Privacy Policy for Kartuu

Kartuu is a Shopify app of KYTH. Systems UG (haftungsbeschränkt). It turns paid Shopify orders into personalised gift vouchers as PDFs. This policy describes which personal data Kartuu processes in doing so.

This is an English translation. The legally binding version is the German one, the Datenschutzerklärung. This translation is provided for your convenience; where the two differ, the German version prevails.

1. At a glance

• Data of merchants. For each shop, Kartuu stores the myshopify domain, a search hash of it, the encrypted Shopify access tokens, the subscription status, a redeemed promo code, your contact address, the record of your consent together with the language in which you saw Kartuu at the time, your settings (appearance, house colours, email sending, voucher product), the state of the setup, of the setup email and of the review request, and the pictures you upload. If you uninstall Kartuu, we learn from Shopify the reason you give when doing so. Details in section 5.
• Data of your customers and of recipients. If someone buys a voucher in your shop, Shopify reports the paid order to us (orders/paid). From this, one record is created per item purchased, with the name and email address of the buyer, the recipient's name, the recipient's email address, the sender's name and the greeting – all encrypted –, plus customer number, order identifier, amount, preferred date and the encrypted voucher code. For this data we are the shop's processor. Details in section 6.
• Uploaded pictures are kept for as long as your shop exists. If the longer edge measures more than 2000 pixels, we scale the picture down. We remove embedded capture data such as time of capture, device and location from every picture; only the orientation is kept. If a picture belongs to the design of your voucher product, any person who opens that product page with the card preview can retrieve the image file. Details in 5.1.
• Outgoing connections. At Shopify, Kartuu calls the token endpoint and the Admin API of your own shop, as well as the storage location Shopify names for uploading a product image; Kartuu does not query customer data fields there. If you have set up email sending, Kartuu also connects to the mail server you entered and hands in the voucher emails there. Our server asks Shopify, through the Partner API, which shops have uninstalled Kartuu and for what reason, and sends our own emails through our mailbox at INWX GmbH. Details in section 7.
• Your browser loads a program library from Shopify (cdn.shopify.com) when you open the app. Details in 5.4.
• Email sending. Kartuu sends voucher emails exclusively through the mail account you set up yourself. If you set up none, Kartuu sends no voucher emails. We ourselves write to your contact address only with the notices from 5.3 – among them, once after installation, the setup email, if you have chosen a plan and steps are still missing before the first voucher sale. We do not send marketing.
• No tracking, no analytics services, no cookies, no fonts or icons from third-party servers.
• Server, database and backups are located in Berlin.

2. Controller

KYTH. Systems UG (haftungsbeschränkt)
Prof.-Mederer-Straße 4
92348 Berg
Germany

Represented by its managing directors Stefan Grasse and Stephan Wittmann
Register court: Local Court (Amtsgericht) Nürnberg, HRB 46313

Contact for data protection matters: datenschutz@kyth.systems
General contact: hello@kyth.systems
Phone: +49 1575 1603446

Data protection officer: No data protection officer has been appointed; under section 38 of the German Federal Data Protection Act (BDSG) there is no obligation to do so at the company's current size. The address above is responsible for all matters.

3. Three roles

This policy is addressed to three groups, and something different applies to each.

The third column covers two people: the person who bought the voucher and the person it is meant for. Of the recipient, Kartuu stores the name, email address and the greeting addressed to them, even though they ordered nothing themselves. For them, too, we are the processor; the controller is the shop (6.1, 10.2).

It is not we but the shop who decides on the purposes and means of processing a shop's customer data. The basis is a data processing agreement under Art. 28(3) GDPR, which the merchant concludes with us.

How the contract is concluded. When the app is connected in the Shopify admin, we show you three documents – this policy, the data processing agreement and the terms of service – and ask for your consent. Without consent, the app is not connected: no record of your shop is created, and no access tokens are obtained from Shopify. What we store as a record is set out in 5.3.

If the content of one of the three texts changes, it receives a new identifier, and you are asked for your consent again the next time you open the app. All three documents can be retrieved without logging in at https://kartuu.kyth.systems/rechtliches/; on request to datenschutz@kyth.systems we will also send them to you.

