address of your shop as well as the place in the App Store from which you came (for example search, category or the detail page). The legal basis is our legitimate interest in knowing how our listing is found and which paths lead to an installation (Art. 6(1)(f) GDPR).

Why we nevertheless treat this as personal data. The ID, name and address of a shop are as a rule information about a company. In the case of a sole proprietorship, however, the shop address may point to a natural person. We therefore treat this information consistently as personal data instead of relying on the opposite.

Separate account, separate figures. The measurement of our App Store listing runs in a separate Google Analytics account, separate from the measurement of this website (section 12). The two data sets are not merged. Here, too, retention is limited to 14 months, and Google signals as well as detailed location collection are switched off.

Transfer to the USA. The same applies as in section 12: Google also processes the data in the United States through Google LLC, on the basis of the standard contractual clauses and, in addition, the adequacy decision on the EU-US Data Privacy Framework. A level of data protection equivalent to European rules does not exist there; in particular, access by authorities cannot be ruled out without you having an effective legal remedy available against this.

Your objection. You can object at any time to the processing based on our legitimate interest (Art. 21(1) GDPR), informally to info@hand-e.de. You withdraw your consent to the measurement in the browser on the App Store pages themselves. The installation, operation and range of functions of our apps do not depend on either.

14. Changes

If the processing changes, this policy will be adapted and the version number above increased. The next time the app is started, the new version will be presented to you for your information. The version published here at any given time is authoritative.

Further information

Terms and conditions · Data processing agreement · Legal notice