Last updated: 19 October 2026
Privacy Policy for the Shopify App "ExpiryLot"
This is an English translation of the German "Datenschutzerklärung". Only the German version is legally binding. If the two versions differ, the German version prevails.
This privacy policy is for merchants who use our app in their Shopify store and for their staff. It explains which personal data we process in connection with the app, for what purpose and on which legal basis. It is also the privacy policy for the app's listing in the Shopify App Store.
1. Controller and contact
Iller Labs, owner Robert Hampusch (sole proprietorship)
Rudolf-Kurz-Str. 2c
89257 Illertissen
Germany
Email: support@expirylot.com
For privacy questions, please use the contact details above.
2. What the app does
The app manages batches and best-before dates in Shopify stores. It tracks stock per batch, deducts sold quantities by FEFO (first expiry, first out), books returns back to their batch and shows which order received which batch (traceability). If enabled, it automatically sets discounts on products whose best-before date is near, moves sold-out products to the end of collections and provides a theme block that shows the best-before date on the product page.
The app works exclusively through Shopify's interfaces. It writes results back into the merchant's store, for example stock levels, discounts, the order of products in collections and batch information on products and orders.
3. Our roles
Our role under data protection law depends on the type of data:
| Data | Our role | What applies |
|---|---|---|
| Order, batch and stock data of your store, including data of your customers | Processor (Art. 28 GDPR) | You, the merchant, are the controller. Our Data Processing Agreement (DPA) applies. |
| Data on installation, the contract, use of the app by you and your staff, and support requests | Controller | This privacy policy applies. |
The merchant informs its own customers in its own privacy policy. For transparency, we still briefly describe the processing on behalf of the merchant in section 5.
4. Data for which we are the controller
4.1 Installation, contract and billing
When you install the app, we process:
- your store's domain and the time of installation and, if applicable, uninstallation,
- a permanent access token ("offline access token") for the Shopify Admin API, which the app uses to work on behalf of your store,
- information Shopify provides to us as app developer, such as the selected plan and billing status,
- if you redeem a voucher: the code, the time of redemption and the end of the free use.
Billing runs entirely through Shopify. We do not receive payment data such as card or bank details.
The purpose is to provide the app and perform the contract. The legal basis is Art. 6(1)(b) GDPR. Where we process data of persons who are not themselves our contracting party, the legal basis is Art. 6(1)(f) GDPR; our legitimate interest is the proper performance of the contract with the merchant.
We keep voucher redemptions and the monthly counter of AI recognitions after uninstallation for the period stated in section 8, so that a voucher can be redeemed only once per store and reinstalling does not reset the monthly limit. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is protection against repeated misuse.
4.2 Using the app in the Shopify admin
The app is displayed inside the Shopify admin. When it is opened, Shopify sends a signed session token. We use it to verify that the request comes from a logged-in user of your store, take the store domain and the Shopify user ID of the logged-in person from it and do not store the token itself. We request this person's first and last name from Shopify at most once a week; we do not store other details such as the email address. The interface loads Shopify's "App Bridge" library from Shopify's servers.
We store settings (location, discount rules, collections to sort) for your store. For entries that affect stock (for example goods receipts, corrections, undone bookings) we also store which person made them (user ID and name), so that you can trace mistakes. This information is deleted together with the other store data. We do not use analytics or tracking tools.
From installation and uninstallation, the chosen plan, the settings and the setup progress (for example the chosen starting path, the step left open, the features switched on) and from the number of AI recognitions, we ourselves evaluate in aggregated form how the app is used and where setup is abandoned, in order to improve the app. Order, batch and stock data of your store and data of your customers are not part of this evaluation. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is improving the app.
The legal basis towards the merchant is Art. 6(1)(b) GDPR. For the merchant's staff, the legal basis is Art. 6(1)(f) GDPR; our legitimate interest is providing the app securely to our customer.
4.2a Help assistant "Lotti"
On the Help page (and via the "Ask Lotti" button) users of the app can ask questions about how to use it. The assistant only knows the description of the app and the help texts; it has no access to your shop data (batches, orders, stock, settings). To answer, the question you typed, the previous turns of the conversation, the interface language and the name of the page currently open are sent to Anthropic's Claude API (see sections 6 and 7). Do not enter personal data in a question; the assistant does not need it.
