Privacy Policy

Last updated: October 12, 2026

This Privacy Policy describes how Finduly ("the App"), operated by NF Cosmetics GmbH, collects, uses, and processes data when merchants install and use the App within Shopify, and when anyone uses the free AI Readiness Check at app.finduly.com/check.

1. Controller

The entity responsible for data processing under this App is:

NF Cosmetics GmbH
Tannenweg 36
85399 Hallbergmoos
Germany

Email: support@finduly.com
Phone: +49 (0)155 63318056

Register Court: Amtsgericht München
Registration Number: HRB 285018
VAT ID: DE362048587

Managing Directors: Natalie Bonetska, Thomas Hahn

Roles: For staff account data, shop domain, session and authentication data, usage data and data of the AI Readiness Check (see Section 2), NF Cosmetics GmbH is the controller. For personal data that may be contained in the store content you make available to the App (for example names or contact details on pages or in reviews), NF Cosmetics GmbH acts as processor on behalf of the merchant, who is the controller; the data processing terms in Section 9 of our Terms of Service apply. We have not appointed a data protection officer, as we are not legally required to do so.

2. Data We Process

Shop domain — e.g. your-store.myshopify.com, used to identify and authenticate your store.
Store content — content that the App reads from your Shopify store (e.g. products, collections, pages, store descriptions) or that you submit to the App for processing.
Generated content — AI-generated pages and drafts created within the App as a result of your inputs.
Technical and authentication data — session tokens and metadata required for the App to operate securely within Shopify.
Staff account data — the name and email address of the Shopify staff member who opens the App, as provided by Shopify with the session.
Usage counters and settings — the number of generations in the current billing cycle and your App settings.
AI Readiness Check — the domain you enter and your IP address. We fetch the public homepage, robots.txt, llms.txt and AI pages of that domain and do not store their content. The IP address is kept in memory for at most one hour for rate limiting and is not written to disk. The checked domain and its score are written to the server log.

We do not request data of your customers or payment information. If personal data of third parties is nonetheless contained in your store content, we process it solely on your behalf and instructions (see Section 1).

3. Purposes and Legal Bases

Operating the App — providing AI-powered content generation for AI and LLM discovery, saving drafts and published pages so you can review, edit and republish them.
Authentication via Shopify — verifying merchant identity and managing secure access to the App.
Plan limits — counting generations within your billing cycle. These counters are not used for analytics.
AI Readiness Check — running the check and protecting it against abuse.

Legal bases under the GDPR:

Account, authentication and usage data of merchants and their staff users (shop domain, session data, staff name and email, usage counters, settings): Art. 6(1)(b) where the merchant is a sole proprietor; otherwise Art. 6(1)(f), based on our legitimate interest in providing the App to the merchant's organisation, authenticating its staff and enforcing plan limits.
AI Readiness Check (domain entered, IP address held in memory, domain and score in the server log): Art. 6(1)(f), based on our legitimate interest in operating a free service securely and protecting it against abuse.
Establishment, exercise or defence of legal claims: Art. 6(1)(f).
Personal data in your store content that we process as your processor is processed on your instructions (Art. 28 GDPR).

4. Recipients and Third-Party Services

Shopify

Shopify is the platform on which the App runs. It is used for merchant authentication, session management and store interaction (reading store content, writing pages). All billing for the App is handled through Shopify's billing API. Shopify acts under its own privacy policy.

Anthropic

Anthropic PBC (USA) provides the Claude AI model that generates content from your store content. When you trigger a generation, relevant content is sent to Anthropic's API. According to Anthropic's commercial terms, API data is not used to train its models. Anthropic acts as our sub-processor; see Anthropic's Privacy Policy.

Hosting and backups

The App and its database run on a virtual server rented from Hostinger International Ltd. (61 Lordou Vyronos, 6023 Larnaca, Cyprus), located in Vilnius, Lithuania (EU). Encrypted backups are stored with Hetzner Online GmbH (Industriestr. 25, 91710 Gunzenhausen, Germany). Both act as our processors under data processing agreements (Art. 28 GDPR).

Fonts and tracking

Our pages load the Inter font from Shopify's content delivery network (cdn.shopify.com); your IP address is transmitted to Shopify for this purpose (Art. 6(1)(f) GDPR, our interest in a uniform and fast presentation). We do not use analytics tools, advertising trackers or tracking cookies. Within Shopify, the App may use technically necessary storage required for authentication (§ 25(2) TDDDG).

5. Data Security

All connections are encrypted (HTTPS). Server access is restricted to authorised administrators, data is stored separately per shop, and backups are encrypted before they leave the server.

6. Data Retention

Session data, including staff account data, is deleted immediately when you uninstall the App. All other data stored for your shop (drafts, generated pages, usage counters and settings) is deleted when Shopify sends the shop/redact request, normally about 48 hours after uninstallation. Pages already published in your Shopify store remain there until you delete them yourself.

AI Readiness Check: your IP address is held in server memory for at most one hour and is never written to disk. The checked domain and its score are written to our server log, which is automatically deleted after 7 days. We do not keep access logs of our web server for the App.

Encrypted backups containing the above data are deleted after 90 days at the latest. We keep data longer only where necessary to establish, exercise or defend legal claims; in that case it is restricted to that purpose.

7. International Transfers

Our servers and backups are located in the EU. Store content submitted for generation is transferred to Anthropic in the United States; this transfer is safeguarded by the EU Standard Contractual Clauses contained in Anthropic's Data Processing Addendum. You may request a copy of these safeguards at support@finduly.com. Shopify processes data under its own terms and safeguards.

8. Your Rights

Under the GDPR you have the following rights regarding your personal data: access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection (Art. 21). To exercise them, contact us at support@finduly.com. Where we process personal data on a merchant's behalf (see Section 1), we forward requests to the responsible merchant or support them as the merchant instructs.

Right to object (Art. 21 GDPR): Where we process your data based on Art. 6(1)(f) GDPR (legitimate interests), you may object at any time on grounds relating to your particular situation. We will then stop the processing unless we demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims.

You have the right to lodge a complaint with a supervisory authority (Art. 77 GDPR), in particular in the EU member state of your habitual residence, place of work or place of the alleged infringement. The authority competent for us is the Bayerisches Landesamt für Datenschutzaufsicht (BayLDA), Promenade 18, 91522 Ansbach, Germany, www.lda.bayern.de.

Providing staff account data and shop data is necessary to use the App; without it the App cannot be provided. Using the AI Readiness Check requires processing your IP address for rate limiting. We do not use automated decision-making or profiling within the meaning of Art. 22 GDPR.

9. Changes to This Policy

We update this Privacy Policy when our data processing changes. We inform merchants of material changes, such as new purposes or recipients, in the App or by email before they take effect.

10. Contact

If you have any questions about this Privacy Policy or our data practices, please contact us at support@finduly.com.