Privacy Policy

This Privacy Policy explains what personal data is processed when you use this website and what rights you have as a data subject.

Data Controller

The data controller within the meaning of the General Data Protection Regulation (GDPR) is M. Amin Sayegh, trading as AIProCraft, Paul-Bertz-Str. 38, 09120 Chemnitz, Germany. See the Legal Notice for contact details.

Contacting us by email

If you contact us by email, we process the data you provide (e.g. name, email address, content of your message) solely to handle your request.

WhatsApp Business

Contacting us via WhatsApp Business is voluntary and optional. Your message is transmitted through the infrastructure provided by WhatsApp/Meta. You can always reach us by email (info@aiprocraft.de) instead, without using WhatsApp.

Voluntarily submitted contact data

Data you voluntarily submit through our contact or application forms is used solely to process your request or application and to get in touch with you.

Signing up for the newsletter is optional and based on your consent (Art. 6(1)(a) GDPR). When you sign up, we store your email address, chosen language, the source of your sign-up, the exact text you agreed to, and the time of consent. Your status remains "pending" until a double opt-in confirmation process is available — no newsletter is being sent yet. Once sending is set up, you will be able to unsubscribe at any time. For privacy-related questions, contact us at info@aiprocraft.de.

Payment processing via Stripe

We use the payment provider Stripe to process payments. When you make a purchase, the data required for payment processing (e.g. email address, payment details) is transmitted directly to Stripe. Stripe's own privacy policy applies.

Customer account and portal (Supabase)

We use Supabase's infrastructure to manage customer accounts, handle sign-in, and run the customer portal. This stores account and access data along with the content relevant to your portal (e.g. orders, reports).

Shopify connection (Product Intelligence and Revenue Recovery)

When you connect your Shopify store to AIProCraft, this happens on your explicit authorisation through Shopify's standard authorisation procedure (OAuth). Access remains limited to the read-only permissions granted in that step (scopes: read_products, read_orders, read_all_orders); we never write to your store. The connection serves two services. (1) Product Intelligence: through the Shopify Admin API we retrieve product and catalogue data for the products you select — product identifier, title, handle, status, last-modified time, product description, SEO title and meta description, image URL and alternative text, and the public product URL — and we additionally retrieve your store's publicly accessible product page exactly as any visitor would see it. The purpose is to check this product content for visibility and quality shortcomings, to present evidence-backed findings, and — where you request it — to generate suggested meta-description texts, which are presented to you for review only and are never written back to your store automatically. We store the selection of the checked product, a snapshot of the checked content, execution metadata, and the findings and evidence derived from them. This service neither requires nor requests order or customer data. (2) Revenue Recovery: we process order, refund and fulfilment records — order identifiers, dates, amounts, discount codes, line items, and Shopify's internal customer reference number. Customer names, email addresses, telephone numbers and postal addresses are neither required nor requested. The purpose is to analyse your store's commerce history in order to identify evidence-backed revenue-leakage patterns (for example products with unusually high refund rates) and to present these findings to you. Raw order and customer records are processed transiently in memory during a scan and are not stored; we store only the derived scan results and findings, which may contain Shopify order/refund reference identifiers as evidence. The free returns cost check uses the same connection and reads the same order and refund records, but — unlike services (1) and (2) — stores no result at all: the return rate and estimated cost per return are calculated transiently in memory, shown to you and then discarded; no scan results, findings or snapshot are created. The storage of derived results described in this section applies only to the Product Intelligence checks and Revenue Recovery scans you start in your account. Shopify access credentials are stored server-side only and with additional application-level encryption, and are not disclosed to any third party. Privacy requests forwarded by Shopify through its mandatory privacy webhooks are processed automatically: for a customer data request (customers/data_request) we hold no customer master data that could be produced; the request is logged, and you as the controller answer it from your own records. For a customer deletion request (customers/redact) we remove the identified order references from stored findings. For a store deletion request (shop/redact) we delete all data stored for that store — the connection including its access credentials, product selections, content snapshots, executions, findings and evidence, and the scan history — and we remove the shop domain from the webhook delivery log. Independently of this, stored results are deleted automatically under fixed retention periods: scan history after 180 days at the latest, findings no longer confirmed by newer scans after 90 days at the latest, and — after you disconnect your store or uninstall the app — all remaining scan results after 30 days at the latest, with the encrypted access credentials removed immediately. These deletions do not cover purchase and invoice records relating to AIProCraft services you have bought, which we must retain for the period prescribed by commercial and tax law retention obligations; those records contain no product, order or customer data from your Shopify store. We do not sell store or customer data, do not disclose it for advertising purposes, and do not use it for any purpose other than providing the service to you. Insofar as this store data contains personal data of your customers, we process it on your behalf under the Data Processing Addendum (see aiprocraft.de/avv).

Sign-in with Google

You can optionally sign in using your Google account (Google OAuth, provided through our authentication infrastructure, Supabase). When you do, we receive your name, email address, and profile photo from Google to create and sign you into your customer account. Google's own privacy policy also applies. You can register with email and password instead at any time.

Hosting (Vercel)

This website is hosted on Vercel's infrastructure. When you visit the site, Vercel automatically processes technical server log data (e.g. IP address, access time, requested page, and browser/system information) as needed for hosting, security, and stability.

Cookies and technically necessary storage

This website does not currently use marketing or tracking cookies. Technically necessary cookies or similar storage technologies may be used to operate the website, handle login and session management, run the client portal, and maintain security. Because no non-essential analytics or marketing tools are currently in use, no cookie banner is shown at this time. If tools such as Microsoft Clarity, Google Analytics, Meta Pixel, or similar services are added in the future, cookie and consent mechanisms will be reviewed and implemented before they are activated.

Website analytics (Vercel Web Analytics)

This website uses Vercel Web Analytics to collect aggregated and anonymous page-view statistics. It does not use third-party cookies; instead, it recognizes visitor sessions using a hash derived from the incoming request, which is discarded after 24 hours. Collected information may include the page path, referrer, approximate location, device type, browser, and operating system. No advertising or cross-site tracking is used, and we do not send personal data such as names, email addresses, or account details to this tool.

Storage duration

We store personal data only for as long as necessary for the respective processing purpose, as required by statutory retention obligations, or until you object to its deletion. After that, the data is deleted or anonymized.

Your rights under the GDPR

You have the right to access, correct, delete, or restrict the processing of your personal data, as well as the right to data portability and to object to processing. You may withdraw any consent you have given at any time, with effect for the future. You also have the right to lodge a complaint with a data protection supervisory authority.

Contact for privacy requests

For questions about data protection, you can reach us at info@aiprocraft.de.