4. What Kartuu does

4.1 Overview

• Connecting. Kartuu receives your shop domain and your consent, obtains access tokens from Shopify and renews them, checks incoming webhooks for authenticity, serves the three data protection webhooks required by Shopify and reads your shop's subscription status from Shopify.
• Designing. Kartuu receives uploaded pictures, checks and keeps them, and generates a preview and a PDF of the voucher card from the details you type in the admin.
• Setting up a voucher product. On your click, Kartuu creates a voucher product with variants and metafields in your shop – as many as you create, each as a value voucher or as a service voucher – and generates a product image for it. Without your click this does not happen.
• Receiving paid orders. When a paid order with a voucher line item arrives via the orders/paid webhook, one record is created per item purchased. The details from the order form are stored encrypted. Only a product you have set up in Kartuu as a voucher product counts as a voucher line item; if other products carry Kartuu details, you decide in the order overview (“Check product”) before a voucher is made from them.
• Creating a gift card. For a value voucher, Kartuu generates a voucher code and uses it to create a Shopify gift card through the Admin API. The code is stored encrypted immediately.
• Generating and delivering the card. The PDF is created from a copy of the template and the stored details. It is delivered by email through the merchant's mail account to the recipient, and through a claim page whose address is made known with the voucher. Buyers can also retrieve the voucher through the Kartuu block on the thank-you page and the order status page (6.5).
• Cancelling. If the merchant cancels an order or fully refunds a voucher line item, Kartuu deactivates the associated gift card. After a partial refund, or for a card that has already been partly used, the merchant decides in the order overview; before that, Kartuu queries the balance from Shopify. Immediately before a voucher is issued, Kartuu queries the order's cancellation and payment status; if it has been cancelled or fully refunded, no voucher is created.

4.2 What Kartuu does not do

• Kartuu does not query any customer data fields from Shopify – no address, no phone number, no payment data. The personal order data comes exclusively from the webhook. When a voucher is released, Kartuu queries the state of the order (fulfillment orders and open quantities) in order to report the voucher line item as fulfilled, and, immediately before a voucher is issued, its cancellation and payment status.
• Kartuu does not store balances. If the merchant asks for the redemption status in the order overview or opens the export, the balance is read from Shopify and displayed, but not stored. The export contains neither names nor voucher codes. Of a gift card, Kartuu keeps only its identifier.
• Kartuu does not keep generated PDF files. A PDF can be generated again at any time from the stored details.
• Kartuu does not use its own mail provider for voucher emails. They are handed in exclusively through the mail account the merchant sets up. Only our notices to merchants (5.3) go out through our own mailbox, never a voucher.

4.3 Permissions granted

On installation, Kartuu requests four permissions as well as access to the protected customer data fields “Name” and “Email address”. Shopify shows you this on installation, and you grant it by installing.

read_all_orders is not requested: Kartuu only needs orders from installation onwards. Nor is write_publications – whether your voucher product becomes visible in your online store is for you to decide.

5. Data of merchants (we are the controller)

There is no processing for our own purposes – in particular for advertising, profiling, resale, training models or evaluations across merchants. The exceptions are the reason you give when uninstalling – we read it to improve Kartuu (5.3) – and the state of Shopify's request for a review, so that we do not ask more often than Shopify allows (5.1).

5.1 What is stored

A personal reference usually arises only indirectly here: the shop domain identifies a business, and in the case of sole traders there is a natural person behind it. We therefore treat this data like personal data.

The access log has no column that could hold a name, an address, an email address or a voucher number. There is no choice regarding this log; it is a condition of Shopify's approval.

Necessity. Providing the shop domain and the Shopify access tokens is neither required by law nor by contract, but it is necessary for using Kartuu. This data arises automatically when you connect the app. Your contact address is a mandatory field: without it and without your consent, the app is not connected, and no contract is concluded (Art. 13(2)(e) GDPR).

Where the pictures are stored. All other details in this table are stored in the database on our server in Berlin, except for the reason for an uninstallation (5.3). The image content of the pictures is stored as a file on the same server, on a persistent storage medium. It is not part of the database backup (9.6).

Who can retrieve a picture. There is no address under which the storage would be generally readable. In the admin, you receive your pictures after your session has been checked. Outside of it, a picture is delivered only through a signed address that becomes invalid after one to two hours: in the preview in the admin and – if the picture or logo belongs to the design of a voucher product – to any person who opens that product page with the card preview (6.6). That person can download the image file as it is stored.

