Privacy Policy – HGDE MatchGrid
Last updated: 18 September 2026
This policy explains what the Shopify app HGDE MatchGrid processes. It is written for merchants who install the app and for the visitors of their stores.
1. Controller
- HGDE Studio, owner Karl Grosz
- George-Washington-Straße 239
- 68309 Mannheim, Germany
- Email: hgde.studio@gmail.com
2. What the app processes
2.1 Merchant data
| Data | Purpose | Legal basis | Retention |
|---|---|---|---|
| Shop domain (e.g. example.myshopify.com) | identify the installation | Art. 6(1)(b) GDPR (contract) | until uninstall |
| Shopify access token | technical access to the shop | Art. 6(1)(b) GDPR | until uninstall |
| App language setting | show the app in the right language | Art. 6(1)(b) GDPR | until uninstall (kept in your store, not with us) |
The finders and bundles you create (images, texts, linked products) are stored inside your own store as metaobjects in your Shopify account. We keep no copy of them. Both metaobject types are owned by the app: you can see the entries in the Shopify admin, you edit them in the app. The images sit in your Files as part of your store. The app language setting is also kept in your store, on the app installation, not on our server.
2.2 Store visitor data
We store no personal data about store visitors. No names, no email addresses, no IP addresses, no cookies, no device identifiers, no profiles and no recognition across page views.
For statistics the app only counts events in total per day, for example "finder 12 was opened 48 times today" or "card 3 was picked 12 times". These counters cannot be traced back to individuals and are therefore not personal data. No consent is required.
When a discount is used, the visitor's own cart remembers which finder they came through. That information never leaves Shopify and is not stored by us.
3. Recipients and processors
- Shopify Inc. – the platform the app and the store run on
- Fly.io, Inc. (USA) – operates the app server, located in Frankfurt am Main, Germany
A data processing agreement is in place with the hosting provider. Any transfer to third countries is based on the EU standard contractual clauses.
4. Deletion
When you uninstall the app, we delete your shop's session data; Shopify notifies us automatically. Finders and bundles live in app-owned metaobject types: uninstalling deletes their definitions. The entries are then out of reach for you and for us, and a reinstall does not bring them back; when Shopify removes them for good is up to Shopify. Images the app uploaded to your Files stay there – they belong to your store, and you delete them under Content → Files. The anonymous counters contain no personal reference and are deleted after 12 months.
On request we delete all data stored for your shop immediately: hgde.studio@gmail.com
5. Requests from your customers
Shopify forwards data and deletion requests automatically (customers/data_request, customers/redact, shop/redact). Since we store no visitor data, there is nothing to hand over and nothing to delete. That is also the answer we return to Shopify.
6. Your rights
You have the right to access, rectification, erasure, restriction of processing, data portability and objection, as well as the right to lodge a complaint with a supervisory authority.
7. Changes
We update this policy when the app changes. The current version is always available at this address.