Privacy policy

1. Controller and roles

Genius Nutrition S.R.L. operates DPG Pfand Germany. The Shopify merchant determines the purposes of processing its store and order data; the operator processes that data as a service provider and controls its own account, billing and support data. The app is independent and is not DPG Deutsche Pfandsystem GmbH.

2. Data processed

We process the shop domain, Shopify OAuth and session data, subscription status, deposit configuration, selected variants, GTIN, package count and material family, and Shopify order, line, product, SKU and quantity data. Order and line snapshots include their Shopify identifiers, statuses and timestamps, unit and subtotal amounts, currency, discounts, tax titles, rates and amounts, refund quantities and amounts, and the association between merchandise and deposit lines. When Shopify supplies them for an online session, session records can also include the authenticated merchant staff user's ID, first and last name, email address, locale, and account-owner, collaborator and email-verification flags. These fields describe merchant staff account context, not buyer or order-customer profiles. To classify refund completion correctly, we also store minimal Shopify transaction metadata: transaction identifier, kind, status, amount, currency, gateway label, and manual/test indicators. We do not request or store order-customer names, email addresses, phone numbers, postal addresses, card data, bank details or other buyer payment-instrument data.

Raw webhook payloads are not stored. A SHA-256 digest and minimal delivery metadata prevent duplicate processing.

For short-lived storefront readiness checks, we store only a SHA-256 digest of the one-time random token (never the raw token), shop and configuration generations, catalog digest and count, extension version, tested surface, Germany/EUR and locale context, and issue, observation, expiry and invalidation timestamps. Expired records become eligible for deletion after 24 hours and are removed by the scheduled daily retention run within 48 hours of expiry. Shopify can send signed app-proxy request metadata; it is used only for authentication and routing and is not stored.

To remember the language choice, the app uses a functional cookie and, inside the embedded app, browser local storage. Both contain only the value en or de-DE and expire after no more than one year. The app uses no advertising or analytics cookies.

3. Purposes and legal basis

Data is used for authentication, applying merchant configuration, cart controls, synchronizing deposit-bearing lines, internal merchant audit, privacy requests and support. The applicable legal bases are: performance of the merchant contract under Article 6(1)(b) GDPR, compliance with applicable legal obligations under Article 6(1)(c), and legitimate interests in service security and abuse prevention under Article 6(1)(f); order-customer data is processed on the merchant's instructions under Article 28 GDPR.

4. Retention

Order snapshots are deleted after 90 days. Technical webhook receipts and temporary Bulk raw/staging data are deleted with their terminal background-job records after 30 days. Privacy-request exports remain available for 30 days and also include requested order data still in Bulk processing. OAuth sessions are removed on uninstall. Remaining tenant data is deleted after Shopify's mandatory shop/redact webhook or an applicable deletion request.

5. Providers and transfers

Shopify provides the platform, authentication, billing and store data. Railway provides hosting and database infrastructure. Processing outside the EEA follows the providers' applicable terms and transfer mechanisms.

6. Security

We use HTTPS, Shopify authentication, webhook HMAC verification, server-side tenant isolation, data minimization and scheduled deletion. No measure eliminates every risk.

7. Rights and contact

Customers should first contact the Shopify merchant controlling their order. Requests for access, correction, deletion, restriction or objection may be sent to privacy@obsedia.ai. Complaints may be submitted to the competent supervisory authority.