/// legal
Privacy Policy
Last updated: 13 October 2026. This English version is a convenience translation; the German version prevails.
1. Privacy at a glance
General notices: The following notices provide a simple overview of what happens to your personal data when you visit this website.
2. Hosting
I host the content of my website at Vercel Inc. (Vercel). The provider is Vercel Inc, 340 S Lemon Ave #4133, Walnut, CA 91789, USA. When you visit my website, Vercel collects various log files including your IP addresses (plus time, page accessed and browser identifier) in order to deliver the page and protect it against abuse. The legal basis is my legitimate interest in secure and reliable operation (Art. 6 (1) (f) GDPR). Vercel processes the data on my behalf; transfers to the USA are based on the EU-US Data Privacy Framework or the EU standard contractual clauses. The logs are deleted automatically by Vercel, after 30 days at the latest. I deliver the fonts, scripts and images of this website myself; the only content loaded from third-party servers when a page is accessed is the graphic of the liability insurance seal (section 6).
3. Data collection on this website
Contact/Beta Form:
If you send me enquiries via the form, your details from the enquiry form, including the contact details you provided there, will be stored by me for the purpose of processing the enquiry and in the event of follow-up questions. I delete the enquiry as soon as your matter has been dealt with, after 12 months at the latest. If a contract results or the message is business correspondence, I keep it for 6 years and documents relevant to billing for 8 years (§ 147 German Fiscal Code, § 257 German Commercial Code), in each case from the end of the calendar year.
Early access pre-registration:
If you pre-register via the form, I use the order of sign-ups (time of receipt) to allocate the early access places (see Terms, early access offer); for this I use your email address and, if provided, your shop address. I keep the pre-registration list in the database of my Shopify app (hosted by Railway, servers in the EU) so that a place can be assigned to your store automatically when it is redeemed in the app. The legal basis is Art. 6 (1) (b) GDPR (pre-contractual steps taken at your request). By way of derogation from the period stated above, pre-registrations are stored until the end of the 60-day period following the launch notification and deleted afterwards unless a contract is concluded; if a contract is concluded, the retention periods stated above apply.
Delivery service for form messages:
The details submitted via the form (name, email address, shop address, selected plan and your message) are transmitted to my email inbox via the form service Web3Forms (web3forms.com). The service processes the form details and, for technical reasons, your IP address; processing outside the European Union cannot be ruled out. The legal basis is Art. 6 (1) (b) GDPR where your enquiry is aimed at a contract, and otherwise Art. 6 (1) (f) GDPR (legitimate interest in handling enquiries). If you do not want this, please write to me directly by email at hello@struxify.io.
Live demo “Try it with your own store”:
When you enter a store address in the live demo, your browser sends this address to my server (app.struxify.io, hosted by Railway in the EU). The server then retrieves the publicly visible product data of this store once (the product feed that every visitor of the store sees) and transmits the title, description and product image of one product to Google Gemini to generate the texts shown. This is factual product data, not personal data. The store address and the product data are neither stored nor logged; they only exist in memory for the duration of the request. To protect against misuse, your IP address is counted briefly (at most until the end of the day) in memory only as a non-reversible hash value. The legal basis is Art. 6 (1) (f) GDPR (legitimate interest in a working product demonstration protected against misuse). Please only enter addresses of stores that you own or manage.
4. Cookies, local storage and analytics tools
This website does not set cookies and does not store anything on your device. I currently do not use any analytics, advertising or tracking tools; a consent banner is therefore not required. The language (German/English) results solely from the address accessed.
5. Shopify App & API Data Processing (AI Integration)
When you install and use my Shopify App 'Struxify', the app accesses specific store data. This includes:
1. Store and Merchant Data:
For contract fulfillment and technical provision (Art. 6 para. 1 lit. b GDPR), I process the email address of the store administrator and the store URL. These data are used exclusively for service provision and authentication.
2. Product Data & Google Gemini API:
To provide AI optimizations (translations, SEO, GEO, metafields), store product data (titles, descriptions, weights, etc.) are transmitted via encrypted API interfaces to my sub-processor Google LLC (or affiliates). I point out that this is generally non-personal factual data (products, no buyer data). According to Google Data Cloud enterprise policies, the transmitted data is *not* used for general training purposes of their own AI models. Processing takes place within secure server environments.