What an uploaded picture contains is up to you. We check it for format, dimensions and harmlessness (11.2) and do not look through its content. A photo from a mobile phone can carry the time of capture, the device and the location. We remove this capture data from every picture on upload; only the orientation is kept, so that a photo taken upright does not lie on its side. If the longer edge measures more than 2000 pixels, the picture is also scaled down and re-encoded; a smaller picture is not re-encoded. Pictures uploaded before 23 September 2026 have been cleaned in the same way.

5.2 What is not stored

• Your session token (the Shopify-signed proof of your logged-in session) is only checked in memory and then discarded – not in the database, not in the log, not in browser storage. Only the shop domain, the app identifier and the validity times are read (5.6).
• Credentials never get into a log – neither access, refresh nor session tokens, not even shortened.
• Error messages. In the event of an error, as a rule only the type of exception is written. In some cases the exception's message is also logged, because the cause could not be found otherwise: when obtaining a token from Shopify temporarily fails (own text, HTTP status code, shop domain), when a card design cannot be checked or rendered (affected field or image key), when a picture is rejected on upload (the reason), when the image storage is unreachable and when a step of the daily clean-up run fails. Tokens, contact addresses, voucher codes and the names, greetings and email addresses of your customers do not appear in it in plain text.
• Your contact address does not appear in any log line.
• The country of your shop. At your first consent we ask Shopify once for the country code of your shop – only the code from the billing address, for example “US” – and then set the language and paper of your cards: English on US Letter in the United States and Canada, German in Germany, Austria, Switzerland and Liechtenstein, otherwise English, each on A4. Only this setting is stored (5.1), and you can change it under Settings at any time; we neither store nor log the country code itself. For shops in the United States and Canada, however, the setting (“English (US)”) reveals the country.
• Your first name from Shopify. For the salutation of the setup email, we read from Shopify the name Shopify holds as the owner of your shop and take the first name from it – only at the moment the email is created. It is stored neither in our database nor in a log line, but only in the email to you (5.3). If the email does not arrive, the receiving mail server usually returns it to our mailbox with an error message; we delete such a bounce as soon as we have checked the address, at the latest after 30 days.

5.3 Your contact address and the record of consent

In the consent step, we ask for an email address at which we can reach you. Together with your consent, we store:

The version identifier is set exclusively by the server; a value sent along by the browser is not accepted. Every consent given is recorded individually.

What we do with it. We write to you at this address in the event of a personal data breach, a change of the data processing agreement, a change of a sub-processor, or to forward a request that a data subject has addressed to us instead of you. We announce a change of the data processing agreement to you at least 30 days in advance (§ 0.3 there) – automatically, from our own mailbox at INWX GmbH (section 7), in the language in which you saw Kartuu when consenting (in German if we do not know it); we record which version we announced to you and when. Before sending, we receive a preview with your shop domain and the text, afterwards a short report; we delete both after 30 days. If you have set up a mail account, Kartuu also sends a note to this address through that account at most once a day when orders need your attention – only with counts and a link into the app.

We also write to you once with the setup email: on the morning after installation, and only if you have chosen a plan and a step is still missing before the first voucher sale – such as the voucher product or a Kartuu block in your theme. If you choose the plan later, it comes on the morning after, at most one week after installation; without a plan we do not write to you. It names the missing steps and how to do them, in the language in which you saw Kartuu when consenting, and comes from our own mailbox at INWX GmbH (section 7). We send no further emails of this kind, not even a reminder. The setup email contains no advertising: no price, no promo code, no request for a review and no call to book a plan. The legal basis is Art. 6(1)(b) GDPR (terms of service).

It addresses you by the first name Shopify holds as the owner of your shop; we read it only when sending and do not store it (5.2). If there is no usable first name, we greet you without a name. The legal basis for this salutation is Art. 6(1)(f) GDPR – legitimate interest: to address you personally. You can object (Art. 21 GDPR, 10.1); we will then greet you without a name.

We do not send marketing. The address is not passed on to third parties and not analysed.

If you write to us, we process your message and your sender address in order to answer it. The legal basis is Art. 6(1)(b) GDPR insofar as the terms of service are concerned, otherwise Art. 6(1)(f) GDPR – legitimate interest: to answer requests addressed to us.

