Privacy Policy — GoTranslate (Shopify App)

Last updated: August 23, 2026
Version: 1.0
Applies to: the Shopify app "GoTranslate" (hereinafter "the app") and the pages served at app.gotranslate.app, including these legal documents.

Separate marketing or information pages at gotranslate.app are covered by the privacy policy published there.

The German version of this privacy policy is the authoritative language version. This English version is a translation of the German version at https://app.gotranslate.app/privacy; in the event of any discrepancy, the German version prevails.

1. Controller

The controller within the meaning of Art. 4(7) GDPR for the processing operations described in this policy is:

1.1 Data protection officer

A data protection officer has not been designated. There is no obligation to designate one under Art. 37 GDPR or Section 38 BDSG: the controller does not, as a rule, permanently engage 20 or more persons in the automated processing of personal data, its core activities do not consist of regular and systematic monitoring of data subjects on a large scale, and it does not process special categories of personal data within the meaning of Art. 9 GDPR on a large scale.

Please direct data protection enquiries and requests to exercise the data subject rights listed in section 10 to support@gotranslate.app.

1.2 Two roles — please note

Vis-à-vis users of the app, the provider acts in two different roles under data protection law. This distinction is essential for understanding this policy:

2. What the app does

GoTranslate is a Shopify app that automatically translates shop content into further languages set up in the shop. The process is as follows:

1. The merchant installs the app via the Shopify App Store and thereby grants the permissions listed in Section 4.
2. Via the Shopify Admin API, the app reads the translatable content of the shop as well as the languages that have been set up.
3. The merchant selects target languages and content areas.
4. The app sends the source texts to the translation service (see Section 6) and writes the results back into the shop as translations via the Shopify Admin API.
5. Source texts and translations are stored in the app's database so that changes can be detected, repetitions avoided and usage billed.

The app processes shop content, not the data of the shop's customers. See Section 5 for explicit details on this.

3. What data is processed

The following table lists all categories of data that the app stores in its own database.

Note on whether shop content relates to identified persons: shop content is in principle factual data (product descriptions, page texts, menu items). A relation to identified or identifiable persons arises only where the merchant itself writes personal data into shop content — for example the names of contact persons on an About Us page, photographers' names in product descriptions or contact details in legal texts. In such cases, processing on behalf of the controller pursuant to Art. 28 GDPR applies (see Section 11).

4. Permissions requested (scopes)

Upon installation, the app requests exclusively the following permissions. The scope follows the principle of data minimisation (Art. 5(1)(c) GDPR): only what is necessary for the translation service is requested.

Not requested are, in particular, read_customers, read_orders, read_all_orders, read_draft_orders and all permissions relating to payment and shipping data of individual orders.

5. No customer data of the shop

The app does not process any personal customer data of the shop.

This is not a declaration of intent but is technically ensured:

1. No permission. The app does not request access to protected customer data. It has no access to customer accounts, orders, payment data, delivery or billing addresses, shopping baskets or checkout processes.
2. Active skipping of protected objects. When metafields are read, the Shopify API also returns metafields belonging to protected objects. Such entries are recognised by the app and skipped; their content is neither read nor stored nor transmitted to the translation service.
3. No storefront access. The app runs exclusively within the Shopify admin. It does not embed any script into the storefront, does not set cookies there and does not collect any data from visitors to the shop.
4. Evidence via the mandatory webhooks. The webhooks customers/data_request and customers/redact required by Shopify are implemented and answered with logging. As no customer data is held, there is nothing to disclose in response to an access request and nothing to delete in response to an erasure request. Receipt and processing are documented.

The only exception concerns information that the merchant writes into shop texts itself (see the note at the end of Section 3). The merchant alone decides on such content.

5.1 Classification under the Shopify requirements

Shopify classifies apps according to the extent to which they access protected customer data. In the provider's assessment, the app meets Level 0 (no access to protected customer data) and therefore does not require separate approval for protected customer data fields.

5.2 No use for training AI models

The provider does not use the merchant's content to create, train, fine-tune or improve its own artificial intelligence models, and does not pass it on to third parties for that purpose. This is also in line with the requirements of the Shopify Partner Program and the Shopify API Terms, which prohibit such use without prior written consent. For the transfer to the translation service, see Section 6.

