Privacy Policy

Struxify Freight & Tiers (website freight.struxify.io and Shopify app) · Last updated: 23 October 2026

This English translation is provided for convenience. The German version is legally binding: German version.

Summary: I only process what is necessary for the waiting list or for operating the app. No advertising cookies, no tracking, no sale of data, no use of AI. For the freight calculation, the app uses only the country and postcode of the delivery address and does not store any names or addresses. You can request access, rectification and erasure at any time by email.

1. Controller

Struxify — Inh. Dávid-Dennis Warning
Bürgermeister-Steenbock-Straße 21 a, 24558 Henstedt-Ulzburg, Deutschland
Email: hello@struxify.io

I am not required to appoint a data protection officer. For data protection questions you can reach me at the address above.

2. Visiting the website

When you access freight.struxify.io, my hosting provider processes technically necessary data (IP address, time, page accessed, browser identifier) in server logs in order to deliver the page and protect it against misuse. The legal basis is my legitimate interest in secure operation (Art. 6(1)(f) GDPR). The logs are deleted automatically by the hosting provider, after 30 days at the latest. I only keep individual entries longer where this is necessary to investigate a specific security incident.

Hosting: Railway Corporation (USA), data centre in the EU (Netherlands). I deliver the fonts, scripts and graphics of this website myself; your browser does not load any content from third-party servers when you visit.

I do not use any cookies or any analytics or advertising tools on this website and do not store anything on your device. A consent banner is therefore not required. The language (German/English) results solely from the address accessed.

Live demo on the home page

When you enter a store address and a postcode in the live demo, the app's server fetches the publicly visible product data of that store once (product name, variant, SKU, price, weight – the same details every visitor sees in the store) and calculates an example with it. The store address, postcode and product data are processed in memory only for the duration of that one calculation and are neither stored nor logged. To prevent abuse I limit the number of requests per IP address (truncated hash, in memory only). The legal basis is Art. 6(1)(f) GDPR (demonstrating the software at your request).

3. Waiting list (“Coming soon”)

If you sign up for the waiting list, I process your email address and – voluntarily – your name or company, shop address and the desired plan. The sole purpose is to inform you by email about the launch of Struxify Freight & Tiers in the Shopify App Store.

Legal basis: your consent (Art. 6(1)(a) GDPR).
Double opt-in: After you sign up I send you a confirmation email. Only after your confirmation are you on the list. As proof I store the times of sign-up and confirmation, the language of your sign-up and a truncated hash value of your IP address (the IP address cannot be recovered from it).
Withdrawal: at any time via the “Delete my entry” (Eintrag löschen) link in every email or informally by email to me. Your data will then be deleted immediately. The lawfulness of processing up to the withdrawal remains unaffected.
Storage period: I automatically delete unconfirmed entries after 30 days. I delete confirmed entries once I have informed you about the launch and the early-access window (60 days after the launch notification) has ended, at the latest 30 days thereafter, and immediately upon your withdrawal. I use the order of confirmation to allocate the early-access places. The emails sent remain in the sending log of the email service Resend for up to 30 days.
I do not send a newsletter and do not pass the data on to third parties for advertising purposes.

4. Use of the Shopify app

4.1 Merchant (shop) data

For the app I process the shop domain, the access credentials provided by Shopify (access token), your settings and the tables you upload (postcode zones, freight prices, surcharges, product data, tier prices) including the file names. The legal basis is the performance of the contract of use (Art. 6(1)(b) GDPR). As proof I store the time of your acceptance of the Terms of Use. Please do not upload any personal data in the tables – it is not needed for this.

4.2 Your customers' data (processing on behalf)

Freight calculation in the checkout: When a customer in your shop chooses a delivery address, Shopify sends the app a request containing the delivery address (street address, city, postcode, country) and the cart items (name, SKU, quantity, weight, price). From this the app reads only the country and postcode as well as SKU, quantity, weight and price, calculates the freight price and responds to Shopify. The request is processed in memory only for the duration of the calculation; I do not store name, street, city or the full postcode.

Log without personal reference: So that you can identify gaps in your tariffs, I store per request: time, country, the first two digits of the postcode, determined zone, weight, number of pallets, oversize flag, offered price, result and response time. Drawing conclusions about individual persons from this is not intended and practically impossible.

Tier prices: Tier prices are calculated by a Shopify Function within Shopify's infrastructure. For tiers per delivery zone, this function reads the postcode and country of the delivery address; no data is transmitted to the app's servers in the process.