Changing the address. Write to datenschutz@kyth.systems. With every new version of these texts, the consent step also shows you the stored address for editing.

Billing. Kartuu uses the app plans managed by Shopify: selection and payment take place at Shopify. We ask Shopify whether your subscription is active, what the plan is called, whether it is a test subscription and until when the current billing period runs; the latter is only displayed and not stored. We do not process payment data; it remains with Shopify.

On the plan “Kartuu Free”, we report to Shopify, for billing, the value of each voucher issued in US dollars, together with the identifier of your shop and the time, and store these reports until your shop is deleted. For the conversion we retrieve the reference rates of the European Central Bank; no details about you or your customers are transmitted in doing so. This applies only to shops that have consented from consent record ID 1.27-2026-10-06 on.

Promo code. If you redeem a promo code under Settings, we store the code and the time with your shop. The discount is not granted by Kartuu itself: we enter it manually at Shopify (terms of service § 5). So that we learn of it, our server sends a message to our own mailbox at INWX GmbH (section 7) – with your shop domain, the code, the time, your plan status and whether Kartuu is still installed; it contains no other details. As soon as you have booked a plan, a second message of the same kind follows. So that none comes twice, the server records which redemptions it has already reported (shop domain and time); if your shop disappears from our database (9.2), the record disappears with the next run, at the latest after one hour. We delete the messages from the mailbox as soon as the discount has been entered or it is certain that it will not be entered. The legal basis is Art. 6(1)(b) GDPR.

If you uninstall Kartuu. When you uninstall, Shopify asks for a reason and offers a free-text field for it. Shopify provides both to us as the app's developer through its Partner API, together with the shop domain and the time. Our server queries this information every hour and sends it as an email to our own mailbox at INWX GmbH (section 7) – supplemented by the date of installation, your plan and whether the setup was completed, as long as this information is still in our database (9.2). The email contains no data of your customers. We read it to understand why merchants remove Kartuu again and to improve the app; we do not send you a survey about it. We delete the email after 30 days. So that no uninstallation is reported twice, the server records the shop domain and time of every reported uninstallation; the record is cut back to the last 30 days on every run. The legal basis is Art. 6(1)(f) GDPR – legitimate interest: to learn where Kartuu falls short and to improve the app. You can object to this at any time (Art. 21 GDPR, 10.1).

5.4 App Bridge from the Shopify CDN

Kartuu's embedded interface loads the “App Bridge” library directly from cdn.shopify.com. This request comes from your browser. Shopify receives the usual connection data (IP address, browser identifier) and the origin https://kartuu.kyth.systems, but no customer, order or voucher data and no token. The recipient is Shopify, i.e. the same party that delivers the Shopify admin to you.

5.5 No cookies of our own, no tracking in the app

Kartuu sets no cookies of its own and does not use sessionStorage. No analytics, statistics, advertising or tag services are integrated in the app, and no external font or icon services are called. If Kartuu reads the cookie kyth_klick of our website, it does so solely for the attribution in 5.7 and only if you consented to it on kyth.systems.

Two entries in browser storage. Kartuu stores at most two notes in your browser's localStorage, each only on your click:

• Under “Orders”, a note may appear that the Kartuu block on the thank-you page is missing. If you choose “Don't show again” there, Kartuu notes that you have hidden this note.
• On the start page, a note about what's new in Kartuu may appear. If you choose “Got it” there, Kartuu notes which news item you have seen – as its date.

The notes contain no information about you or your shop and are not transmitted to us. You remove them by deleting the site data of kartuu.kyth.systems in your browser; the notes then appear again.

Consent under section 25 of the German Telecommunications Digital Services Data Protection Act (TDDDG) is not required: the notes are strictly necessary so that the function you have expressly requested – keeping the respective note hidden – can be provided (section 25(2) no. 2 TDDDG).

5.6 If you act for a merchant in the Shopify admin

This information applies to people who open Kartuu for a merchant without being the merchant themselves – such as employees, agencies or technical service providers. Art. 14 GDPR applies.