6. Transfer to the translation service

This section describes the app's most sensitive operation from a data protection perspective: the transmission of shop texts to an external machine translation service.

6.1 What is transmitted

Only the source texts to be translated are transmitted, together with the source and target language and — where the merchant has created a glossary — the relevant glossary entries. The shop domain, the access token, usage and billing data, and any other information that would permit attribution to a particular shop are not transmitted.

Consequence for the merchant: everything the merchant maintains as shop text may be transmitted to the translation service, provided that the relevant content type has been selected for translation. If those texts contain personal data, that data is transmitted as well. The merchant can restrict the selection of content types and fields to be translated in the app's settings.

6.2 Who the recipient is

The app calls the interface server-side. There is no direct connection between the merchant's device and the translation service.

6.3 Data processing agreement, retention period and processing location

The provider of the translation service makes a public data processing agreement available in which it acts as a processor for its customer.

According to publicly available information from the provider, requests and responses of the standard interfaces are stored for abuse detection purposes for a rolling period of 30 days, unless a mode of operation without data storage ("zero data retention") is enabled.

No particular server location is publicly guaranteed; the provider's privacy policy states a preference for selecting providers within the European Union and permits transfers to third countries on the basis of the standard contractual clauses (see Section 8.2).

6.4 Machine translation — note on quality

The translations are produced fully automatically by a language model. No human review takes place. The results may be substantively incorrect, misleading or incomplete. For legally relevant texts — in particular the shop's own privacy, withdrawal, shipping and returns terms — the merchant must review the generated translations itself before publication. Further details are set out in the terms of use.

No automated decision-making within the meaning of Art. 22 GDPR takes place. The app does not take decisions producing legal effects or similarly significantly affecting natural persons; it translates texts only. Information pursuant to Art. 13(2)(f) GDPR about the logic involved in automated decision-making is therefore not required.

7. Retention period and deletion

7.1 Uninstallation of the app

Upon receipt of the Shopify webhook app/uninstalled, the shop's session data is deleted and the shop is marked as uninstalled. The remaining shop data — including the access token stored in encrypted form — is initially retained so that a reinstallation within the period provided for by Shopify does not have to begin with a complete rebuild. The access token is invalidated by Shopify upon uninstallation and is therefore non-functional; it is deleted together with the shop record upon shop/redact.

7.2 Erasure request (shop/redact)

According to Shopify's own information, Shopify sends the shop/redact webhook 48 hours after the app has been uninstalled. Upon receipt of this webhook, the app deletes all data of the shop concerned from its database. Deletion cascades across all tables and covers in particular:

• the shop record including the encrypted access token,
• all stored source texts and translations,
• the shop's translation cache,
• all settings, glossaries and selection lists,
• all job, analysis and progress logs,
• all usage records,
• all session data.

The only item retained is the record of the receipt and processing of the webhooks themselves. This record contains no shop content and serves to comply with the accountability obligation under Art. 5(2) GDPR.

7.3 Translation cache

Entries in the translation cache are deleted automatically if they have not been used for twelve months. Deletion runs as a nightly background process.

7.4 Billing-relevant data

Commercial and tax law retention obligations may apply to billing-relevant records, in Germany in particular under Sections 147 AO and 257 HGB. Statutory retention obligations remain unaffected by the deletions described in Sections 7.1 to 7.3. Invoicing itself is carried out by Shopify.

8. Recipients and subprocessors

8.1 Overview

The complete and current list of subprocessors, including the providers' websites, can be found in Part B of the data processing agreement at https://app.gotranslate.app/dpa.

8.2 Transfers to third countries

The app is designed so that the actual processing of shop content takes place within the European Union: the application runs in the Frankfurt region (Germany), the data is held in the Ireland region (eu-west-1), and the translation service is a French company. In short: EU data space — app servers in Germany, database in Ireland. This describes where processing takes place; it is not an assurance that all administration, support and logging functions of the providers used remain inside the EU.

The support chat is hosted by Lovable Labs AB in Sweden, i.e. inside the European Union.

