Storraby NICCOS

Legal

Privacy policy

Storra helps Shopify merchants add sections to their themes. To do that we store as little as possible: your shop's domain, the access Shopify grants the app, and your plan, credits and purchases. We never access your customers or orders.

Last updated 5 November 2026

1. Who is responsible

The controller for the processing described here, within the meaning of the EU General Data Protection Regulation (GDPR), is:

NICCOS[Street and number][Postcode City]Germanyprivacy@niccos.com

TODO(legal) Add the full legal entity name, registered address, commercial register entry and managing director(s). Check whether NICCOS must appoint a data protection officer (Art. 37 GDPR, § 38 BDSG) and name them here if so.

2. Scope of this policy

This policy covers the Storra app for Shopify (“the app”) and these public pages. It applies to merchants who install the app and to their staff who use it inside the Shopify admin. Shopify itself processes data under its own privacy policy.

3. Data we process

The app requests two Shopify permissions only: reading and writing themes. Within that, we process:

DataWhyLegal basis
Shop and accessYour shop's myshopify.com domain, the access token Shopify issues to the app, the granted permissions and token expiry dates.To sign you in through Shopify and to act on your themes when you ask the app to.Contract (Art. 6(1)(b) GDPR)
Plan, credits and purchasesYour plan, the Shopify ID and status of your subscription, the billing period end, credit balances, a log of credit movements (amount, reason, reference, time), the charges the app created (Shopify ID, type, item, amount, status) and the sections you unlocked.To grant credits, unlock sections you paid for and keep a correct account history.Contract (Art. 6(1)(b) GDPR); legal retention duties where they apply (Art. 6(1)(c) GDPR)
Onboarding answersOptional answers from the setup questions: industry, main goal, team size and revenue range (as a bracket). Stored as app data inside your Shopify store, not in our database.To recommend sections that fit your store. You can skip the questions.Contract (Art. 6(1)(b) GDPR)
ThemesNames, IDs and roles of your themes and the section files the app writes (all named with an sp- prefix).To show your themes and install the sections you choose. To let you try a section first, the app can copy your live theme into an unpublished theme named “Storra Preview” in your store. Theme content is read from Shopify when needed and not copied into our database.Contract (Art. 6(1)(b) GDPR)
NICCOS client statusFor NICCOS retainer clients only: the shop domain on our list of shops that get the plan for free.To apply the free plan agreed with you.Contract (Art. 6(1)(b) GDPR)
Technical logsIP address, time, requested URL, browser user agent and status code of requests to our servers, plus application logs that name the shop domain and the action (for example a webhook topic).To run the service, keep it secure and fix errors.Legitimate interest in a secure, working service (Art. 6(1)(f) GDPR)

When you open the app inside the Shopify admin, Shopify passes a signed session token that identifies your shop and your staff account. We verify it to authenticate the request; we don't store names, email addresses or other profile data of you or your staff.

Payments are processed by Shopify and appear on your Shopify invoice. We never see card or bank details.

The app and these pages don't use analytics, advertising or tracking cookies. The app runs inside the Shopify admin and relies on Shopify's own technically necessary mechanisms there.

TODO(legal) Confirm the legal bases above. If onboarding answers are ever used by NICCOS for sales or lead generation (not just recommendations), this needs its own purpose, legal basis and probably consent. Check whether the billing records (charges, credit log) are subject to retention duties under German commercial and tax law (§ 257 HGB, § 147 AO) given that Shopify invoices the merchant, and adjust the retention section if so.

4. No customer data

Storra has no access to your customers, orders or any other buyer data and stores none. Shopify still requires every app to accept privacy requests about customers (“customer data request” and “customer redact”). We confirm these requests and record that we hold no data for the customer.

5. Sections in your storefront

Sections you install become regular files in your theme and run on your storefront like the rest of your theme. They load no third-party scripts, set no tracking and send no data to us. Some sections remember display state in the visitor's browser for the current session (for example, a countdown bar keeps its timer in session storage). That data stays in the browser and is never sent to us.

For your storefront you are the controller towards your visitors, and your own privacy notice applies.

TODO(legal) Confirm whether session storage used for display state is “strictly necessary” under § 25(2) TDDDG / Art. 5(3) ePrivacy Directive, or whether merchants need to cover it in their consent banner.

6. Service providers and recipients

  • Shopify runs the platform the app is part of, handles billing and sends the data listed above to the app through its APIs.
  • Hosting provider runs our servers and database in the European Union and processes data on our behalf under a data processing agreement (Art. 28 GDPR). TODO(legal) Name the hosting and database provider and region once production hosting is chosen.
  • Shopify CDN: our pages load a font stylesheet from cdn.shopify.com, which means your browser sends your IP address to Shopify.

We don't sell data and don't share it with advertisers.

TODO(legal) Describe transfers to third countries (Shopify entities in Canada/the US, possibly the hosting provider) and the safeguards relied on (adequacy decision / EU-US Data Privacy Framework / standard contractual clauses).

7. Retention and deletion

  • When you uninstall the app, we delete your shop's access data (sessions) immediately. The app data holding your onboarding answers is cleaned up by Shopify, which decides how long it keeps it after an uninstall. We keep your plan, credits and unlocked sections for now, so they are restored if you reinstall.
  • 48 hours after uninstalling, Shopify asks us to erase your shop's data. We then delete everything we hold for your shop: account, credit log, charges, unlocked sections and NICCOS client status.
  • Technical logs are kept for a limited period and then deleted automatically. TODO(legal) Set the log retention period (typically 7–30 days) to match the hosting setup.
  • Section files in your theme belong to you and stay in your theme after uninstalling. You can delete them in the Shopify theme code editor (files starting with sp-). The same goes for the “Storra Preview” theme, which you can delete under Online Store › Themes.

8. Your rights

Under the GDPR you have the right to:

  • access your data (Art. 15)
  • rectification (Art. 16)
  • erasure (Art. 17)
  • restriction of processing (Art. 18)
  • data portability (Art. 20)
  • object to processing based on legitimate interest (Art. 21)

To exercise them, write to privacy@niccos.com and include your shop's myshopify.com domain. You can also lodge a complaint with a data protection supervisory authority, in particular in the EU member state where you live or work. TODO(legal) Name the supervisory authority competent for NICCOS (depends on the federal state of the registered office).

9. Security

All traffic to the app is encrypted with TLS and requests from Shopify are verified by signature. In your themes the app only writes its own section files (prefixed sp-). The one exception is the “Storra Preview” theme it creates for trying sections, where it also places the section in a page template. It never publishes a theme.

10. Changes to this policy

We update this policy when the app changes how it handles data. The date at the top shows the current version. Questions? Contact support or write to privacy@niccos.com.