← AETHER Blocks · Impressum · Support · AVV

Privacy Policy — AETHER Blocks

Last updated: 2026-10-06

This Privacy Policy describes how the Shopify app AETHER Blocks (the "App"), operated by AETHER Studio, Leopold Schuller ("we", "us"; address in the Impressum), collects, uses, and shares information when a merchant installs or uses the App, and when shoppers visit a store that uses it.

1) Information about merchants

When you install the App, Shopify provides and we store:

• your store domain (*.myshopify.com) and the store's Shopify ID;
• an offline access token and refresh token issued by Shopify, with the granted scopes and their expiry;
• your current plan in the App (read from Shopify's Partner API).

The App requests these permissions: read_products (product names and images for discount rules), read_discounts/write_discounts (the automatic set and quantity discount), read_pixels/write_pixels and read_customer_events (the analytics pixel described below), read/write_validations, read/write_payment_customizations and read/write_delivery_customizations (the optional checkout rules: minimum order value, payment methods from a cart value, shipping methods by country). It cannot read or change your theme files, orders, or customer records.

If you set up the optional one-click offer after checkout, we store the chosen product (ID, title, image URL), its variant ID, the discount percentage and whether the offer is active. This is deleted on shop/redact.

Your block settings live in your theme, your discount rules in Shopify's discount and app metafields. We do not copy them into our database.

2) Information about shoppers (Block-Analytics)

The App installs a Shopify web pixel that runs in Shopify's sandbox and only runs if the shopper's cookie and privacy choices allow analytics. It sends to our server:

• clicks inside AETHER blocks: block name, action (for example "add to cart"), and the button or product label;
• completed checkouts: order total, currency, and number of line items;
• if you add the survey to the thank-you page: the answer the shopper picked (for example "Instagram"), nothing else;
• Shopify's pseudonymous browser identifier (clientId), so a checkout can be matched to earlier block clicks in the same browser.

We do not receive or store names, email addresses, phone numbers, postal addresses, IP addresses, order or customer IDs, or payment data. The identifier cannot be linked to a customer by us. The data is used only to show you, the merchant, which blocks are clicked and how many orders followed.

The storefront blocks themselves are served by Shopify and load no third-party scripts, fonts, or trackers. If you add a YouTube or Vimeo video, the player is loaded from YouTube (privacy-enhanced mode, youtube-nocookie.com) or Vimeo only after the shopper clicks play; until then only your own poster image is shown.

3) Store check (AETHER-Empfehlung)

When you start a check in the App, our server loads the public pages of your own store (your domains or *.myshopify.com) once and analyzes the HTML. Other websites cannot be checked. To show your progress, we store the score and which checks passed or failed, with the date. Page content is not stored. This history is deleted with all other store data on shop/redact.

4) Legal basis and retention

• Merchant data is processed to provide the App you installed (Art. 6(1)(b) GDPR) and kept for as long as the App is installed.
• Analytics events are processed on your behalf as your processor (Art. 28 GDPR) and deleted automatically after 180 days. Our data processing agreement (AVV) applies automatically when you install the App.
• Uninstall: on Shopify's app/uninstalled webhook we delete your access tokens immediately.
• GDPR shop/redact (48 hours after uninstall): we delete all remaining data about your store, including all analytics events and store-check history.
• GDPR customers/redact and customers/data_request: we hold no data that identifies a customer, so there is nothing to delete or export.

5) Subprocessors

• Shopify — app platform, authentication, billing, web pixel runtime
• Fly.io — hosting of the App's server in Frankfurt, Germany
• Neon — managed PostgreSQL database in Frankfurt, Germany (AWS eu-central-1)
• Sentry — error monitoring, only if enabled; no shopper data is sent

All data is stored in the EU. Fly.io, Neon, and Sentry are US companies; where they may access data, transfers are covered by the EU Standard Contractual Clauses and, where applicable, the EU–US Data Privacy Framework.

We do not sell, rent, or share your information for advertising, and we do not use it to train AI models.

6) Your rights (GDPR)

You have the right to access, rectify, erase, restrict, port, and object to the processing of your data, and to lodge a complaint with a supervisory authority. Shoppers should contact the store they bought from; we support merchants with such requests. Email leopold@aetherstudios.de. We respond within 30 days.

7) Security

• All traffic uses HTTPS (TLS 1.2+).
• Access tokens expire and are refreshed automatically; the database is encrypted at rest and in transit.
• Production access is restricted to the App operator.

8) Changes

We may update this Privacy Policy. Material changes will be announced in the App's dashboard at least 14 days before they take effect.

9) Contact

AETHER Studio (Leopold Schuller) · leopold@aetherstudios.de