Workflow Transactional EmailWorkflow Transactional Email

Privacy Policy

1. Controller and contact

This Privacy Policy explains how Workflow Transactional Email ("the app") processes personal data. The app is operated by Code Creation Labs GmbH, Friedensstr. 1, 47647 Kerken, Germany (Yann Faulhaber; Amtsgericht Kleve, HRB 20472; VAT ID DE451671933).

For any data-protection question or to exercise your rights, contact us at [email protected].

2. Our role: processor for the merchant

The app is installed by a Shopify merchant (the "merchant") to extend Shopify Flow. For any personal data contained in the store data and Flow payloads the merchant routes through the app, the merchant is the data controller and we act as a processor on the merchant's behalf under Article 28 GDPR. Our Data Processing Agreement is available at dpa.

We are the controller only for the limited account and operational data we need to run the service and to communicate with the merchant (for example the merchant's contact email, shop domain and plan, and support correspondence).

3. What we process and why

Purpose of processing: Sending transactional email from Shopify Flow via the merchant's connected mailbox (Google Workspace or Microsoft 365 via OAuth) or an SMTP relay configured by the merchant; and executing the HTTP Request action - making outbound HTTP requests the merchant configures, returning the response to Shopify Flow, and storing a run history of both actions.

Categories of personal data: Recipient email addresses and names, message content (which may include order and customer data the merchant inserts via Flow variables), the credentials / OAuth tokens for the merchant's connected sending mailbox, and any personal data contained in the request or response payloads of HTTP requests the merchant configures - which the app returns to Shopify Flow and may store in the run history.

Categories of data subjects: The merchant's customers and email recipients, any individuals whose data appears in the message content or in the HTTP request/response payloads; the merchant's own staff who use the app.

Legal basis: performance of the contract with the merchant and our legitimate interest in providing and securing the service (Art. 6(1)(b) and (f) GDPR). For the personal data the merchant routes through the app, the merchant determines the legal basis towards its own customers.

4. Where your data is hosted

All processing takes place in the European Union on Google Cloud, region europe-west1 (Belgium). Databases, caches and file storage are region-local, with encryption at rest.

Personal data and secrets (such as credentials and tokens) are additionally encrypted at field level using Google Cloud KMS, with separate keys, and are decrypted only in memory for the moment a request runs.

Our public website and the documentation for the app are delivered through Cloudflare, Inc. (DNS, TLS termination and edge caching), which processes the visitor's technical connection data. The app itself and all merchant data stay on Google Cloud in the europe-west1 region.

5. Sub-processors

We engage the following sub-processors to provide the service. Each is bound by a data processing agreement with obligations equivalent to ours:

  • Google Cloud (Google Ireland Limited) - Compute, storage (incl. encrypted attachment storage on Google Cloud Storage) and Cloud KMS key management - European Union - Google Cloud region europe-west1 (Belgium) - DPA: https://cloud.google.com/terms/data-processing-addendum
  • Microsoft 365 (Microsoft Ireland Operations Limited) - Transmission of the merchant's outbound email (recipient, subject, body, attachments) when a Microsoft mailbox is connected - EU / the merchant's Microsoft tenant region - DPA: https://www.microsoft.com/licensing/docs/view/Microsoft-Products-and-Services-Data-Protection-Addendum-DPA
  • Google Workspace (Google Ireland Limited) - Transmission of the merchant's outbound email when a Google Workspace mailbox is connected - EU / the merchant's Google tenant region - DPA: https://workspace.google.com/terms/dpa_terms.html
  • Shopify International Limited - The Shopify platform - the app receives triggers from and returns data to Shopify Flow; that data may contain personal data the merchant routes through it - Ireland (EU); Shopify operates globally, third-country transfers safeguarded under Chapter V GDPR (SCC / EU-U.S. DPF) - DPA: https://www.shopify.com/legal/dpa

6. Data retention and deletion

We keep personal data only as long as needed to provide the service. All processing history (send, run and webhook history) is automatically cleared after 30 days, and operational logs are retained no longer than 30 days.

Uninstalling the app deletes the merchant's data; on termination we delete or return all personal data processed on the merchant's behalf within 30 days, unless Union or Member State law requires storage. We honour Shopify's mandatory data-protection webhooks (customers/data_request, customers/redact and shop/redact) within the timelines Shopify specifies.

Merchants can request deletion at any time by contacting [email protected].

7. International transfers

Our own infrastructure is in the EU. Where a sub-processor - in particular Shopify - processes personal data outside the EEA, the transfer is safeguarded under Chapter V GDPR, in particular the EU Standard Contractual Clauses and, where applicable, the EU-U.S. Data Privacy Framework.

8. Your rights

Subject to the applicable conditions, you have the right of access, rectification, erasure, restriction, data portability, and objection, and the right to lodge a complaint with a supervisory authority. Our lead authority is the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW).

Because we usually act as the merchant's processor, requests about a merchant's customer data are best directed to that merchant; we will assist the merchant in responding.

9. No tracking on this site

This website sets no third-party advertising or analytics cookies and embeds no third-party trackers.

10. Changes to this policy

We may update this Privacy Policy to reflect changes to the service or the law. The current version and its date are shown at the top of this page; material changes to sub-processors are notified in accordance with our DPA.

11. Our other apps

We operate other Shopify apps, each with its own privacy policy:

  • Workflow Webhooks: https://workflow-webhooks.app
  • Workflow Trigger Extensions: https://workflow-trigger-extensions.app
  • Workflow Functions: https://workflow-functions.app