Privacy policy

This privacy policy explains which personal data we process when you visit ahoiapps.com, contact us or use one of our Shopify apps, and what rights you have under the EU General Data Protection Regulation (GDPR) and the German Federal Data Protection Act (BDSG).

I. General information

1. Controller and contact

The controller responsible for data processing on this website and in our Shopify apps is:

Please send any questions about data protection or requests to exercise your rights to the email address above.

2. Legal bases

We process personal data only where the law permits it. The legal bases we rely on are:

• Consent: Art. 6(1)(a) GDPR, and § 25(1) TDDDG where information is stored on or read from your device.
• Contract or pre-contractual steps: Art. 6(1)(b) GDPR, for example when you install one of our apps or your inquiry concerns one of our apps or services.
• Legal obligation: Art. 6(1)(c) GDPR, for example statutory retention duties.
• Legitimate interests: Art. 6(1)(f) GDPR, where processing is necessary for our legitimate interests and your interests or fundamental rights do not override them.

The sections below state which legal basis applies to each processing activity.

3. Storage period

Unless a more specific period is stated below, we keep personal data only as long as needed for the purpose it was collected for. After that, we delete it.

Where statutory retention duties apply, we keep the data for the required period and restrict its processing. Under German commercial and tax law this is generally six years for business correspondence and ten years for accounting records, counted from the end of the calendar year in which the data was created.

4. Recipients and processors

We use the following service providers, which process personal data on our behalf as processors under Art. 28 GDPR. Each is bound by a data processing agreement and may use the data only according to our instructions.

Shopify and, for embedded videos, Google (YouTube) are not our processors but separate controllers (see sections 13, 14 and 15). Beyond these providers, we disclose personal data only where required by law, for example to tax advisors or authorities.

5. Transfers to third countries

Using Cloudflare, Google and Hatchbox may involve transferring personal data to the USA, a country outside the EU/EEA.

Cloudflare, Inc. and Google LLC are certified under the EU-US Data Privacy Framework. Transfers to them are therefore based on the European Commission's adequacy decision of 10 July 2023 (Art. 45 GDPR). In addition, both have agreed to the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR), which apply if the adequacy decision ceases to be valid.

GoRails, LLC (Hatchbox) is not certified under the EU-US Data Privacy Framework. Transfers to Hatchbox are based on the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR, Module Two), which form part of our data processing agreement.

You can request a copy of the Standard Contractual Clauses using the contact details in section 1. The certifications can be checked at dataprivacyframework.gov.

6. Processing when you exercise your rights

If you exercise your rights under Art. 15 to 22 GDPR, we process the data you send us to handle your request and to be able to prove that we did. The legal basis is Art. 6(1)(c) GDPR in conjunction with Art. 15 to 22 GDPR and § 34(2) BDSG.

7. Your rights

You have the following rights regarding your personal data. To exercise them, contact us using the details in section 1.

• Access (Art. 15 GDPR, § 34 BDSG): to know whether and which personal data we process about you.
• Rectification (Art. 16 GDPR): to have inaccurate data corrected.
• Erasure (Art. 17 GDPR, § 35 BDSG): to have your data deleted.
• Restriction (Art. 18 GDPR): to have the processing of your data restricted.
• Data portability (Art. 20 GDPR): to receive data you provided in a structured, machine-readable format.
• Withdrawal of consent (Art. 7(3) GDPR): to withdraw consent at any time with effect for the future.

Right to object (Art. 21 GDPR)

Where we process your data based on Art. 6(1)(f) GDPR, you can object at any time on grounds relating to your particular situation. We will then stop the processing unless we can demonstrate compelling legitimate grounds that override your interests, or the processing serves legal claims.

Right to lodge a complaint (Art. 77 GDPR)

You can complain to any data protection supervisory authority. The authority responsible for us is the Unabhängiges Landeszentrum für Datenschutz Schleswig-Holstein (ULD), Holstenstraße 98, 24103 Kiel, Germany.