• Which data. The session proof signed by Shopify (session token) with shop domain, app identifier, validity times and a user identifier assigned by Shopify. The user identifier is not evaluated.
• Source. From Shopify (Art. 14(2)(f) GDPR).
• Purpose and legal basis. Checking that a request is genuine and which shop it belongs to. Art. 6(1)(f) GDPR – legitimate interest: to authenticate requests and to keep shops separate from one another.
• Retention. None; the proof is checked in memory and discarded.
• Information. Through publication of this policy, as we do not know your contact details (Art. 14(5)(b) GDPR).
• Your rights. As in section 10.1, addressed to datenschutz@kyth.systems.

5.7 Attributing your installation to an ad

This information applies only if you came to Kartuu through our website kyth.systems and consented to the Meta pixel in its banner. The website then sets the cookie kyth_klick for kyth.systems and its subdomains (website privacy policy, section 9).

• What Kartuu reads. After the installation, Kartuu reads this cookie if your browser sends it when you open the app, or if you choose "Link briefly" on the start overview; kartuu.kyth.systems then opens briefly in the browser window for this. The cookie contains a random identifier, the Meta identifiers _fbc and _fbp, the campaign details of the ad (utm), the page visited and the times of the click and of the consent.
• When not. Without consent there is no cookie and no attribution. Kartuu only attributes if the click was at most 90 days before the installation, and only once per shop. Kartuu does not attribute shops that agreed to a version before the identifier 1.26-2026-09-28.
• What goes to Meta. The event "StartTrial" (start of the trial) with the time of the installation, the address of the website page, _fbc and _fbp, the random identifier as a checksum (SHA-256), and the IP address and browser identifier (user agent) of the request that read the cookie. It is transmitted via Meta's Conversions API, at most seven days after the installation and only if _fbc or _fbp is present. Your shop domain, your contact address, your name and data of your customers do not go to Meta.
• What we store. The details from the cookie and the status of the transmission. We delete the IP address and browser identifier as soon as the event has been sent or it is certain that it will not be sent, at the latest eight days after the installation. We delete the rest together with your shop (9.2).
• Why. To see which ad led to an installation and to align our ads accordingly.
• Legal basis. Your consent on kyth.systems under Section 25(1) TDDDG and Art. 6(1)(a) GDPR. For the collection and the transmission to Meta, we and Meta Platforms Ireland Ltd. are joint controllers (Art. 26 GDPR); the arrangement for this is the Controller Addendum in Meta's Business Tools Terms. Meta alone is responsible for further processing; details are in Meta's privacy policy.
• Withdrawal. Via "Privacy settings" in the footer of kyth.systems; the website then deletes the cookie. We delete an attribution already stored on request to datenschutz@kyth.systems; we cannot recall an event already reported to Meta.
• Promotional code from an ad. If you redeem a promotional code that exists only in our ads (currently LAUNCH50) and there is no attribution through the cookie, we record this as the origin of your installation. This stays internal; nothing goes to Meta.

6. Data of a shop's customers (we are the processor)

6.1 Who is affected and what is stored

The recipient's email address is stored so that the voucher can be delivered to them: the email goes out through the merchant's mail account and contains the voucher as a PDF and a claim link. If the merchant has not set up a mail account, no email is sent. With the card, the recipient also learns the giver's name and the greeting. As the recipient did not provide their data themselves, Art. 14 GDPR applies to informing them; this is the shop's responsibility (6.3).

One record is created per item purchased:

Not stored: the customers' postal address and phone number, payment data, the order content outside the voucher line items and the order header, and the generated PDF.

Processed only briefly:

• the sample details used when designing in the admin – they are put into a preview and a PDF and not stored; only a draft the merchant expressly saves is stored (5.1);
• the details from the Kartuu block and the card preview in the shop (6.5, 6.6);
• the content of the data protection webhooks – it is read in for the signature check and then discarded (6.4);
• the generated PDF – it is discarded after delivery.

Uploaded pictures. What can be seen in a picture is decided by the merchant alone; Kartuu does not check it. If a picture shows people, their data is stored for as long as the shop exists (5.1). The upload is an instruction from the merchant (§ 3.2 no. 3 of the data processing agreement).

6.2 How long this data is stored

Shopify does not transmit the erasure of a recipient who has never bought anything in the shop themselves. It is carried out manually on request to datenschutz@kyth.systems (10.2).

6.3 On whose instructions we act

The processing of order, customer and recipient data takes place exclusively on the shop's instructions. The legal basis towards the data subject is provided by the shop – as a rule Art. 6(1)(b) GDPR for the performance of the purchase contract. The duty to inform recipients under Art. 14 GDPR lies with the shop.

