Note. This is the English translation of our German privacy policy. In case of discrepancies, the German version at
/de/legal/datenschutzprevails.
1. Controller
The controller responsible for data processing on Storewy websites and shops is:
Mietzu
Wichertstr. 73
10439 Berlin
Germany
Email: contact@storewy.com
Storewy operates the platform storewy.com and brand-specific shops on subdomains (e.g. your-brand.storewy.com).
2. Overview
We process personal data only where necessary to operate our websites, fulfil orders, provide support, or — with your consent — run conversion analytics.
| Processing | Legal basis (Art. 6 GDPR) |
|---|---|
| Orders, shipping, support | Art. 6(1)(b) contract / (c) legal obligation |
| Server logs, abuse prevention | Art. 6(1)(f) legitimate interest |
| Strictly necessary storage (cart, language, consent state) | § 25(2) TDDDG; Art. 6(1)(f) |
| Conversion analytics (PostHog) after opt-in | Art. 6(1)(a) consent / § 25(1) TDDDG |
| Anonymous, server-side reach measurement without cookies | Art. 6(1)(f); objection Art. 21 |
| Aggregated device-free landing count (currently off) | Art. 6(1)(f); objection Art. 21 |
See our Cookie Policy for cookies and local storage.
3. Hosting and server logs
Our application runs on Google Cloud Run (Google Cloud Platform, typically EU regions). Each request generates technical log data (e.g. truncated IP, timestamp, URL, user agent, status code).
Purpose: operation, stability, error analysis, abuse prevention.
Legal basis: Art. 6(1)(f) GDPR.
Retention: per GCP log rotation, usually a few weeks.
4. Orders and payment
When you place an order we process name, delivery/billing address, email, order contents, payment status, and order reference.
| Service | Provider | Purpose | Location |
|---|---|---|---|
| Supabase | Supabase, Inc. | Order, product, support database | EU project region |
| Stripe | Stripe Payments Europe Ltd., Dublin | Payment processing (Stripe Checkout) | EU / possible third country per Stripe routing |
| Resend | Resend, Inc. | Transactional email (order confirmation) | USA (SCCs) |
| AliExpress Open Platform | Alibaba / AliExpress | Order forwarding to suppliers (dropshipping) | Third country (China) — see section 8 |
Legal basis: Art. 6(1)(b) GDPR; tax/commercial retention Art. 6(1)(c).
Stripe cookies: Stripe Checkout may set its own cookies — see the Cookie Policy.
5. Support chat (AI)
Brand shops offer a support chat. Messages are processed using Google Gemini / Google Generative AI API.
Data: chat content, optional email you provide, thread id, page URL.
Legal basis: Art. 6(1)(b) and/or (f).
Storage: support threads in Supabase.
You are chatting with an AI assistant (see in-chat notice).
6. Conversion analytics (PostHog) — consent only
If you choose “Accept analytics” in the cookie banner, we use PostHog (PostHog Cloud EU, eu.i.posthog.com).
Data (summary): pseudonymous id (storewy.ph_anon_id), page views, masked click/interaction signals (autocapture), checkout events, email after purchase (person merge).
Legal basis: Art. 6(1)(a) GDPR and § 25(1) TDDDG.
Session recording: active after consent — session replays with text masking (inputs and text content are masked).
DPA: PostHog as processor (Art. 28) via posthog.com/dpa.
Withdraw consent: Cookie settings link in the footer at any time.
Retention: per PostHog project settings (EU).
After purchase, the analytics chain may be linked to your email for conversion reporting. Pre-consent ephemeral ids are not back-joined.
7. Anonymous, server-side reach measurement without cookies
For visitors who do not accept analytics or ignore the banner, we count anonymous visits entirely server-side on our own infrastructure (Google Cloud Run, EU). Nothing is stored on or read from your device — we only use data your browser already transmits with every request (IP address, user agent).
How it works: Our server derives a cryptographic hash from the IP address and user agent using a daily-rotating key and discards the raw IP immediately; it is never stored or shared. The hash only supports counting unique visits within a single day — recognition across days, or identifying a person, is not possible. The user agent is additionally reduced to a non-personal bot flag (yes/no) and likewise discarded. Only the hash, the page type and the shop are sent to our analytics provider PostHog (EU) — no person profile, no IP, no user agent.
Your cookie-banner decision (accept or reject) is additionally counted server-side as an aggregated event (with no further personal data) and logged as a record of your choice.
Legal basis: Art. 6(1)(f) GDPR (aggregated reach measurement). § 25 TDDDG is not triggered, as no information is stored on or read from your device.
Objection: Art. 21 GDPR by email to contact@storewy.com.
8. Aggregated landing measurement (currently disabled)
A server-side, device-free landing view count is implemented but currently disabled. No person profile; visitor IP is not sent to PostHog for this event.
If enabled: Art. 6(1)(f) GDPR; objection under Art. 21 via contact@storewy.com.
9. Third-country transfers
Where providers outside the EEA are used (e.g. Resend, Google, AliExpress), transfers rely on appropriate safeguards (especially EU Standard Contractual Clauses, Art. 46 GDPR) and supplementary measures where required.
10. Retention
- Order/invoice data: commercial/tax retention (often up to 10 years).
- Support threads: until resolved, then deletion/anonymisation unless legally required to keep.
- PostHog analytics: per PostHog retention; deletion on request (form below).
- Consent records: timestamp, banner version, choice — kept for accountability (~3 years).
11. Your rights
Access, rectification, erasure, restriction, portability, objection (Art. 21) to legitimate-interest processing, and withdrawal of consent (Art. 7(3)) — via cookie settings or email.
You may lodge a complaint with a supervisory authority (e.g. Berlin Commissioner for Data Protection).
12. Analytics erasure and consent management
- Change / withdraw consent: Cookie settings in the site footer.
- Delete PostHog data: form at the bottom of this page or email contact@storewy.com with your checkout email.
Order records kept for tax law are not deleted by analytics erasure.
Delete analytics data (Art. 17 GDPR)
If you previously chose “Accept analytics”, you can request deletion of your PostHog analytics profile and related events. Order records kept for tax law are not affected.