Privacy policy

November 2026

Who is responsible

Niklas Loitlesberger, sole proprietor, Possingergasse 59–61/4/8, 1160 Vienna, Austria, office@helfa.at.

This website

The website sets no cookies, contains no tracking and loads nothing from third parties. Fonts are delivered with the page. The website is hosted by Vercel Inc. (440 N Barranca Ave #4133, Covina, CA 91723, USA). When you open it, Vercel processes technically necessary data (IP address, time, page requested, browser identifier) to deliver the page. The legal basis is Art. 6(1)(f) GDPR, our legitimate interest being secure operation. Vercel is certified under the EU-US Data Privacy Framework. If you write to us, we use your address only to reply.

The Shopify app

In the app, the merchant is the controller of their customers' data. We process it as a processor under Art. 28 GDPR, solely to respond to that shop's disputes.

We process:

• Shop data: shop domain and the access token issued by Shopify
• Disputes: ID, reason, amount, deadline, status
• Orders related to a dispute: order number, line items, shipping address, fulfillments, tracking numbers, tracking events, refunds
• Customer data for the dispute: name and email address, where Shopify's evidence form requires them
• Documents uploaded by the merchant

What we do not use the data for

No advertising, no sale, no training of AI models and no sharing with other products, including Helfa, the AI customer service run by the same operator. The app uses no AI services.

Retention

We keep evidence files until 90 days after a dispute closes, then delete them. Evidence saved in Shopify is under the control of Shopify and the merchant. On uninstall we delete the access token immediately. We act on Shopify's mandatory privacy webhooks (customers/data_request, customers/redact, shop/redact) and delete shop data no later than 48 hours after shop/redact.

Service providers

The app is operated on Railway Corp. in the EU region (Netherlands). Dispute and order data is held only there, not at Vercel. We exchange order data with Shopify via the Shopify Admin API. To read tracking history we send the tracking number to the tracking service 17TRACK, without name, address or order data. This processing may take place outside the EU. Billing runs through Shopify, we do not see payment data.

Your rights

You have the right to access, rectification, erasure, restriction, portability and objection (Art. 15–21 GDPR). Write to office@helfa.at. Customers of a shop should contact the merchant first. Complaints can be filed with the Austrian Data Protection Authority (Barichgasse 40–42, 1030 Vienna, www.dsb.gv.at).