On the individual providers: Fly.io, Inc. has its registered office in the United States and states in its privacy policy that information collected by it is stored and processed there; the provider is certified under the EU-U.S. Data Privacy Framework. The contracting party at Supabase is a company with its registered office in Singapore, with the parent company based in the United States; the provider incorporates the standard contractual clauses into its data processing agreement. Mistral AI has its registered office in France; the provider's data processing agreement permits transfers to third countries on the basis of the standard contractual clauses.

8.3 Further recipients

Data is transferred to public authorities only where there is a statutory obligation to do so.

9. Security of processing

The provider implements the following technical and organisational measures pursuant to Art. 32 GDPR:

10. Rights of data subjects

Under the GDPR, data subjects have the following rights:

Competent supervisory authority of the controller: Bayerisches Landesamt für Datenschutzaufsicht (BayLDA — Bavarian State Office for Data Protection Supervision), Promenade 27, 91522 Ansbach, Germany — https://www.lda.bayern.de

10.1 Whom data subjects should contact

Responsibility follows the allocation of roles described in Section 1.2:

• Where the request concerns shop content — that is, data contained in product texts, pages or other shop content — the merchant is the controller. Requests must be addressed to the merchant. The provider supports the merchant in responding within the framework of the data processing agreement (Art. 28(3)(e) GDPR) and will rectify or erase the data on the merchant's instructions.
• Where the request concerns the contractual relationship between merchant and provider — for example usage and billing data — the provider is the controller. Requests must be addressed to support@gotranslate.app.

Requests are answered without undue delay and at the latest within one month of receipt (Art. 12(3) GDPR). In justified cases, this period may be extended by a further two months; the data subject will be informed of this.

11. Processing on behalf of the controller

Insofar as the provider processes shop content on behalf of the merchant, a data processing agreement pursuant to Art. 28 GDPR applies. It governs in particular the subject matter and duration of the processing, the obligation to act on instructions, confidentiality, the technical and organisational measures, the engagement of subprocessors, support for the merchant with data subject requests and personal data breaches, and deletion after the end of the contract.

The agreement is available at: https://app.gotranslate.app/dpa

The provider is obliged to inform the merchant in advance of intended changes to subprocessors. The information is provided at least 30 days before the change; the objection procedure is governed by Section 6 of the data processing agreement.

12. Relationship with Shopify

Shopify is the merchant's own contracting party. Shopify's privacy policy applies to the processing of personal data by Shopify itself — in particular customer data, orders and payment transactions; the provider has no influence over this.

Billing for the app is carried out entirely through Shopify's billing function. In this context, the provider receives no payment data of the merchant; it receives from Shopify only the status of the subscription and the amounts billed.

13. Contact

For all questions concerning data protection in connection with the app:

• Email: support@gotranslate.app
• Postal address: AP10 Studios UG (haftungsbeschränkt), Peter-Henlein-Straße 13, 89312 Günzburg, Germany
• Responsible for data protection: Andreas Paulheim (Managing Director); no data protection officer has been designated (see section 1.1)

14. Changes to this privacy policy

The provider will amend this privacy policy where the processing, the services used or the legal situation change. The version in force at any given time is available at https://app.gotranslate.app/privacy and is dated.

In the case of changes that materially affect the rights of the merchant or of data subjects — in particular a change of translation service or hosting provider — the provider will inform the merchant in advance by email to the address stored in the Shopify account or by a notice in the app.

This English version is a translation. In the event of any discrepancy, the German version at https://app.gotranslate.app/privacy prevails.

Annex A — Sources consulted

All sources were retrieved on 23 August 2026. This list serves to make the statements in this policy traceable. The legal sources cited are German-language versions; the corresponding English-language EUR-Lex versions are available under the same CELEX code.

Shopify requirements

Material findings: the privacy policy must be linked in the App Store listing and must expressly name the retention periods as well as the geographic storage and processing locations. Shopify does not provide partners with its own data processing addendum; concluding a data processing agreement with the merchant is the provider's own responsibility.

GDPR

Service providers used

Technical basis

The processing operations described in Sections 3 to 9 were verified against the app's source code and database migrations (state of the repository as at 23 August 2026), in particular against the configuration of the permissions and webhooks, the handler for the mandatory Shopify webhooks, the database migrations including the access restriction rules, and the pricing logic.

Status: August 23, 2026 · Version: 1.0