6. Exali AG Liability Seal
1. Description and scope of data processing:
This site uses an integration of the Exali AG liability seal. The graphic element of the seal is loaded from the servers of Exali AG. Due to the technical design of the Internet, your IP address is processed in order to transfer the graphic to your browser. If you click on this seal, you will leave my site and be redirected to the servers of Exali AG. Further information can be found in the privacy policy of Exali: exali.de Datenschutzerklärung.
2. Legal basis for data processing:
The legal basis for data processing is Art. 6 para. 1 lit. f) GDPR (legitimate interest).
3. Purpose of data processing:
The data processing serves the purpose of providing evidence of the mandatory information on professional liability required by law according to § 2 para. 11 DL-InfoV in a visually appealing manner.
4. Legitimate interest:
My legitimate interest for data processing arises from the purpose of offering an appealing online presence and fulfilling my information obligations in an aesthetically pleasing manner.
7. Processing of business contact data for direct marketing (B2B)
I process personal data relating to contact persons at companies in order to offer those companies my products and services in the field of search engine optimisation.
1. Categories of data processed:
I only process data that the companies concerned have made publicly available themselves, usually via their website, imprint or contact page: company name, general company email address (such as info@, hello@ or service@), website URL, where applicable the name of an authorised representative named in the imprint, and publicly accessible technical characteristics of the website (for example meta information, structured data and entries in robots.txt). I do not purchase address lists and I do not collect data from sources that are not publicly accessible.
2. Purpose of processing:
The processing serves to contact companies for whose business activity my services may be relevant (B2B direct marketing) and to prepare a company-specific technical summary of their publicly accessible website.
3. Legal basis:
The legal basis is my legitimate interest pursuant to Article 6(1)(f) GDPR. My legitimate interest lies in direct marketing for my products and services and in approaching potential business customers. Recital 47 of the GDPR expressly states that the processing of personal data for direct marketing purposes may be regarded as carried out for a legitimate interest.
4. Balancing of interests:
I have balanced my interests against the interests and fundamental rights of the data subjects. As I address individuals solely in their professional capacity and via general company addresses, limit myself to self-published data, establish a connection to the recipient's professional activity and provide a simple objection mechanism at any time, I consider that the interests of the data subjects do not override mine.
5. Right to object:
You have the right to object at any time to the processing of your data for direct marketing purposes (Article 21(2) GDPR). Following an objection I will no longer process your data for these purposes. An informal message to hello@struxify.io, or a reply to the message you received from me, is sufficient. No costs arise other than transmission costs at basic rates.
6. Suppression list and retention:
In order to give lasting effect to your objection, I add your domain or email address to an internal suppression list. This list serves the sole purpose of preventing any further contact. The legal basis is likewise Article 6(1)(f) GDPR. Contact data processed for marketing purposes is deleted once the purpose no longer applies, and no later than two years after the last contact. Entries on the suppression list are retained permanently, as deleting them would defeat the purpose of the objection.
7. Note on marketing law:
Independently of the data protection basis, when contacting companies by email I observe the applicable competition and telecommunications law of the country in which the company addressed is established.
8. Retention at a glance
Server logs of the hosting provider: 30 days at most (section 2). Enquiries via the form or by email: until dealt with, 12 months at most; business correspondence 6 years, documents relevant to billing 8 years (section 3). Early access pre-registrations: until the end of the 60-day period following the launch notification (section 3). Contact data for direct marketing: no later than two years after the last contact; suppression list entries permanently (section 7). Data from the use of the Shopify app: for the duration of the installation; after uninstallation I delete the store data upon Shopify's erasure request (48 hours afterwards). Details are set out in the legal texts inside the app.
9. Controller & Your Rights
Controller within the meaning of the GDPR: Struxify — Owner: Dávid-Dennis Warning, Bürgermeister-Steenbock-Straße 21 a, 24558 Henstedt-Ulzburg, Germany, email: hello@struxify.io. You have the rights of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20), and objection (Art. 21 GDPR). You can withdraw consent at any time with effect for the future. You can also lodge a complaint with a data protection supervisory authority. Competent supervisory authority: ULD Schleswig-Holstein, Holstenstraße 98, 24103 Kiel, Germany.