Privacy policy: devvibe Widerrufsbutton

Last updated: 26 October 2026

This policy applies to the Shopify app “devvibe Widerrufsbutton”. It is addressed to merchants who install the app and also describes how data of the merchants’ customers is processed.

1. Roles and controller

The merchant is responsible for the data of a shop’s customers. devvibe processes it as a processor under Art. 28 GDPR. We provide a data processing agreement on request. devvibe is the controller for the merchants’ own data (shop domain, contact email, settings).

Controller: Matthias Ruf, devvibe, Estweg 25, 86872 Scherstetten, Germany
Email: hallo@devvibe.io

2. Data we process

From the withdrawal form (customers):

Name and email address
Order number and, for a partial withdrawal, the selected items and quantities and an optional free text about them
Time of receipt, reference number and status of the case
Technical data for abuse prevention: a salted hash of the IP address (not the IP address itself) and the user agent

No reasons for the withdrawal, no photos, no phone numbers and no postal addresses of customers are requested or stored.

From Shopify (only after the merchant installs the app):

From orders only what is needed for matching: order number, name, email address and line items
Shop domain and the app’s access token
Subscription status (Free or Pro)

From merchants: contact email for notifications, sender name and app settings. With Pro additionally appearance (colors, font, logo), custom texts and email design.

3. Purpose and legal basis

Receiving and confirming a withdrawal under § 356a BGB: fulfilment of the merchant’s legal obligations (Art. 6(1)(c) GDPR) and performance of the contract (point (b))
Matching to the order and handling in the admin: the merchant’s legitimate interest in proper processing (point (f))
Protection against automated abuse (rate limit, honeypot): legitimate interest (point (f))

4. Retention and deletion

Withdrawal data is stored for three years after receipt by default (limitation period) and then deleted automatically. The merchant can set a period between 30 and 3650 days in the app settings.
Intermediate form data between the first and second step is deleted after 24 hours at the latest.
After the app is uninstalled, Shopify sends a shop/redact request after 48 hours. We then remove all data of that shop.
Requests for customers/redact and customers/data_request are handled automatically through the Shopify interfaces. For customers/redact the personal details of the affected withdrawals are made unrecognizable.
Completed privacy jobs are deleted after 90 days.

5. Recipients and hosting

Hosting: Hetzner Online GmbH, data centers in Germany. A data processing agreement is in place.
Email delivery: The confirmation to the customer and the notification to the merchant are sent through the API of Sweego (Sweego SAS, France, EU). Recipient address, sender and email content are transmitted. A data processing agreement is in place.
Shopify: The app retrieves order data through the Shopify API and sets a tag on the order. Shopify’s own privacy notices also apply.

We do not transfer data to countries outside the EU and EEA ourselves. A transfer may take place at Shopify, which is governed by Shopify’s terms.

6. Cookies and tracking

The app sets no cookies in the storefront and includes no tracking services. A short-lived form token protects against abuse and is not linked to individuals. Visits to these pages on devvibe.io are covered by the general devvibe privacy policy (in German), which describes web analytics and cookies.

7. Your rights

Data subjects have the right of access, rectification, erasure, restriction of processing, data portability and objection, and the right to lodge a complaint with a supervisory authority. Customers should first contact the merchant they ordered from. We support merchants in handling these requests.

8. Security

Transmission is encrypted (TLS). Data is kept in an access-protected database, backups are encrypted. Access to Shopify data is limited to the permissions the app needs to match orders.

9. Contact and changes

Please send privacy questions to hallo@devvibe.io. We update this policy when the app or the legal situation changes. The current version is at devvibe.io/apps/widerrufsbutton-shopify/privacy.