Privacy Policy

1. Controller

The controller responsible for the processing of personal data described in this policy is:

Aura UG (haftungsbeschränkt)
Ludwig-Erhard-Straße 18
20459 Hamburg, Germany
Represented by the Managing Director: Florian Marzahl
Registered at Amtsgericht Hamburg, HRB 192077

You can reach us regarding data protection matters at [email protected].

2. Scope

This policy covers personal data processed through the Shoppex platform, including the merchant dashboard, hosted storefronts and checkout, the customer portal, our marketing website, and integrations we operate on your behalf. Merchants who sell through Shoppex are themselves controllers for the buyer data they collect; for that data we act as a processor on their behalf under a data processing agreement.

3. Merchant Account Data

When you create and operate a Shoppex account we process account and contact details (such as name, email address, and authentication credentials), shop configuration, subscription and plan information, and usage data required to provide the dashboard and its features. This data is used to authenticate you, provide the services, bill your subscription, and communicate with you about your account.

4. Storefront & Buyer Data

When a buyer places an order through a hosted storefront or checkout, we process order details, contact information provided at checkout, delivery data for digital goods, and records necessary to fulfil and document the transaction. This data is processed on behalf of the merchant operating the storefront.

5. Payment Data

Payments are processed through third-party payment providers. Card and equivalent sensitive payment credentials are handled by those providers and are not stored by Shoppex. We retain transaction metadata (such as amount, status, provider reference, and timestamps) required to reconcile orders, manage refunds and disputes, and meet our legal record-keeping obligations.

6. Live Chat & Support Messaging

Merchants may enable a live chat widget on their storefront. When a storefront visitor opens the chat and sends a message, we process:

(a) the message content the visitor types; (b) an optional name and email address if the visitor chooses to provide them; (c) the page URL the chat was started from; and (d) technical data such as the visitor's IP address, used only transiently for rate limiting and abuse prevention. Visitors are not required to create an account. A random, hashed session token identifies the conversation; we do not use cross-site tracking or fingerprinting for the chat.

To let the merchant reply, the visitor's messages are relayed to the merchant's own configured support channel on Telegram or Discord, and the merchant's replies are relayed back to the visitor's browser. This means message content is transmitted to and stored within the merchant's Telegram group or Discord server and is subject to Telegram's and Discord's own privacy policies. Merchants are responsible for restricting access to their support channels. We read message content from the merchant's designated support threads solely to deliver replies to the visitor; we do not read or process content from any other channels.

7. Third-Party Integrations & Processors

We rely on carefully selected service providers to operate Shoppex, including hosting and infrastructure providers, payment providers, email delivery, error monitoring, and — where a merchant enables the live chat relay — the Telegram Bot API and the Discord API. These providers process personal data on our or the merchant's behalf under appropriate data processing agreements and, where applicable, suitable safeguards for international transfers.

8. Server Logs & Security

Our systems automatically record technical information such as IP addresses, timestamps, request metadata, and error diagnostics. This data is used to operate the service securely, detect and prevent abuse, and diagnose technical problems. It is retained only as long as necessary for these purposes.

9. Legal Bases

We process personal data on the following legal bases under the GDPR: performance of a contract (Art. 6(1)(b)) to provide the services you request; compliance with legal obligations (Art. 6(1)(c)) such as accounting and record-keeping; and our legitimate interests (Art. 6(1)(f)) in operating, securing, and improving the platform and in preventing abuse. Where required, we rely on your consent (Art. 6(1)(a)), which you may withdraw at any time.

10. Retention

We retain personal data only for as long as necessary for the purposes described above or as required by applicable law. Support chat conversations are retained for the operational lifetime of the conversation and are subject to configurable retention and automatic closure. Transaction and accounting records are retained for the statutory periods required under German law.

11. Your Rights

Subject to the conditions of the GDPR, you have the right to access your personal data, to rectification, to erasure, to restriction of processing, to data portability, and to object to processing. You also have the right to lodge a complaint with a supervisory authority. To exercise these rights, contact us at [email protected]. Where we act as a processor for a merchant, we will forward your request to the responsible merchant.

12. Contact

For any questions about this Privacy Policy or our data practices, contact us at [email protected].