Privacy policy

Struxify B2B Quote & Agent (website b2b.struxify.io and Shopify app) · Last updated: 20 October 2026

This English version is a convenience translation. Only the German version is legally binding; in the event of any discrepancy, the German version prevails.

In short: I only process what is necessary for the waitlist or for operating the app. No advertising cookies, no tracking, no sale of data. Request texts are transmitted to Google Gemini for recognition; I send emails via Resend. You can request access, rectification and erasure at any time by email.

1. Controller

Dávid-Dennis Warning (Struxify)
Bürgermeister-Steenbock-Straße 21 a, 24558 Henstedt-Ulzburg, Germany
Email: hello@struxify.io

I am not required to appoint a data protection officer. For questions about data protection, you can reach me at the address above.

2. Visiting the website

When you access b2b.struxify.io, my hosting provider processes technically necessary data (IP address, time, page accessed, browser identifier) in server logs in order to deliver the page and protect it against abuse. The legal basis is my legitimate interest in secure operation (Art. 6(1)(f) GDPR). Depending on the hosting provider's plan, the logs are available to me for 7 or 30 days; I only look at them in the event of malfunctions or security incidents and only keep individual entries longer if this is necessary to investigate a specific incident.

Hosting: Railway Corporation (USA), data centre in the EU (Netherlands). I deliver the fonts, scripts and graphics of this website myself; no content is loaded from third-party servers when you visit.

I do not use cookies or analytics or advertising tools on this website and do not store anything on your device. The language (German/English) results solely from the address accessed.

Live demo on the home page

If you enter a store address in the live demo, my server retrieves the publicly visible product data of that store once (product name, variant, SKU, price, availability – the same information every visitor sees in the store) and matches it against the text of the sample request. Store address, product data and request text are only processed in memory for the duration of this one evaluation and are neither stored nor logged. The request text is transmitted to the AI service used (see section 5) to recognise the line items; please therefore do not enter any names or contact details there. To protect against abuse, I limit the number of requests per IP address (only as a truncated hash, in memory). The legal basis is Art. 6(1)(f) GDPR (demonstrating the software at your request).

3. Waitlist (“Coming soon”)

If you sign up for the waitlist, I process your email address and – voluntarily – name or company, store address and the desired plan. The sole purpose is to inform you by email about the launch of Struxify B2B Quote & Agent in the Shopify App Store.

Legal basis: your consent (Art. 6(1)(a) GDPR).
Double opt-in: after signing up I send you a confirmation email. You are only on the list once you have confirmed. As proof I store the times of sign-up and confirmation, the language of your sign-up (so that the launch email also arrives in German or English) and a truncated hash of your IP address (the IP address cannot be recovered from it).
Withdrawal: at any time via the link “Delete my entry” in every email or informally by email to me. Your data is then deleted immediately. The lawfulness of processing up to the withdrawal remains unaffected.
Retention: I delete unconfirmed entries automatically after 30 days. I delete confirmed entries once I have informed you about the launch and the period for the early-access spot (60 days after the launch notification) has expired, but in any case upon your withdrawal. I use the order of confirmation to allocate the early-access spots.
I do not send a newsletter and do not pass the data on to third parties for advertising purposes.

4. Use of the Shopify app

4.1 Merchant data (store)

For the app I process the store domain, the credentials provided by Shopify (access token), your settings, the names and email addresses of the team members you create, and a copy of your product catalogue (titles, variants, SKUs, prices, availability) and – with the Slow Mover module enabled – per variant stock, cost price (from Shopify, permission “read inventory”), sales of the last 90 days and units per carton; I refresh these values about every six hours. The legal basis is the performance of the contract of use (Art. 6(1)(b) GDPR). As proof I store the time of your consent to the terms of use and, where applicable, to the autopilot.

4.2 Your customers' data (processing on your behalf)

When evaluating requests, the app processes personal data of your customers: names, email addresses, content of emails and chat messages, company assignment and order history from Shopify. You as the merchant are the controller for this data; I process it as a processor only on your instructions (Art. 28 GDPR) and exclusively for creating drafts and quotes and for the reorder radar (notice of due repeat orders from your regular customers). I retrieve the order history from Shopify as needed; I do not keep my own copy of the orders. The reorder radar recalculates on every request from order date, order value and customer; the result is kept in memory for at most 15 minutes and is not stored. Details are governed by the data processing agreement (DPA).