6.4 Shopify's three data protection webhooks

Only the customer number and the email address are evaluated from these webhooks; other details sent along, such as phone number and postal address, are discarded. Every webhook is checked against its signature before processing (HMAC-SHA256). Our role is that of the processor; the shop's legal basis is as a rule Art. 6(1)(c) GDPR. What remains is an entry in the access log without a name, address or customer identifier.

Even without a customer account. A person is found through their customer number or through their email address – as recipient as well as buyer, even if they bought without a customer account. For vouchers from before 23 September 2026, we add the search value of the buyer's address needed for this, as long as the address is stored.

6.5 The Kartuu block on the thank-you and order status page

The merchant can place a Kartuu block on the thank-you page and on the order status page of their shop. The buyer's browser then calls our server.

6.6 The card preview on the product page

If the merchant places the Kartuu block on their product page, it shows a preview of the voucher card there. The visitor's browser loads this preview through an address of the shop (/apps/kartuu/…); Shopify forwards the request to our server with a signature, adding the shop domain and, for logged-in customers, their customer number. Kartuu uses this information only to check the signature and returns a card with empty placeholder fields. What the visitor types into the order form is inserted into the preview by their browser alone; it is not transmitted to us for this.

The card shows the design of the voucher product with the shop's name, logo and picture. The browser loads the fonts and pictures of this card directly from kartuu.kyth.systems, the pictures through signed addresses that become invalid after one to two hours. The browser's IP address arises in the process; it is not stored (9.8). An uploaded image file that belongs to the design can be downloaded by the visitor as it is stored (5.1).

Nothing is stored. Our role is that of the processor.

7. Recipients and sub-processors

The uploaded pictures are stored on our server and not in the object storage.

Cloudflare runs the DNS zone kyth.systems. For Kartuu, Cloudflare only answers which IP address belongs to kartuu.kyth.systems; the data traffic between your browser and Kartuu does not run through Cloudflare. Cloudflare is therefore not a processor for Kartuu.

Your mail provider is your own processor: Kartuu merely hands in voucher emails through the account you set up. Whether a third country is involved depends on your mail provider and is outside our influence. There is no service engaged by us for sending voucher emails, nor any analytics, tag or error-tracking service in the app; only the attribution from 5.7 goes to an advertising service. Our own mailboxes are with INWX GmbH (above); our notices to you from 5.3, including the setup email, also go out through them.

Addresses of the recipients:

8. Transfers to third countries

Server, database and backups are located in Berlin. A third-country reference arises through Shopify and, with the attribution from 5.7, through Meta. As for Shopify: the contracting party for merchants in the EEA is Shopify International Limited in Ireland; the group has companies in Canada and the USA, among other places. We cannot determine where Shopify processes the data sent to the token endpoint and the Admin API.

• Canada: For organisations subject to the Canadian data protection law PIPEDA, there is an adequacy decision of the European Commission (Decision 2002/2/EC, Art. 45 GDPR).
• USA and other third countries: Shopify incorporates the EU standard contractual clauses under Implementing Decision (EU) 2021/914 into its Data Processing Addendum. The addendum is available at https://www.shopify.com/legal/dpa; you can obtain a copy of the clauses on request to datenschutz@kyth.systems.
• Meta (USA): With your consent to the Meta pixel (5.7), Meta also transfers data to Meta Platforms, Inc. in the USA. Meta Platforms, Inc. is certified under the EU-U.S. Data Privacy Framework; the transfer is based on the European Commission's adequacy decision of 10 July 2023 (Art. 45 GDPR).
• GitHub (USA): Only source code flows there, no personal data.

9. Retention and deletion

9.1 When the app is uninstalled

When Kartuu receives the app/uninstalled webhook, both access tokens are deleted immediately and the time of uninstallation is recorded. The other data remains for the time being, so that late webhooks can still be assigned and you do not have to consent again if you reinstall Kartuu before the final deletion under 9.2 – as a rule, that is, within 48 hours. The longer period under 9.3 applies only if the deletion webhook does not arrive.

9.2 Final deletion

Shopify usually sends the shop/redact webhook 48 hours after uninstallation. Kartuu then first deletes your uploaded pictures and then, in a single transaction, all of your shop's data from the database, including all voucher records.