We store the question, the answer, the shop domain, language, page, the user ID of the person asking, your rating (thumbs up/down) and the number of processed characters (tokens) for 180 days. This lets us count questions per shop and month, spot questions the assistant could not answer, and add reviewed answers to its knowledge by hand. The assistant does not "learn" from questions on its own. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is making the app understandable and improving the assistant. Use is voluntary.
4.3 Technical logs at our hosting provider
The app runs on Cloudflare. Every request to the app, whether from Shopify's servers or from an admin user's browser, generates technical data, in particular IP addresses and timestamps. Cloudflare may store such technical logs to operate and secure its service. We use them only for troubleshooting and to defend against attacks.
The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is the secure and stable operation of the app.
4.4 Support requests
If you contact us, we process your contact details and the content of your message to answer your request. The legal basis is Art. 6(1)(b) GDPR where the request concerns the contract, otherwise Art. 6(1)(f) GDPR (legitimate interest in answering enquiries).
5. Data we process on behalf of the merchant
On behalf of the merchant as controller, the app stores:
- the store's settings,
- batches: variant ID, best-before date, quantity, optional lot number, receipt date,
- for each order line, the allocation: order ID, order number (such as "#1234"), line item ID, variant ID, batch, quantity and returned quantity,
- a log of stock adjustments,
- original prices, so that automatically set discounts can be reset, and a log of these price changes,
- a note of which batches have already been reported to Shopify Flow or by email (only product and batch data are passed on, no personal data),
- if the merchant turns on email notifications: up to five recipient addresses that the merchant enters. If none are entered, the app looks up the store's email address at Shopify when sending, without storing it. The emails contain product, batch and stock data and are sent via Cloudflare Email Service,
- a queue of incoming webhook events.
For the events "orders/create", "orders/edited", "orders/cancelled" and "refunds/create", Shopify sends full order data. This includes personal data of the merchant's customers, such as name, email address and addresses. The app discards these fields immediately on receipt, before anything is stored. Only the IDs of the order, order line and product, quantities and the restock type enter the queue, but no names, contact or address data. Queue entries are deleted as soon as they have been processed, usually within seconds. Entries that could not be processed even after repeated attempts are deleted after 30 days.
Delivery lists and invoices uploaded by the merchant (Excel, CSV, PDF, phone photos) are read in the browser; digital PDFs are read with the pdf.js library, which is loaded from our own server. We do not store the file itself, only the batches and quantities booked from it. Only when a user explicitly clicks "Recognize with AI" is the PDF or the delivery-note photos sent to Anthropic for text recognition (see section 6). Invoices may contain names and contact details of contact persons.
The app retrieves customer data through the API in one case only: when a user chooses “Print → Packing slip with best-before dates” in an order, it looks up the name and shipping address of the selected orders at Shopify, inserts them into the print document and does not store them. It sets no cookies or trackers in the online store (storefront) and uses no analytics services. The theme block only displays a date from the product data and processes no personal data.
The DPA sets out the details.
6. Recipients
- Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA, provides our hosting (Cloudflare Workers, the Cloudflare D1 database and Cloudflare Workers KV storage) and sends the email notifications (Cloudflare Email Service). Cloudflare is our processor; Cloudflare's data processing addendum, including the EU Standard Contractual Clauses, applies.
- Anthropic Ireland, Limited, 6th Floor, South Bank House, Barrow Street, Dublin 4, D04 TR29, Ireland (contracting entity for customers in the EEA; parent company Anthropic, PBC, 548 Market Street, PMB 90375, San Francisco, CA 94104, USA; processing in the USA), for the optional AI recognition of invoice PDFs and delivery-note photos (on request, the file is sent to the Claude API and read there) and for the help assistant "Lotti" (the question and conversation are sent to the Claude API to be answered, see section 4.2a). Anthropic is our (sub)processor. Under Anthropic's Commercial Terms of Service (section on customer content), API inputs and outputs are not used to train models.