8. Automated decisions and data protection officer

We do not use automated decision-making, including profiling, within the meaning of Art. 22 GDPR.

We are not required to appoint a data protection officer. For all data protection questions, please contact us directly (section 1).

II. Our website

9. Hosting and server log data (Cloudflare Workers)

This website is hosted on Cloudflare Workers, operated by Cloudflare, Inc. Cloudflare runs a global network of data centers, and your request is usually answered by the one closest to you. All connections to this website are encrypted (HTTPS).

Delivery of pages. Pages, images and fonts are static files served directly from Cloudflare's network. To deliver them, Cloudflare necessarily processes connection data, in particular your IP address, the requested URL, date and time of access, and your browser's user agent.

Contact form requests. Only requests to our contact form endpoint (/api/contact) are handled by our own application (a Cloudflare Worker). For these requests we use Cloudflare Workers Logs, which record:

• date and time of the request, the URL and the HTTP status code;
• request headers, including your IP address;
• in case of errors, the status code returned by our email provider.

The content of the form (name, email address, message) is not logged.

We process this data to deliver the website securely and reliably, to detect and fix errors, and to defend against attacks and automated abuse. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in the secure and error-free operation of the website. Workers Logs are deleted automatically after 3 days.

More information: Cloudflare Privacy Policy.

10. Contact form and email delivery (Scaleway)

When you send us a message through the contact form, we process the data you enter (such as name, email address and message) to answer your inquiry and any follow-up questions. Fields marked as required are needed to handle your request; all other information is voluntary.

The legal basis is Art. 6(1)(b) GDPR if your inquiry relates to a contract or pre-contractual steps. Otherwise it is Art. 6(1)(f) GDPR; our legitimate interest is responding to inquiries addressed to us.

How your message reaches us. Our application checks your input and passes the message to the Transactional Email service of Scaleway SAS (data center in Paris, France). Scaleway delivers it to our mailbox service@ahoiapps.com. The email is sent from no-reply@send.ahoiapps.com, with your email address set as the reply-to address so that we can answer you.

Scaleway processes the message content, sender and recipient addresses, subject line and technical delivery data (such as timestamps and delivery status) on our behalf, exclusively within the EU. Our mailbox is provided by Google Workspace (Google Ireland Limited), which receives and stores the message on our behalf. The form data is not stored in any database or storage on our website.

Spam protection. To protect the form from automated abuse, we use only server-side checks, without third-party scripts or cookies:

1. an invisible honeypot field;
2. an origin check that accepts submissions only from ahoiapps.com;
3. a link filter (no links in the name field, at most three links in the message);
4. a rate limit of three messages per minute per IP address. For this, Cloudflare briefly uses your IP address as a counter key for a 60-second window; it is not stored permanently.

The legal basis for spam protection is Art. 6(1)(f) GDPR; our legitimate interest is protecting our website and inbox from spam and abuse. We keep your inquiry until it has been fully handled, unless statutory retention periods apply (see section 3).

More information: Scaleway Privacy Policy.

11. Contact by email

If you contact us directly by email, we process your message and the contact details you provide to handle your request. Incoming emails are received and stored in our Google Workspace mailbox (see section 4).

The legal basis is Art. 6(1)(b) GDPR if your request relates to a contract or pre-contractual steps, and Art. 6(1)(f) GDPR otherwise. We delete the data once your request has been handled, unless statutory retention periods apply.

12. Cookies, browser storage and analytics

This website does not set cookies and does not use advertising or cross-site tracking. Analytics only runs with your consent. Fonts and images are served from our own server; we do not use Google Fonts or external CDNs.

Browser storage (sessionStorage). When you submit the contact form, your email address is briefly stored in your browser's sessionStorage so that the thank-you page can show where we will reply. It is read once and deleted immediately, at the latest when you close the tab, and is never transmitted to us. This storage is strictly necessary to provide the confirmation you requested (§ 25(2) No. 2 TDDDG).

