Privacy Policy

Last updated: October 3, 2026.

This policy covers personal data processed by Saku's Shopify app and hosted shopping pages, including pages on merchant domains. It does not cover Saku's separate marketing website.

Who is responsible

Saku is operated by Benno Kohrs, a sole proprietor based in Germany. You can contact us at support@saku.so.

We are the data controller for app access, support, security and product improvement.

For personal data we process on a merchant's behalf to host their pages, the merchant is the controller and we act as a processor.

Data from merchants

App access and store information

When you install or open Saku, Shopify provides the following information to authenticate you and connect the app to your store:

• Store ID, name and domains
• Your Shopify user ID, name, email address, email verification status, language and account role
• App permissions, access tokens and installation status

Pages and products

We process the content and design settings you add to Saku, along with product and collection information such as descriptions, images, prices, variants and availability. We access or update Shopify navigation and files when needed for the features you use.

Page content and settings are stored in Shopify. Published page content is public. Shopify manages subscription billing, and we access your plan and subscription status to provide its features.

App usage and feedback

We use PostHog to understand app usage, improve Saku and investigate problems. It collects usage events, page views, browser and device information, feedback you submit and session recordings. This data is linked to your store domain.

Session recordings show clicks, navigation and visible page content within Saku. Form input values are masked before recordings are sent to PostHog. Content displayed outside input fields may remain visible.

PostHog loads when you open the app and uses browser session storage. It does not run on public shopping pages.

Support

We process contact details, messages and attachments to respond to support requests.

Tawk.to provides support chat. Its widget loads when you open the app, before you send a message. It receives your name, email address, store information and technical data, and uses cookies or similar technologies.

Data from shopping page visitors

Our infrastructure processes IP addresses, requested URLs, browser information, request times and error details to deliver pages, troubleshoot problems and prevent abuse.

Shopping and checkout

Shopify and the merchant handle purchases through the merchant's cart or checkout. Their privacy policies apply to contact, delivery and payment information. Saku does not collect payment card details or maintain its own customer or order database.

Fonts, media and links

Pages may load Google Fonts and YouTube or Spotify embeds. These providers receive technical data, including your IP address and browser details, and embeds may use cookies or similar technologies. Resources can load before you play media, including with YouTube's privacy-enhanced embeds.

Merchants are responsible for notices and consent required by the content and integrations they choose.

Purposes and legal bases

Where the GDPR applies and we act as a controller, we process personal data on these bases:

• Service delivery: our contract with you for app access, page management and requested support (Article 6(1)(b))
• Staff access and support: our legitimate interest in serving the merchant when you use Saku as their employee or collaborator (Article 6(1)(f))
• Security and improvement: our legitimate interests in preventing abuse, maintaining reliability and improving usability, subject to consent requirements for tracking (Article 6(1)(f))
• Legal obligations: applicable accounting, tax and other legal requirements (Article 6(1)(c))

Where consent is required, it must be obtained before processing and can be withdrawn without affecting earlier lawful processing. For data we process on a merchant's behalf, we follow their instructions and they determine the legal basis.

Who receives data

We use these providers to operate Saku:

• Shopify: authentication, store data, subscriptions and checkout
• Cloudflare: hosting, network delivery, our app database and logs
• PostHog: merchant app analytics, feedback and recordings
• Tawk.to: support chat

Email services process our support correspondence. Google and Spotify receive data when their fonts or embeds load.

We do not sell personal data. We may disclose it to meet legal requirements or establish, exercise or defend legal claims. Shopify and embedded services also process data for their own purposes.

International processing

Our providers may process data outside the European Economic Area, including in the United States.

Transfers subject to the GDPR require an applicable adequacy decision or appropriate safeguards, such as the European Commission's Standard Contractual Clauses. Contact us for information about the safeguards applicable to your data and how to obtain a copy.

How long we keep data

• App access records and credentials are kept for the installation and removed from our app database when Shopify notifies us of an uninstall
• Installation records are deleted on Shopify's store deletion notification unless Saku has been reinstalled
• Page content and files stored in Shopify are subject to Shopify's storage and deletion processes
• Support correspondence is kept while needed to resolve requests, maintain relevant support history or handle disputes
• Analytics, session recordings and operational logs are kept while needed for product improvement, troubleshooting and security
• Records required for legal obligations are kept for the applicable statutory period

Uninstalling does not automatically erase support or analytics records. Deleted data may remain in provider backups until they expire.

Your rights

Depending on applicable law, you can request access, correction, deletion, restriction of processing or a portable copy of your data, and withdraw consent.

You can object to processing based on legitimate interests, including our use of your data for product improvement. Email support@saku.so with enough information to identify your store or request. We may need to verify your identity.

Requests are normally free. We respond as soon as reasonably possible and within one month, unless a lawful extension applies. We will explain any extension within that month.

For purchases or merchant-controlled data, contact the merchant first. We assist with requests concerning data we process on their behalf.

You can complain to a data protection authority where you live or work, or to the Bavarian State Office for Data Protection Supervision.

Changes to this policy

We update this policy as our data practices or legal requirements change. We provide notice of material changes where required by law.