Privacy Policy

Who we are

Findready ("the app") is a Shopify app operated by Keoma Kindl, based in Austria, EU. Keoma Kindl is the data controller for the direct relationship with you, the merchant. For any question about your data or this policy, or to exercise your rights, contact us at support@keomakindl.at. Given the scope of our processing we are not required to appoint a Data Protection Officer; support@keomakindl.at reaches the person responsible.

What this policy covers and our role

This policy explains what personal data the app processes when you install it on your Shopify store, why, and on what legal basis.

Two roles apply. When the app reads your customers' personal data to answer a search, you (the store owner) are the controller and we act as your processor under Article 28 GDPR, processing that data only on your instructions to provide the app. For our direct relationship with you as a merchant, we are the controller.

Data we process

Store and account data: your store domain, a Shopify access token, and your app settings.

Order and customer data: read live to answer a search. The app keeps no copy of orders or results. If you explicitly save a search, its name, query text and filters are stored; query text can contain a customer identifier if you enter one. We do not receive payment or card data.

Content you add: saved search definitions and any feedback or bug report you send us.

Legal basis for processing

Providing the app to you: Article 6(1)(b) GDPR, performance of our contract with you as a merchant, namely order search.

Processing your customers' personal data: we do this only as your processor, on your documented instructions under Article 28 GDPR; your own legal basis as the controller governs that data.

Keeping the service safe: Article 6(1)(f) GDPR, our legitimate interest in security, abuse prevention and rate limiting, balanced against your and your customers' rights.

Legal obligations: Article 6(1)(c) GDPR, for example when we act on Shopify's mandatory privacy webhooks.

How we use it

We use this data solely to search your orders and repeat searches you explicitly save. We do not use your data for advertising, and we do not sell or share it. We keep no copy of the orders or results read to answer a search.

Cookies and local storage

The app uses only what it needs to function. Inside the Shopify admin, a strictly necessary session cookie keeps you signed in to the app. In your browser we use local storage to remember your preferences, such as your chosen language.

We do not use advertising cookies, cross-site trackers, or any third-party analytics.

Storage, security and encryption

We store very little: your session token, app settings, saved search definitions and any feedback you send. Shopify access and refresh tokens are encrypted at rest with AES-256-GCM. We do not store orders or search results. A saved query can contain a customer identifier only when you explicitly enter and save it.

Data in transit is protected with TLS. Access to production data is limited to what is needed to operate and support the service.

Where your data is stored and international transfers

We store your data on infrastructure located in the European Union (a managed database in Frankfurt, Germany, and application hosting in an EU region). We do not transfer your data outside the EU ourselves.

Shopify, as the platform your store runs on, may process data outside the EU under its own data processing terms and the European Commission's Standard Contractual Clauses, which you accepted when you started using Shopify.

Sub-processors

We use a small number of carefully chosen sub-processors, each bound by a data processing agreement: Shopify (the platform your store and orders live on), Neon (our managed PostgreSQL database provider, hosting data in the EU) and Railway (our application hosting provider, running in an EU region). We do not share your data with any other third parties, and we never sell or rent it.

Retention

We keep your settings, saved searches, feedback and session token while the app is installed. You can delete a saved search at any time. Customer redaction requests remove saved queries containing the email or phone supplied by Shopify. A shop-redaction request after uninstall permanently deletes all saved searches and other app data. You can also contact us at support@keomakindl.at to request earlier deletion.

Your rights

Under the GDPR you and your customers have the right to access, rectify, erase, restrict and object to the processing of personal data, and to data portability. You can trigger full deletion by uninstalling the app. Customer access and deletion requests flow through Shopify's standard privacy webhooks, which we honor automatically; you can also contact support@keomakindl.at to exercise any right directly.

We do not carry out automated decision-making or profiling that produces legal or similarly significant effects. If you believe we have handled your data unlawfully, you have the right to lodge a complaint with a data protection supervisory authority in the EU, in particular in the country where you live, work, or where the alleged infringement took place.

Children's data

The app is a business tool for merchants and is not directed at children. We do not knowingly process the personal data of children.

Changes to this policy

We may update this policy. The effective date above always reflects the current version, and we will reflect any material change here.