Cloudflare Web Analytics (only with your consent). If you agree in our consent banner, we use Cloudflare Web Analytics to understand how our website is used and to improve its performance. The script is loaded from static.cloudflareinsights.com only after you have consented. It sends the following measurement data to cloudflareinsights.com: page visited, referrer, page load times, country and device type. To send this data, your browser necessarily transmits your IP address to Cloudflare; according to Cloudflare, it is not used to identify or track you. Cloudflare Web Analytics does not set cookies, does not use fingerprinting and does not create user profiles. On transfers to the USA, see section 5.

The legal basis is your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG). You can withdraw it at any time with effect for the future via the “Privacy settings” link in the footer of every page. If you decline or withdraw, the script is not loaded.

Storing your choice. Your decision (consent given or declined) and the date are stored in your browser's localStorage under the key “ahoi-consent” (not a cookie) so that we do not ask you again on every page. This is strictly necessary to respect your decision (§ 25(2) No. 2 TDDDG). The entry is not transmitted to us; you can delete it at any time via your browser settings.

13. YouTube videos

Videos on our website are embedded with a click-to-load solution using youtube-nocookie.com. Before you click, nothing is loaded from YouTube; the preview image is served from our own server.

Only when you click on a video does your browser load the YouTube player from Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google then receives at least your IP address, the page you are visiting and technical information about your browser and device. Google may store information on your device (for example cookies or local storage) and may transfer data to Google LLC in the USA, which is certified under the EU-US Data Privacy Framework.

By clicking, you consent to loading the video. The legal basis is Art. 6(1)(a) GDPR and § 25(1) TDDDG. You can withdraw your consent at any time with effect for the future by not loading further videos and deleting stored browser data. Google is responsible for its own processing after the video has loaded: Google Privacy Policy.

III. Our Shopify apps

14. Scope and roles

This part applies to the apps Ahoi Apps publishes in the Shopify App Store: Easy Recipe Pages, Auto TOC: Blog SEO & Nav, Estimated Read Time, Blog Filter & Search, Blog Posts Likes, Easy Rich Snippets for SEO, Easy Sitemap Builder for SEO and LLMs.txt Generator.

For data about you as a merchant and about the staff users of your store, we are the controller. None of our apps reads customer or order data from your store. Where features in your online store process data of your store's visitors (section 16), we do so on your behalf as your processor under Art. 28 GDPR; the terms of this processing are set out in our Data Processing Agreement, which applies automatically when you install one of our apps.

Shopify International Limited, Victoria Buildings, 2nd Floor, 1-2 Haddington Road, Dublin 4, Ireland, operates the Shopify platform and is responsible for its own processing, including the billing of app subscriptions: Shopify Privacy Policy.

15. Data we process when you use our apps

When you install one of our apps, we receive and store:

• your shop's domain (myshopify.com address);
• the access token and refresh token issued by Shopify, their expiry, and the access permissions (scopes) you granted;
• installation status and subscription data (plan, subscription status and IDs).

We do not store payment data. Charges for app subscriptions are processed entirely by Shopify.

Store content. To provide their functions, our apps read store content through the Shopify API within the granted scopes, for example products, collections, pages, blogs and articles. Most apps process this content only when needed and save their settings as metafields or metaobjects in your own store, where they remain after uninstalling until you delete them. LLMs.txt Generator stores copies of your products and variants, collections, pages, blogs and articles in our database in order to generate your llms.txt file.

Session cookie. Our apps set a technically necessary session cookie that contains only a random session identifier. On our server, this identifier is linked to your language setting and a security token that protects against cross-site request forgery (CSRF). Sessions are deleted automatically after 30 days of inactivity. The legal basis is § 25(2) No. 2 TDDDG and Art. 6(1)(f) GDPR; our legitimate interest is the secure operation of the app.

