Privacy Policy

EU Withdrawal Form & Button (the "app") is operated by Appsentials, Luis Benz, Comeniusstr. 4, 01307 Dresden, Germany. Contact: hello@monetais.de. This policy describes which data the app processes when a merchant installs it from the Shopify App Store and when a merchant's customers use the withdrawal form. Last updated: October 2026.

Roles

For the data of a merchant's customers, the merchant is the controller and we process the data on the merchant's behalf (processor, Art. 28 GDPR). For the merchant's own store and account data, we are the controller.

What the app processes

• Store and session data. The myshopify domain, Shopify-issued API tokens and the name and email of the staff member who opened the app, required to operate the app.
• App settings. Form and button configuration, the notification email address and, if set up, the merchant's own sending domain.
• Withdrawal declarations. When a customer submits the withdrawal form: first and last name, email address, order number, order date, total and line items, the selected reason and optional notes, the language, and the IP address and browser user agent at the time of submission (as proof of when the declaration was made).
• Order data from Shopify. To verify a declaration and check the withdrawal period, the app reads the matching order. If the merchant enables it, the app creates a return in Shopify.
• Billing. The plan is managed by Shopify; the app only stores the plan name and status.

The data is used solely to provide the withdrawal function: storing the declaration, confirming it to the customer, notifying the merchant and showing it in the app. It is not sold, not used for advertising and not shared with third parties beyond the service providers below.

Service emails to merchants

After an install we send the store's contact email a few short service emails about the app: a welcome with the first setup step, one request for an App Store review after a week (with at most one reminder) and, after an uninstall, one question about what was missing. For this we use the store's contact email, store name, country and the install and uninstall dates provided by Shopify. Legal basis: our legitimate interest in looking after our merchants (Art. 6(1)(f) GDPR, § 7(3) UWG). Every email has an unsubscribe link; after unsubscribing we send no further emails of this kind. Unsubscribes and feedback answers are kept until you ask us to delete them.

Service providers

• Fly.io – hosting of the app and its database, region Frankfurt, Germany (EU).
• Resend – sending the confirmation email to the customer and the notification to the merchant (EU region).
• Brevo (Sendinblue SAS, France, EU) – sending the service emails to merchants described above.
• Shopify – the app runs inside Shopify and reads and writes data through the Shopify API.

Retention and deletion

Withdrawal declarations are kept until the merchant deletes them, or automatically after the period the merchant sets in the app settings. When a merchant uninstalls the app, all withdrawal declarations of that store are deleted; the remaining store data is deleted when Shopify sends the shop redaction request (48 hours after uninstalling). Data of an individual customer is deleted when the merchant or Shopify requests it via Shopify's mandatory privacy webhooks.

Your rights

Under the GDPR you have the right to access, rectification, erasure, restriction of processing, data portability and objection, and the right to lodge a complaint with a supervisory authority. Customers of a merchant should contact the merchant first, as the merchant is the controller of their data; we support the merchant in answering the request. You can also contact us at hello@monetais.de.