Privacy policy for the Sphen Shopify app.

What the app processes

The app processes the merchant's shop data — in particular products, collections, pages, blog articles and the status of the theme embed — to run GEO/SEO audits and generate AI content suggestions. Suggestions only take effect once the merchant reviews and applies them in the app. The processing legal basis is Art. 6(1)(b) GDPR where processing is necessary to provide the app. Where personal data is processed on a merchant's documented instructions, the controller-processor obligations are governed by Art. 28 GDPR; Art. 28 GDPR is not a processing legal basis.

To generate content suggestions, Sphen uses AI language-model providers as subprocessors engaged by Sichtbar in its role as the technical processor under data-processing agreements. Product, collection, page and blog text of the shop is transmitted for generation. The current list of subprocessors, recipients and third-country transfers used by Sichtbar is maintained in the German privacy policy.

Protected customer data (pending Shopify approval, currently inactive)

For extended analytics features, the Sphen app has requested access to protected customer data from Shopify. These features remain inactive until Shopify grants approval. Planned are, first, order data (order totals, refunds, attribution of orders to optimized content) for revenue attribution — buyer names, e-mail addresses or postal addresses of end customers are not surfaced in the app — and, second, a first-party web pixel that collects storefront events such as page views and purchases solely for the respective merchant's analytics. There is no advertising, no cross-site tracking and no sale of data.

Retention and security

Attribution data derived from orders is stored for at most 12 months from the order date and then deleted automatically; raw pixel events are deleted after 30 days. Pixel session identifiers are hashed before storage. All data is encrypted in transit (TLS) and encrypted at rest by the technical hosting providers; Shopify API access tokens are additionally encrypted at the application layer. Processing runs on hosting and infrastructure subprocessors engaged by Sichtbar as the technical processor under data-processing agreements (see the German privacy policy for the provider list and third-country transfer details).

Optional Google connections

Merchants can optionally connect Google Analytics 4 via OAuth directly in the app; the app requests only the read-only Google Analytics scope (analytics.readonly), and the merchant can revoke the connection at any time. The app has no Search Console connect flow of its own: where the merchant's organization has already connected Google Search Console through the Sichtbar technical platform, the app only reads search-performance reporting data from that existing connection.

Uninstall, GDPR webhooks and deletion requests

Upon app uninstall, shop data is deleted via Shopify's GDPR redaction webhooks (shop/redact and customers/redact). Data-access requests arriving via the customers/data_request webhook are handled on behalf of Niccos GmbH within the statutory periods. Merchants can also request deletion from Niccos GmbH at kontakt@niccos.com.

Data subject rights

Under the GDPR, data subjects have the rights to access, rectification, erasure, restriction of processing, data portability and objection, as well as the right to lodge a complaint with a supervisory authority. Rights requests must be sent to Niccos GmbH at kontakt@niccos.com. Sichtbar may provide authorized technical support on Niccos GmbH's behalf. Additional information about Sichtbar's technical infrastructure, recipients and international transfers is set out in the Sichtbar technical-service privacy policy.

The app's terms of service and support pageare available separately.