Quote PDF: on request I provide a sent quote as a PDF (link in the quote email or “PDF Vorschau” – PDF preview – in the app). The PDF is generated anew from the current data of the draft in Shopify on every request, processed in memory only and delivered immediately – I store neither the document nor a copy of the quote data. The link is signed with a time-limited access code; I store your logo and the footer details for the PDF in your app settings.

Quote acceptance: if a customer accepts a quote via the link or QR code on the PDF or by email with a check code, I store with the request the time of acceptance, the name stated by the customer and, where applicable, company, order number and email address, as well as the number of the resulting order in Shopify. The check code is not stored but recalculated from the current draft in Shopify on every check. The acceptance data is subject to the retention period you have chosen (section 6).

4.3 Storefront chat

If your store uses the chat assistant, the visitors' messages, voluntarily provided contact details and a truncated hash of the IP address (to protect against abuse) are stored. The order history is only used in the chat for customers who are logged in to the store. The chat window points out the use of AI and the data processing.

4.4 Merchant verification (B2B Verify) and VAT number check (VIES)

If your store has activated merchant verification, business customers can register as a company via a form in the store or in the chat. On your behalf the app then processes: company name, name of the contact person, email address, country, VAT identification number, the Shopify customer ID where applicable, a truncated hash of the IP address (abuse protection) and – if the customer uploads it – proof of business activity (trade registration or commercial register extract as PDF or image). For this data you are the controller; I process it as a processor under the DPA.

VIES check: If the customer enters a VAT number, the app checks it immediately with the VAT Information Exchange System of the European Commission (VIES, ec.europa.eu/taxation_customs/vies). Only the country code and the number are transmitted; the Commission replies with validity, the company name and address registered in the member state and a consultation number. I store this reply with the application as evidence of the check (§ 18e UStG). The check itself is a procedure provided for by EU law; identical checks are cached in the app for at most 10 minutes.

Proof document: An uploaded document (at most 5 MB) is stored in the app's database in the EU (encrypted in transit, accessible only through the app) and is visible only to you and your team members in the app; it is not transmitted to third parties or to AI services. I delete the document automatically as soon as you have approved or rejected the application, and at the latest 90 days after receipt if no decision has been made by then (the application then expires).

Approval: With a valid VAT number the app can approve the customer automatically; otherwise you decide in the app. On approval the app sets the tag you have chosen (default “B2B-Validiert”) in the Shopify customer account, stores the VAT number, marks the customer as tax-exempt according to your setting (intra-community supply) and assigns the customer to a company and price list in Shopify. What was set is logged with the application. The app does not notify the customer of the result; that is up to you as the merchant. If you have entered a notification address, I send you an email per application containing company, email address, VAT number, VIES result and the file name of the proof document via the email service Resend (section 5).

4.5 Billing

The subscription is billed through Shopify. I do not receive or store payment data (credit card, bank details), only the plan booked, the identifier of the subscription at Shopify and the start of the billing period, in order to provide the scope of the plan and the quota (Art. 6(1)(b) GDPR).

4.6 Quick order

If your store uses the quick order block, I process the entered SKUs and quantities and uploaded tables (CSV/Excel, at most 2 MB) in memory only and do not store them. For logged-in customers I retrieve “My purchase list” live from the order history in Shopify on every call and keep no copy. If a customer submits a request via the block, I store it like a chat request (items, quantities, email address and, where given, name, company and note; sections 4.2 and 6). If you have allowed guests, this also applies to visitors who are not logged in. A truncated IP hash serves only for rate limiting in memory and is not stored.

