Last updated: 4 October 2026
Controller: Universal Exporters LLC, contact support+epr@justarobot.online.
The app computes packaging quantities per material from your shipped Shopify orders for LUCID, your dual system and Austria. For that it stores per order only the order number, destination country, ship date and line items (product / variant id, quantity, weight) — no names, addresses, e-mail addresses or payment data.
| Data | Source | Retention |
|---|---|---|
| Order number, destination country (country code only), ship and cancel date, line items with product/variant id, quantity, refunded quantity, weight | Shopify Admin API (read_orders), at install (last 60 days) and by webhook on every order change |
Until uninstall (deleted 48 h later) |
| Product and variant titles, SKU | Shopify Admin API (read_products) |
Only titles/SKUs of assigned products, until uninstall |
| Your packaging, assignments, shipping rules, settings (LUCID number, scheme, countries) | Your input in the app | Until uninstall |
| Reporting periods: totals per material, closing and reporting date | Your input in the app | Until uninstall |
| Shop domain, access token (session) | Shopify | Until uninstall |
| Access log: when the app read or displayed orders (shop, action, count — no order data) | App | 12 months, deleted with the shop on uninstall |
The order address is read only to determine the destination country; only the country code is stored.
Art. 6(1)(b) GDPR (contract with the merchant). Where personal data of end customers is involved, the merchant is the controller and we are the processor (Art. 28 GDPR); Shopify's data processing terms for apps apply in addition.
The app runs on Railway in the EU (Netherlands data centre; server and PostgreSQL database). Server error reports are e-mailed to us (Resend) without any shop or customer reference. There are no other recipients; no analytics, advertising or tracking services.
On uninstall the session is deleted immediately; 48 hours later Shopify sends shop/redact and all data of the shop is
deleted. Customer requests (customers/data_request, customers/redact) are acknowledged — there is nothing to provide or
erase because no customer data is stored.
Access, rectification, erasure, restriction, portability and objection under Art. 15–21 GDPR; the right to complain to a supervisory authority. Requests to the address above.