Cart hints (booster): If your store has added the “Freight & pallet booster” block, the visitor's browser sends the cart items (SKU, quantity, weight, unit price) together with language and form of address to the app via the Shopify app proxy whenever the cart is not empty. The app calculates in memory the utilisation of the freight and pallet tier, the free-shipping threshold and the next price tier and responds immediately; nothing is stored or logged. Shopify also transmits the store domain and, for logged-in customers, the customer ID; the app only evaluates the customer ID if you have switched on suggestions from previous orders (next paragraph). To prevent abuse I limit requests per IP address (truncated hash only, in memory, not stored). The hints are estimates based on a fixed delivery zone; the binding freight price is only calculated in the checkout.

Suggestions from previous orders (from Pro, only if you switch them on): If a customer is logged in to your store and the rate band or the started pallet still has room, the app uses the customer ID transmitted (signed) by Shopify to read this very customer's orders from the last up to six months live via the Shopify API (order lines: item or variant, quantity, order date; plus title, SKU, price, availability and weight of the variant). From this it calculates up to three suggestions with an “Add to cart” button in memory. The customer's name, email, phone number and address are not requested. Nothing is stored or logged; so that not every cart change queries Shopify again, the app keeps the result per store and customer in memory for at most 10 minutes and then discards it (immediately on a server restart). Guests and other customers see none of it. The legal basis on your side is usually your legitimate interest in relevant reorder hints for your business customers (Art. 6(1)(f) GDPR); include the feature in your privacy policy.

You as the Merchant are the controller for this data; I process it as a processor only on your instructions (Art. 28 GDPR) and exclusively for calculating shipping and tier prices and the cart hints. The details are governed by the Data Processing Agreement (DPA).

4.3 Billing

The subscription is billed via Shopify. I do not receive or store any payment data (credit card, bank details), only the plan booked, the subscription's identifier at Shopify and the start of the billing period, in order to provide the plan's scope (Art. 6(1)(b) GDPR).

5. Recipients and service providers

Shopify (Shopify International Ltd., Ireland) – the platform on which the app runs; the shipping service and discount are created in your Shopify account, billing is handled via Shopify.
Railway (Railway Corporation, USA) – hosting of app and database, data centre in the EU (Netherlands).
Resend (Resend Inc., USA) – sending the waiting-list emails (confirmation, launch notification). Your customers' data is not transmitted to Resend.

Data processing agreements are in place with the service providers. Where data is transferred to the USA, this takes place on the basis of the EU-US Data Privacy Framework (if the provider is certified) or the EU Standard Contractual Clauses (Art. 45, 46 GDPR). I do not sell any data and do not pass it on for advertising purposes. The app does not use artificial intelligence; there is no automated decision-making within the meaning of Art. 22 GDPR – calculations are based exclusively on the tables stored by the Merchant.

Railway and Resend are companies based in the USA and are in this respect also subject to US law. To protect against unlawful access from third countries, I store the app and database in the EU, encrypt all transmissions, transmit only the waiting-list details to the email service, and base transfers on the EU-US Data Privacy Framework or the EU Standard Contractual Clauses (information pursuant to Art. 28 of Regulation (EU) 2023/2854).

6. Storage period and erasure

As long as the app is installed: settings and tables remain stored until you replace or remove them.
Request log: 7 to 90 days depending on the plan, then automatic deletion. The log contains no personal data (clause 4.2).
Uninstallation: If you uninstall the app, I delete all of your shop's data (settings, tables, log) from the app's database – immediately upon uninstallation, at the latest upon Shopify's deletion request (48 hours afterwards).
Access and erasure requests from your customers: If Shopify forwards such a request to me, I confirm receipt. Since the app does not store any data attributable to a customer, there is nothing to disclose or delete.
Suggestions from previous orders: in memory only, at most 10 minutes per store and customer, then discarded automatically; not stored in the database (clause 4.2).
Server logs: automatic deletion after 30 days at the latest (clause 2); for the waiting list see clause 3.
Email enquiries to me: If you write to me directly, I delete the message as soon as your matter has been dealt with, after 12 months at the latest. I keep business correspondence relating to a contract for 6 years and documents relevant to billing for 8 years (§ 147 German Fiscal Code, § 257 German Commercial Code), in each case from the end of the calendar year.

7. Your rights

You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21 GDPR). You can withdraw consent you have given at any time with effect for the future (Art. 7(3) GDPR). Simply write to me at hello@struxify.io. If you are a customer of a shop that uses the app, please contact that shop first as the controller; I support it in responding.

You also have the right to lodge a complaint with a data protection supervisory authority, for example the one responsible for me: Unabhängiges Landeszentrum für Datenschutz Schleswig-Holstein (ULD), Holstenstraße 98, 24103 Kiel, Germany.

8. Changes

I adapt this policy when the app or the legal situation changes. The version published here applies.