The vouchers' claim page disappears together with the data. A PDF that has already been delivered remains with the recipient; the gift card in the merchant's shop remains valid.

You cannot delete individual uploaded pictures in the app; they remain for as long as your shop exists. On request to datenschutz@kyth.systems, we will remove a specific picture and confirm this.

9.3 If the deletion webhook does not arrive

If shop/redact does not arrive, a daily clean-up run deletes all of the shop's data 30 days after uninstallation in the same way as in 9.2, including the pictures.

If a shop record was created without the connection being established (no access and no refresh token stored), the same run deletes it after 90 days.

9.4 Webhook identifiers: 30 days

The webhook identifiers used for duplicate protection are technical identifiers without personal reference. The clean-up run removes them 30 days after processing has been completed.

9.4a Origin of an installation

We delete the IP address and browser identifier from the attribution (5.7) as soon as the event has been sent to Meta or it is certain that it will not be sent, at the latest eight days after the installation. We delete the other details together with your shop (9.2).

9.5 Erasure of individual persons

Through customers/redact or on request, a person's personal details in the voucher records are deleted; the voucher itself remains (6.2).

9.5a Voucher data once the purpose has ceased

The personal details of a voucher – recipient's name and email address, sender's name, greeting, the buyer's details and their customer number – are deleted three years after the voucher was created. The voucher itself remains with code, status, value and template copy. The decisive factor is the regular limitation period for the claim arising from the voucher (section 195 of the German Civil Code, BGB). The claim link is valid for at most the same period.

9.6 Backups

The database is backed up daily. Each backup is encrypted with AES-256 before it leaves the server, stored on the server and in IONOS's object storage in Berlin, and transmitted over TLS. The password is not stored in the object storage. The fields requiring special protection (access tokens, contact addresses, customer data) are additionally encrypted individually within the backup; this key is stored neither in the backup nor in the object storage, but only in the application's environment on the server.

That a backup can be restored has been verified by an actual restoration. A daily check run reports missing backups.

Uploaded pictures are not part of the backup. If they are lost, the pictures are missing; all other data is unaffected.

Effect on deletions: Deleted data is still contained in backups already made and disappears from them when the periods above expire – at the latest after 30 days on the server and after 95 days in the object storage. As long as it remains there, it is used exclusively for restoration in the event of a fault.

9.7 Application logs: 14 days

Application and container logs are kept for 14 days and then deleted. Their content is described in 5.1. The same applies to the logs of the scripts on the server that send the setup email, the message about an uninstallation and the message about a redeemed promo code (5.3): per run they record the shop domain and the result, never a contact address, a name or the content of an email, and are deleted after 14 days.

9.8 The upstream proxy

A reverse proxy running on the same server in Berlin sits in front of the application container. Its access logging is switched off; it stores no IP addresses, no browser identifiers and no query parameters. Only for the vouchers' claim page (addresses under /gutschein) does it count requests per IP address in order to slow down mass retrieval: for this, the address is held only in memory and discarded two seconds after its last request, without being logged or written to a storage medium. Its own operating log contains only start-up messages and certificate errors with domain names, no details of visitors. The legal basis is Art. 6(1)(f) GDPR – legitimate interest in secure operation.

10. Your rights

10.1 If you are a merchant

You have the following rights towards us:

• Access (Art. 15 GDPR)
• Rectification (Art. 16 GDPR)
• Erasure (Art. 17 GDPR)
• Restriction of processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR)
• Objection (Art. 21 GDPR) to processing that we base on a legitimate interest (marked in 5.1 as Art. 6(1)(f))

To exercise them, write to datenschutz@kyth.systems. We respond free of charge and within one month (Art. 12(3) GDPR). The quickest way to have all of your data erased is to uninstall the app (9.2).

10.2 If you bought something in a shop or received a voucher as a gift

Please contact the shop from which the order was placed. The shop is the controller for your data; we act only on its behalf.

• If the shop requests access through Shopify, Kartuu compiles the stored data (6.4) and hands it over to the shop when the shop requests it from datenschutz@kyth.systems. The shop gives you the answer.
• If the shop requests erasure, Kartuu anonymises the records concerned (6.2).
• If the app is uninstalled, Kartuu deletes all data of this shop (9.2).