Resources loaded in the Shopify admin. When you use our apps in the Shopify admin, your browser loads resources from Shopify (cdn.shopify.com) and, in some apps, from jsDelivr (cdn.jsdelivr.net). Tutorial videos are embedded from YouTube (youtube-nocookie.com, Google). In Easy Recipe Pages, custom CSS you choose to check is sent to the W3C CSS validator (jigsaw.w3.org). In each case, the provider receives your IP address and browser information.

The legal basis for providing the apps is Art. 6(1)(b) GDPR (performance of our contract with you).

16. Features in your online store

Most of our theme app extensions run entirely within Shopify and the visitor's browser. They do not contact our servers and store nothing on visitors' devices. This applies to Auto TOC, Estimated Read Time, Blog Filter & Search (which uses your store's own Shopify search), Easy Rich Snippets for SEO and Easy Sitemap Builder for SEO.

The following features send requests from your storefront to our servers through the Shopify App Proxy. For these requests, our server logs record technical data including the visitor's IP address and browser information; logs are deleted after 7 days (section 17). We process this data on your behalf.

• Blog Posts Likes: When a visitor clicks like or dislike, a random identifier is created in the visitor's browser (localStorage key easy_article_visitor_id) and sent to us with the article ID and the interaction. Like counts are stored as metafields in your store, not per person. Only if you enable “one like per day” do we store the identifier together with the article and interaction to enforce the limit; if no identifier is available, a shortened hash of IP address, browser and language is used instead. These entries are deleted after 3 days.
• Easy Recipe Pages: The recipe block stores a random identifier (rp_visitor_id, created on the first rating), the visitor's own ratings, ticked ingredient checkboxes and the cook-mode setting in the visitor's browser (localStorage). Ratings are sent to us and added to a total stored as a metafield in your store; we do not store any identifiers. Recipe videos you embed are loaded from YouTube, Vimeo or Dailymotion.
• LLMs.txt Generator: Requests for your llms.txt file, for example from AI crawlers, reach our server through the App Proxy. Nothing is stored apart from the server logs.

As the operator of your online store, you are responsible for informing your visitors about these features and, where required, obtaining their consent (for example under § 25 TDDDG for information stored in their browser).

17. Infrastructure, logs and backups

Our apps run on servers of Hetzner Online GmbH in Germany; the application and its databases are located there. We use Hatchbox (GoRails, LLC, USA) to deploy and manage these servers; for this, Hatchbox has technical access to them (see sections 4 and 5). All requests to our apps are routed through Cloudflare, which protects them against attacks.

Server logs. Our apps log technical request data: time, requested URL including your shop domain, HTTP status code, IP address and browser information. We use these logs to operate the apps securely and to fix errors (Art. 6(1)(f) GDPR). They are deleted automatically after 7 days.

Backups. We back up our app databases daily to Cloudflare R2 storage located in the EU. Backups are deleted automatically after 14 days.

18. Storage and deletion

We store your shop data as long as the app is installed. When you uninstall an app, we delete all data relating to your shop, including stored store content, at the latest when Shopify sends us its deletion request (shop/redact) 48 hours after uninstalling. Settings saved as metafields or metaobjects in your own store remain there until you delete them.

Exception for lifetime plans. If you purchased a lifetime plan, we keep only your shop domain, the plan and the related subscription details after deletion, so that you can reinstall the app without paying again. Access tokens and all other data are deleted. The legal basis is Art. 6(1)(b) GDPR. You can ask us at any time to delete this entry as well; you then lose the lifetime entitlement.

Requests from your customers to access or delete their data reach us through Shopify (customers/data_request, customers/redact). As our apps do not store customer data, there is usually no data to provide or delete.

Deleted data may remain in our backups for up to 14 days until they are overwritten.

IV. Final provisions

19. Changes to this policy

We update this privacy policy when our website, our apps or the services we use change, or when the legal requirements change. The current version is always available on this page.

Last updated: October 2026