Effective Date · October 2026

Privacy Policy

This Privacy Policy explains how FUNDLIFY UG (haftungsbeschränkt) (“Fundlify,” “we,” “us,” or “our”) collects, processes, and safeguards personal data when merchants install and operate the Fundlify Crowdfunding & Pre-order application on Shopify (“the App”), when supporters interact with merchant campaigns powered by Fundlify, and when visitors browse fundlify.com (“the Site”).

1. Data Controller

FUNDLIFY UG (haftungsbeschränkt)
Wegelystrasse 6, 10623 Berlin, Germany
Commercial Register: HRB 241215 B, Amtsgericht Charlottenburg (Berlin)
Privacy & Data Protection Contact: hello@fundlify.com / support@fundlify.com

For merchant data and visitors to fundlify.com, Fundlify acts as the Data Controller under the EU General Data Protection Regulation (GDPR / DSGVO). For storefront customer and supporter records processed on behalf of a Shopify store, the respective Shopify merchant is the Data Controller and Fundlify acts as a Data Processor pursuant to Art. 28 GDPR.

2. Data Processed via the Fundlify Shopify App

Fundlify integrates natively with Shopify via Shopify App Bridge (JWT session tokens, without third-party admin tracking cookies) and Shopify Theme App Embeds—meaning Fundlify never injects legacy script tags or modifies merchant Liquid theme files. When a merchant installs and configures the App, we process only the scopes necessary to operate campaigns:

  • Merchant Store Profile: Store domain, shop name, primary contact email, currency, locale, and active Shopify Billing plan status (Art. 6(1)(b) GDPR — performance of contract).
  • Products, Rewards & Inventory Caps: Product IDs, variant titles, pricing, early-bird discount rules, and add-on configurations selected for campaigns.
  • Campaign Orders & Draft Orders: Supporter name, email address, shipping details, selected reward variants/add-ons, and payment status synced from Shopify Checkout or native Shopify Draft Orders so merchants can track funding goals, variant demand forecasts, and fulfillment.
  • $0 Pre-Launch Reservations & 6-Digit Email OTP: When supporters join a $0 pre-launch waitlist or verify a draft reservation, we process their email address and a temporary one-time verification code (OTP) to confirm authenticity and deliver lifecycle campaign notifications on the merchant’s behalf.
  • Native Affiliates (Refer & Earn): When supporters register as campaign advocates, we process their verified email, unique referral code, attributed paid order references, and anti-cheat signals (blocking self-referrals, duplicate claims, and cancelled/refunded orders) so merchants can issue tier discount codes or $0.00 Shopify Draft Order rewards.

3. Data Collected on fundlify.com (Website & Newsletter)

  • Newsletter & Dispatch Subscriptions: If you voluntarily submit your email address via our newsletter signup form, we store your email address, subscription timestamp, source page, and preference tags (website_subscriber, newsletter_subscriber) based on your consent (Art. 6(1)(a) GDPR). You can opt out in one click at any time via fundlify.com/unsubscribe or the unsubscribe link in every email.
  • Server & Security Logs: Hosting infrastructure automatically processes transient request metadata (IP address, user-agent, timestamp, requested URL) strictly to maintain uptime, TLS security, and abuse prevention (Art. 6(1)(f) GDPR).
  • Consent-Gated Analytics (Google Consent Mode v2): We do not run advertising pixels, cross-site retargeting, or third-party behavioral ad networks. On fundlify.com, Google Analytics 4 (G-QL30BXVXBV) is configured with Google Consent Mode v2 set to denied by default (`analytics_storage: 'denied'`, `ad_storage: 'denied'`, IP anonymization enabled) in accordance with § 25 TDDDG and Art. 6(1)(a) GDPR. Analytics storage is activated only if you explicitly click “Accept analytics” in our privacy banner. You may withdraw or change your choice anytime using the “Cookies” control in the page footer.

4. Sub-Processors & Infrastructure

We do not sell personal data. To deliver the Service reliably and securely, we rely on vetted infrastructure providers bound by GDPR Data Processing Agreements and, where data is processed outside the EEA, EU Standard Contractual Clauses (Art. 46 GDPR):

  • Shopify Inc. / Shopify International Ltd.: Storefront hosting, OAuth authentication, Checkout, Draft Orders, and Billing API.
  • Google Cloud Platform & Firebase (Cloud Run, Cloud Firestore, Firebase Hosting): Application compute, encrypted database storage, and static web delivery.
  • Resend Inc.: Transactional email delivery (6-digit OTP verification codes, campaign lifecycle notifications, and opt-in newsletter dispatches).
  • Google Ireland Limited (Google Analytics 4): Aggregated website traffic measurement on fundlify.com, active strictly after explicit visitor opt-in.

5. Data Retention & Deletion

We retain merchant and campaign data for the duration of an active App installation. When a merchant uninstalls Fundlify or submits a verified GDPR erasure webhook/request (shop/redact or customers/redact), personal records are deleted or anonymized within statutory Shopify and GDPR timeframes unless retention is required by German commercial or tax law (§ 147 AO, § 257 HGB). When a contact is deleted from our newsletter/CRM system, a cryptographic suppression record prevents accidental re-import while erasing marketing profile data.

6. Your Rights Under GDPR (Art. 15–21 DSGVO)

If you reside in the European Economic Area, the United Kingdom, or Switzerland, you have the right to:

  • Access (Art. 15), Rectification (Art. 16), and Erasure (Art. 17) of personal data we hold about you.
  • Restriction of Processing (Art. 18) and Data Portability (Art. 20).
  • Object (Art. 21) to processing based on legitimate interests and Withdraw Consent (Art. 7(3)) at any time with future effect.
  • Lodge a Complaint (Art. 77) with a supervisory authority, in particular our lead authority in Berlin: Berliner Beauftragte für Datenschutz und Informationsfreiheit (Alt-Moabit 59–61, 10555 Berlin, Germany).

If you are a backer of a specific Shopify merchant’s campaign and wish to exercise rights regarding an order or reservation with that store, please contact the merchant directly or email us at support@fundlify.com and we will assist in routing your request.

7. Updates & Contact

We may revise this Privacy Policy to reflect new product capabilities or regulatory updates. The current version is always published at https://fundlify.com/privacy. For any privacy questions, contact hello@fundlify.com.