Privacy policy for Rulecart: Kündigungsbutton
“Rulecart: Kündigungsbutton” is a Shopify app. It adds the cancel button required by German law (§ 312k BGB) to a shop, takes cancellations and confirms them.
Who is responsible
Provider of the app: Julius Scheuerer, c/o COCENTER, Koppoldstr. 1, 86551 Aichach, Germany, hello@rulecart.com.
Merchant data
When a merchant installs the app, we process the shop domain, the shop name, the language of the Shopify admin, the shop's time zone, the shop's email address, the email address for copies (used only after it was confirmed through a link), the Shopify session credentials and the optional answer on how the merchant found the app. Purpose: to provide the app (Art. 6(1)(b) GDPR).
Data of the merchant's customers
Through the cancellation form in the shop we process: name, contract, type of cancellation, the reason where given, the requested end of the contract, the email address, reference number, time of receipt and language. We process this data on behalf of the merchant (Art. 28 GDPR); the merchant is the controller. We use it only to store and confirm the cancellation and to make it available to the merchant.
IP addresses are not stored. To prevent abuse, the app counts submissions in memory for at most 10 minutes.
Processors
Hetzner Online GmbH, Germany: server and database (data centre in Nuremberg), backups (Finland).
Scaleway SAS, France: sending the confirmation emails.
Shopify International Limited, Ireland: app platform, sign-in and billing.
Server, database, backups and email sending are in the EU. The form in the shop is sent through Shopify's app proxy; Shopify's privacy policy applies to that step.
Retention and deletion
The app deletes each cancellation three years after the end of the calendar year in which it was received: received in 2026, deleted from 1 January 2030 (German time). Until then, the merchant can prove receipt. If a customer asks the merchant for deletion, we delete their cancellations earlier. After an uninstall, the app deletes all data of the shop when Shopify triggers it (after 48 hours). Deleted data leaves the backups within 30 days.
Cookies and analytics
The app's pages in the shop set no cookies and contain no analytics or advertising tools.
Your rights
You have the right of access, rectification, erasure, restriction, data portability and objection. Customers of a shop should first contact the merchant; we support the merchant. You may complain to a data protection authority, for example the authority of North Rhine-Westphalia (LDI NRW).
Contact: hello@rulecart.com.
Data processing agreement
A data processing agreement under Art. 28 GDPR applies to every merchant, on every plan: the European Commission's standard contractual clauses with our annexes, part of the terms of service at /terms.