Privacy Policy
Privacy Policy for the Shopify app "4SELLERS Shipping Rules"
Last updated: August 11, 2026
This policy describes which data the app "4SELLERS Shipping Rules" (the "app") processes when you install and use it in your Shopify store, and on what legal basis.
The short version: the app is built so that it does not need a database of its own. Your configuration stays in your store, and checkout data is used for the length of one request and then gone.
1. Who we are (data controller)
The controller for the processing described here, within the meaning of the GDPR, is:
4SELLERS GmbH Nelkenweg 6a 86641 Rain am Lech Germany Email: agency@4sellers.de
2. What data we process and why
We keep merchant data (yours) and end-customer data (your buyers') strictly apart.
A. Merchant data (store information)
| Data | Purpose | Where it is stored |
|---|---|---|
Store domain, e.g. your-shop.myshopify.com | Identifies your store | Our session database |
| Access token and session data | Secure communication between Shopify and the app | Our session database |
| Your store's Shopify ID | Checking which plan is active | Not stored; sent to Shopify's Partner API per request |
| Shipping configuration: rules, zones, methods, classes | The app's actual function | As metaobjects in your Shopify store, not with us |
| Product metafields and delivery profile | Assigning shipping classes and connecting to the checkout | In your Shopify store |
Legal basis: performance of our contract with you, Art. 6 (1) (b) GDPR.
The app uses offline access tokens only, so Shopify never sends us the name, email address or user ID of the person who installed it. The session table has columns for those fields — they are part of Shopify's standard session schema — and they stay empty.
B. End-customer data (checkout)
Once you save a shipping method, the app registers a carrier service in your store. During checkout, Shopify calls that service to obtain shipping rates and sends along the data needed for the calculation. We process it for the duration of that request only and do not store it.
Depending on your configuration, this can include:
- Destination: country and postal code, to match your shipping zones.
- Cart contents: products, quantities, prices, weights and shipping classes, to evaluate your rules.
- Customer tags: only if your rules use tag-based restrictions. In that case the app reads the tags of the customer identified by Shopify for the duration of the request.
We do not receive or process payment data, and we do not store email addresses, names, full delivery addresses or order histories.
Legal basis: processing on your behalf for the performance of your contract with your customer, Art. 6 (1) (b) GDPR in conjunction with our contract with you. You remain the controller for your end customers' data; for this checkout-related processing we act as your processor — see section 7.
C. Why we request each permission
Shopify lists the permissions an app requests before you install it. That list describes what the app may access — not what it stores. For completeness, permission by permission:
| Permission | What it is needed for | What we store |
|---|---|---|
read_customers | Reading customer tags during checkout, only if a rule uses a tag restriction | nothing |
read_shipping, write_shipping | Registering the carrier service and attaching it to your delivery profile | nothing |
write_metaobjects, write_metaobject_definitions | Saving your rules, zones and methods in your own store | nothing (the data stays in your store) |
write_products | The forsellers.shipping_class metafield definition on products | nothing |
Two of the entries Shopify shows deserve a word, because they read more dramatically than they are:
- "Customer data" / "orders" — the checkout request contains cart and destination data. It is needed to calculate a rate at all, and it is discarded when the response is sent.
- "Device and activity data" — this refers to standard web-server data (IP address, browser, operating system) as it occurs with any HTTPS request. We do not use it to profile, track or analyse anyone.
3. Storage, retention and deletion
| Data | Retention |
|---|---|
| Session data and access tokens | For as long as the app is installed. Deleted immediately when Shopify's uninstall notification arrives, and again — as a safety net — with Shopify's shop redaction request roughly 48 hours after uninstall. |
| Checkout data (destination, cart, tags) | Not stored. Processed in memory for the duration of the request. |
| Technical log data | Log entries record events such as "a rate request was received" and technical errors, without cart or customer content. They serve operations and troubleshooting only, are not analysed, not combined with other data and not passed on. |
| Your configuration (metaobjects, product metafields) | Stays in your Shopify store, including after uninstall, until you delete it there. See Uninstalling. |
No personal data of yours or of your customers remains on our systems after uninstall.
4. Hosting, subprocessors and log data
The app runs at app-shippingrules.apps.4sellers.de on our own infrastructure at the company's
premises in Rain am Lech, Germany. There is no external hosting provider, and no data leaves the
EU for the purpose of operating the app. Session data is held in a PostgreSQL database that is not
publicly reachable.
Subprocessors: none. Because we operate the servers ourselves and the app uses no analytics, no tracking, no advertising services and no external fonts or CDNs, no third party is involved in processing on our behalf. The only external recipient is Shopify itself — see section 6.
5. Technical and organisational measures (Art. 32 GDPR)
- Data minimisation by design. The app has no database for shipping configuration or checkout data — the one thing it persists is the session. What is not stored cannot leak.
- Encryption in transit. All communication between Shopify, your browser and the app runs over HTTPS/TLS.
- Authenticated requests. Shopify webhooks are verified by HMAC signature; admin requests run through Shopify's OAuth session validation. Unauthenticated requests are rejected.
- Least privilege. The app requests only the permissions listed in section 2.C.
- Separated secrets. API keys and tokens are supplied as environment variables at deployment time and are not part of the source code.
- Automatic deletion. Uninstalling triggers deletion of the session data; no manual step is needed.
- Own infrastructure. The servers are operated by us in Germany, without an external hosting provider and without subprocessors — see section 4. Physical and organisational access to them stays within 4SELLERS.
6. Transfers to third countries
Processing takes place in Germany, on our own servers — see section 4.
There is exactly one outbound call to a recipient outside the EU: to check which plan is active, the app queries Shopify's Partner API and sends your store's Shopify ID with that request. The recipient is Shopify — the same platform that already operates your store and with which you have your own data processing agreement. No end-customer data is part of that request.
We do not transfer data to any other third country and use no third-country services beyond the above.
7. Our role: processor for checkout data
For the checkout-related processing described in section 2.B we act as your processor under Art. 28 GDPR: we process that data only on your instruction — which is what your rules in the app are — for the duration of the request, and for no purpose of our own.
For everything else described here we are the controller; that is the case for your store domain and the session data in section 2.A.
For questions about this processing, write to agency@4sellers.de.
8. Shopify's mandatory webhooks
Shopify requires every app to implement three data-protection endpoints. Ours do the following:
customers/data_request— a customer asks to see their data. We hold no end-customer data, so there is nothing to disclose and the app confirms receipt.customers/redact— a customer asks for deletion. We hold no end-customer data, so no deletion step is required.shop/redact— sent roughly 48 hours after uninstall. The app deletes any remaining session data for that store.
9. Sharing your data
We do not sell your data, do not share it for advertising and do not use it for our own purposes. There are no subprocessors — see section 4. Data leaves our systems only:
- towards Shopify, for the one plan check described in section 6, and
- where we are legally obliged to pass it on, for example following an official order.
10. Your rights
As a data subject in the EU you have the right to access, rectification, erasure, restriction of processing, data portability and objection, and the right to lodge a complaint with a supervisory authority.
To exercise these rights, write to agency@4sellers.de.
For requests from your customers: you are the controller there. Such requests are handled in your Shopify admin — the data is in your store, not with us. If a request nonetheless touches something on our side, contact us and we will support you as your processor.
11. Changes to this policy
We update this policy when our processing changes or for legal or operational reasons. Material changes will be announced through the Shopify dashboard or by email. The date at the top of this page always reflects the current version.