- Shopify: The app only works through Shopify. The contracting party for merchants in Europe is Shopify International Limited, Ireland. Shopify is not our processor but the platform through which you use the app. Shopify processes data under its own terms and privacy policy.
- Authorities receive data only if we are legally obliged to disclose it.
We do not sell data and do not use it for advertising.
7. Transfers to third countries
Cloudflare, Inc. is based in the USA and is certified under the EU-U.S. Data Privacy Framework. For certified companies, an adequacy decision of the European Commission applies (Implementing Decision (EU) 2023/1795 of 10 July 2023, Art. 45 GDPR). In addition, Cloudflare's data processing addendum includes the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR).
For the optional AI recognition, invoice PDFs and delivery-note photos – and for the help assistant, the questions asked – are transferred to Anthropic in the USA. This is based on the EU Standard Contractual Clauses (Module 2 or Module 3) contained in Anthropic's Data Processing Addendum (Art. 46(2)(c) GDPR). According to Anthropic, API inputs and outputs are deleted within 30 days and are not used to train models.
Cloudflare Workers run on Cloudflare's global network, so requests may also be processed in data centres outside the EU. The database is stored in the EU (Cloudflare "EU jurisdiction" setting: the database is stored and processed only in the EU). Access tokens and settings are kept in Cloudflare Workers KV and may be stored and cached across Cloudflare's global network.
8. Retention
| Data | Deletion |
|---|---|
| Access token | immediately when the app is uninstalled |
| All other store data (settings, batches, allocations, log, original prices, set-aside delivery list items), except the counter of AI recognitions and voucher redemptions listed below | when Shopify's "shop/redact" event arrives (48 hours after uninstallation), at the latest 7 days after uninstallation |
| Webhook queue (without customer data) | after processing, usually within seconds; entries that cannot be processed after 30 days |
| Order numbers after a customer's deletion request ("customers/redact") | immediately on receipt; the batch allocation is kept without the order number (see below) |
| Uploaded delivery lists and invoices | not stored by the app; with AI recognition, deleted at Anthropic within 30 days according to Anthropic (up to 2 years if Anthropic's systems flag a usage-policy violation) |
| Monthly counter of AI recognitions | after 40 days, even if the app is uninstalled earlier |
| Voucher redemptions (store domain, code, time of redemption, end of free use) | 2 years after the other store data is deleted ("shop/redact"); if the app is reinstalled, the period starts again with the next deletion |
| Questions to the help assistant (question, answer, shop, language, page, user ID, rating, tokens) | after 180 days, at the latest together with the other store data after uninstallation; anonymised question-and-answer pairs the operator adds to the assistant's knowledge are kept |
| Technical logs at Cloudflare | according to Cloudflare's rules (Workers Logs: 7 days) |
| Support requests | once no longer needed to handle the request, subject to statutory retention duties |
| Billing records | after the statutory retention periods under commercial and tax law |
After a deletion request via "customers/redact", the record of which batch went into which order line is kept without the order number. It contains no names, contact or address data. This allows the merchant to meet its traceability and food recall obligations (see Art. 18 of Regulation (EC) No 178/2002). This allocation is deleted together with all other store data after uninstallation.
9. Your rights
You have the right to
- access (Art. 15 GDPR),
- rectification (Art. 16 GDPR),
- erasure (Art. 17 GDPR),
- restriction of processing (Art. 18 GDPR),
- data portability (Art. 20 GDPR),
- object to processing based on Art. 6(1)(f) GDPR on grounds relating to your particular situation (Art. 21 GDPR),
- lodge a complaint with a supervisory authority (Art. 77 GDPR).
Customers of a merchant should first contact the merchant, as the merchant is responsible for their data. We support the merchant in this.
There is no automated decision-making within the meaning of Art. 22 GDPR.
10. Competent supervisory authority
Bayerisches Landesamt für Datenschutzaufsicht (BayLDA, Bavarian Data Protection Authority)
Promenade 18
91522 Ansbach, Germany
https://www.lda.bayern.de
You may also contact any other data protection supervisory authority.
11. Obligation to provide data
The app cannot work without the store domain and the access token. There is no legal obligation to provide them, but they are required to use the app.
12. Changes
We update this privacy policy when the app or the legal situation changes. The version published here applies.