GDPR compliance

Yes, AddressHero is GDPR compliant. We take privacy seriously and handle all customer data securely. This article answers the questions data protection officers typically ask.

Does AddressHero load scripts automatically when the app is enabled?

AddressHero does not use Shopify ScriptTags or inject any third-party JavaScript into the merchant's storefront. Instead, the app uses Shopify Checkout UI Extensions, which are Shopify-native components loaded and sandboxed by Shopify itself. Our extension only renders in three specific locations:

• During checkout (shipping address)
• On the Thank You page
• On the Order Status page

No AddressHero code is loaded on your general storefront pages (homepage, product pages, collection pages).

Can the extension be delayed or conditionally loaded based on the Shopify Customer Privacy API?

Since AddressHero uses Shopify Checkout UI Extensions (not script tags), the loading behavior is controlled entirely by Shopify's platform. These extensions are not subject to the same consent mechanisms as marketing or analytics scripts. The Shopify Customer Privacy API manages consent for three categories (Marketing, Analytics, Preferences), none of which apply to address validation for order fulfillment.

Is there an alternative integration with consent-based control?

As we use Shopify's native extension framework rather than injected scripts, there is no alternative "script tag" integration that merchants would need to control. The extension is either enabled or disabled at the app level.

Does the app process personal data on page load or before consent is granted?

• On general storefront pages: no. AddressHero has zero presence on your storefront before checkout.
• During checkout: the extension performs local-only validation (for example checking for missing house numbers). No customer data is transmitted to our servers during this step.
• On the Thank You / Order Status page: the extension sends the shipping address to our backend for validation. At this point, the customer has already actively submitted their address as part of the purchase.
• Server-side processing (orders/create webhook): after an order is placed, AddressHero validates the shipping address server-side. Depending on plan and configuration, the address components only (street, house number, postal code, city, country code; no names or email addresses) may be sent to one of these validation providers:
  • Google Maps Address Validation API (Google LLC, certified under the EU-US Data Privacy Framework)
  • Deutsche Post AddressFactory (Postdirekt, processed within Germany)
  • Klaviyo, only if the merchant configured address error notifications: an event containing the customer's email, name and address error type is sent via the merchant's own Klaviyo API key. Klaviyo then acts as the merchant's own sub-processor, not AddressHero's.

General data collection

No cookies are set and no tracking scripts are loaded. AddressHero collects aggregated, non-personal analytics for the merchant dashboard (for example total spelling errors, missing house numbers, or corrections per day). This data is aggregated at shop level and not linked to individual customers; it only contains anonymous error-type counters.

What data is actually stored?

We only fetch what is strictly necessary for the app's functionality:

• Shop name
• Order ID and order date
• Shipping address (address lines 1 and 2, ZIP, city, country code)
• First name, last name, email

Nothing beyond this is requested or stored.

How does the app retrieve data from Shopify, and is the connection secure?

AddressHero fetches data directly from Shopify using the Shopify GraphQL API. The connection runs over HTTPS with TLS, protecting all data in transit. Authentication is handled via OAuth; the app token is a secret environment variable that never reaches the browser and lives exclusively on the server, with minimal scopes.

How is data transfer between app and database secured?

Both the app and the database are hosted at DigitalOcean and communicate over an internal network only; the database is not reachable from the public internet. All traffic between app and database is additionally encrypted with HTTPS and TLS.

Where is the data stored, and how is it encrypted?

Data is stored in a MongoDB cluster hosted at DigitalOcean. DigitalOcean uses LUKS (Linux Unified Key Setup) to encrypt the underlying storage volume, so the disk is encrypted at rest by default.

Retention periods

• Address validation caches (AddressFactory, Google Maps, our own database): addresses only, no personal data, no TTL.
• Shopify order data (name, email, shipping address; internal access only): deleted after 7 days.
• Error log data (order ID, shop, original address, request and validation responses; internal access only): deleted after 30 days.
• Analytics data: aggregated at shop level, no personal data, not linked to individual customers.

Deletion requests

We have implemented all three mandatory GDPR webhooks Shopify requires:

• customers/redact: all data belonging to the affected customer is deleted from our database.
• shop/redact: after uninstalling, all data for that shop is permanently deleted, automatically within 48 hours.
• customers/data_request: enables a report of stored customer data upon request.

Deletion requests are executed automatically via Shopify's webhook infrastructure, making the process reliable and traceable.

Legal basis

The processing of shipping addresses by AddressHero is based on Article 6(1)(b) GDPR (performance of a contract): ensuring correct delivery is a necessary part of order fulfillment. This processing does not require additional consent via a cookie banner, as it falls outside the scope of the ePrivacy Directive / TTDSG cookie consent requirements. AddressHero acts as a data processor under Article 28 GDPR.