If you received a voucher as a gift: As a rule, Shopify does not know you as the recipient (6.4). Write to datenschutz@kyth.systems; we will forward your request to the shop and carry out an erasure on its instructions.

If you cannot reach the shop, you can also contact datenschutz@kyth.systems. We will forward your request to the shop and inform you about it. The shop decides on the substance regarding your data.

10.3 Complaint to the supervisory authority

You can lodge a complaint with a data protection supervisory authority at any time (Art. 77 GDPR), in particular in the member state of your habitual residence, your place of work or the place of the alleged infringement. The authority responsible for us is:

Bayerisches Landesamt für Datenschutzaufsicht (BayLDA) (Bavarian Data Protection Authority)
Promenade 18, 91522 Ansbach, Germany
poststelle@lda.bayern.de

10.4 No automated decision-making

There is no automated decision-making, including profiling, within the meaning of Art. 22 GDPR.

11. Technical and organisational measures

In brief: access tokens and customer data are stored in the database only in encrypted form, the data of different shops is kept separate, incoming messages are checked for authenticity, and credentials do not get into logs. There is no certification under Art. 42 GDPR or under ISO. The complete description is in Annex 2 of the data processing agreement.

11.1 Confidentiality

• Encryption of stored data (AES-256-GCM): access and refresh tokens, contact addresses, user name and password of the mail account, and voucher code, claim token, names, email addresses and greeting. Without a valid key, the application does not start.
• Tenant separation in the database: every table relating to a shop is protected against access to other shops by row filtering (row-level security); the shop table itself is secured through the application and column-level permissions.
• Restricted permissions: the application uses a database account that cannot bypass the row filtering and may only write the columns it actually has to write. The access log cannot be changed afterwards.
• Tenant separation in the image storage: the key of every picture begins with the identifier of its shop. A picture is delivered either after the session has been checked in the admin, or through a signed address bound to exactly this shop that becomes invalid after one to two hours (5.1).
• Separate test and production environments with their own database, their own key and their own Shopify app.
• Access to the production environment is limited exclusively to the two managing directors. Second copies of the keys are kept separately and outside the server.

11.2 Integrity

• Signature check of every incoming webhook (HMAC-SHA256) and strict checking of the session token before anything is processed.
• Security headers for the embedded interface (Content Security Policy, X-Content-Type-Options, restrictive referrer policy).
• Protection against SQL injection through parameterised queries.
• Limited request sizes and rate limiting per shop for preview, PDF and image upload.
• Checked input: everything entered in the voucher editor is checked on the server against fixed allow-lists and limits.
• Checked pictures: only JPEG, PNG, WebP and SVG are accepted; the format is recognised from the content. The size is limited to 5 mebibytes and 12 million pixels, and an SVG is cleaned of everything executable. Pictures over 2000 pixels are scaled down, and the capture data is removed from every picture (5.1).
• Reliable order process: a repeatedly delivered order does not create second vouchers, and exactly one gift card is created per paid value voucher.
• No secrets in the source code repository. Before every commit to version control, a Git hook (gitleaks) checks the changes for them.

11.3 Availability

• Daily, encrypted database backup on the server and in object storage in Berlin, with verified restoration and daily monitoring (9.6).
• Since 24 September 2026, a computer outside the data centre checks every minute whether Kartuu and its database respond, and alerts us after three failed attempts. The answer it receives only says “OK” or “faulty”; it contains no personal data. The computer is located with us: if power or internet fails there, this check falls silent.

11.4 Handling incidents

There is a procedure for data protection incidents with escalation levels, the 72-hour notification period under Art. 33 GDPR, the competent supervisory authority, and a reference to the duty to inform recipients under Art. 14 GDPR.

12. Changes to this policy

If the scope of processing changes, we change this policy beforehand and assign a new identifier. Whoever installs Kartuu afterwards agrees to the new version. If you agreed to an earlier version, we ask you for your consent again when you open the app, before new processing affects your data. The version currently in force is available at https://kartuu.kyth.systems/rechtliches/datenschutz (English: https://kartuu.kyth.systems/rechtliches/datenschutz?locale=en).

Processing for another purpose. If we intend to process your data for a purpose other than the one for which it was originally collected, we will inform you in advance in text form at your contact address about that purpose and all other information under Art. 13(2) GDPR (Art. 13(3) GDPR).