5. Recipients and service providers

Shopify (Shopify International Ltd., Ireland) – platform on which the app runs; drafts are created in your Shopify account, billing runs through Shopify.
Google Gemini (Google Ireland Ltd. / Google LLC, USA) – AI evaluation of the request texts. Only the content necessary for recognition is transmitted (request text, catalogue excerpts, order history where applicable). Under the terms for the paid Gemini API, Google does not use this content to improve its products.
Resend (Resend Inc., USA) – sending and receiving emails (confirmation emails for the waitlist, quotes to customers, notifications to team members and to you about new verification applications, the app's email inbox).
Railway (Railway Corporation, USA) – hosting of app and database, data centre in the EU (Netherlands).
European Commission – VIES (Directorate-General for Taxation and Customs Union, Brussels) – verification of VAT identification numbers (section 4.4). Only the country code and the number are transmitted; the Commission is not a processor but performs its own public-law service.

Data processing agreements are in place with all service providers. Where data is transferred to the USA, this is done on the basis of the EU-US Data Privacy Framework (where the provider is certified) or the EU standard contractual clauses (Art. 45, 46 GDPR). I do not sell data and do not pass it on for advertising purposes.

Railway, Google and Resend are companies based in the USA and are in this respect also subject to US law. To protect against unlawful access from third countries, I store app and database in the EU, encrypt all transmissions, transmit to the AI and email services only the content needed in each case, and base transfers on the EU-US Data Privacy Framework or the EU standard contractual clauses (information pursuant to Art. 28 of Regulation (EU) 2023/2854).

6. Retention and erasure

As long as the app is installed: settings, catalogue copy and team remain stored.
Requests: requests in the history are automatically anonymised once the retention period has expired. You as the merchant set the period in the settings (12, 24 or 36 months from receipt of the request; default 24 months). Request text, email address, customer assignment and free texts are removed, as is the history of follow-up questions and replies on the quote; time, source, status, products and quantities remain. Drafts and orders in your Shopify account are not affected.
Chat histories: I delete storefront chat histories 90 days after the last message. A request that originated from a chat remains in the history until its own period expires.
Verification applications: I delete proof documents upon your decision, at the latest 90 days after receipt. The application itself (company, contact person, email, VAT number, VIES result, decision and log) is kept as evidence of the approval for as long as the app is installed; it is removed with a customer's erasure request via Shopify.
Uninstallation: if you uninstall the app, I delete all data of your store (settings, catalogue copy, requests, chat histories, verification applications, slow-mover data, team) from the app's database – immediately upon uninstallation, at the latest upon Shopify's erasure request (48 hours afterwards).
Erasure requests from your customers: if Shopify forwards a customer's erasure request to me, I automatically remove that customer's request texts, email address, customer assignment, chat histories and verification applications. Only a counter entry without personal reference remains for the quota.
Server logs: see section 2; for the waitlist see section 3.
Emails to me: if you write to me directly, I delete the message as soon as your matter has been dealt with, after 12 months at the latest – unless it is subject to a statutory retention obligation (§ 147 German Fiscal Code, § 257 German Commercial Code: business correspondence 6 years, accounting records 8 years, in each case from the end of the calendar year).

7. Use of AI (Regulation (EU) 2024/1689)

The app uses an AI language model (Google Gemini) to suggest line items, quantities and product matches from requests. AI-generated drafts are marked in the app; the storefront chat points out that an AI assistant is answering (Art. 50). No automated decision with legal effect within the meaning of Art. 22 GDPR takes place: the app only creates drafts, which the merchant reviews before a quote is sent or an order is completed. An exception is merchant verification: with a valid VAT number the app can approve a customer automatically if the merchant has so configured; the merchant can review and reverse any approval in the app, and the customer can contact the merchant about it.

8. Your rights

You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and the right to object to processing based on legitimate interests (Art. 21 GDPR). You can withdraw consent at any time with effect for the future (Art. 7(3) GDPR). Simply write to me at hello@struxify.io. If you are a customer of a store that uses the app, please contact that store first as the controller; I support it in responding.

You can also lodge a complaint with a data protection supervisory authority, for example the one responsible for me: Unabhängiges Landeszentrum für Datenschutz Schleswig-Holstein (ULD), Holstenstraße 98, 24103 Kiel, Germany.

9. Changes

I adapt this policy when the app or the legal situation changes. The version published here applies.