Privacy Notice

Last updated: 2026-05-08

This notice applies to Kedalion GPSR as a Shopify app. It describes how Kedalion handles merchant-entered disclosure data, Shopify product context, and app workflow data for this app.

Data controller and contact

Kedalion is the controller for the app-owned processing described in this notice. For privacy questions, deletion requests, or support-safe handling questions, contact hello@kedalion.app.

Personal data and merchant data processed by the app

Store domain, app sessions, and Shopify admin context needed to authenticate and run the app.
Product identifiers, titles, handles, vendor values, and related product metadata needed for the disclosure-builder workflow.
Merchant-entered disclosure information such as manufacturer details, EU representative details, warnings, document links, and country of origin.
App settings, gap indicators, publication status, and audit-style change history recorded inside the app.

Data the app is not designed to collect

Customer payment information.
Checkout payment card data.
Customer account content unrelated to the merchant's product disclosure workflow.

How the app uses data

To show product disclosure gaps and saved-state indicators.
To store product-by-product disclosure profiles and shop defaults.
To publish storefront disclosure data through the app-managed product workflow and theme block.
To retain a basic audit trail of product disclosure edits made through the app.

Legal basis for processing

Kedalion processes this data to provide the requested app service to the merchant that installs the app, including authentication, product review workflow, configuration, and support. Kedalion may also process limited operational data to maintain the security and integrity of the service.

Retention and deletion

Kedalion retains app-held disclosure data and settings for as long as needed to provide the app to the installing merchant, unless earlier deletion is requested or the app is uninstalled. When deletion is required, Kedalion will use commercially reasonable efforts to remove the relevant app-held data from its storage footprint.

Third-party sharing

Kedalion does not sell data processed by this app. The app relies on Shopify infrastructure for app installation, authentication, and product access under the granted app scopes. Kedalion may also rely on standard hosting or database infrastructure used to operate the service, and may disclose information if required by law or valid legal process.

User rights and merchant requests

Depending on applicable law, data subjects may have rights to request access, correction, deletion, restriction, objection, or portability. Requests concerning store content or product data should usually be coordinated first through the merchant that controls the Shopify store. Kedalion will reasonably cooperate with merchant-directed requests that concern app-held data.

Policy updates

Kedalion may update this notice from time to time to reflect product, legal, or operational changes. When that happens, Kedalion will update the date on this page and publish the revised version at this same URL.