Privacy Policy

The controller under Article 4(7) GDPR is:

Controller

Ibrahim Ölmez (nouz, Einzelunternehmen)support@nouz.co

We have not appointed a Data Protection Officer, because the size and nature of the processing does not require one under Article 37 GDPR. For anything privacy related, write to support@nouz.co and a person reads it.

2.1 Account data

For your account we collect and store:

• Email address, for signing in, for the verification code, for transactional messages such as receipts, and for the reports and alerts you choose to receive.
• Password, stored only as a salted hash by our authentication provider, Supabase. We never see it in plain text.
• Your name, if you add it to your profile, so we can address you by it.
• Store settings you configure, such as the store name and the time your nightly sync runs. Your currency and time zone are read from Shopify rather than typed.
• Messages you write to us in nouz (Support, Messages), with the screenshots you attach (at most three a message), the team you wrote to, which store and page a conversation began from unless you remove that line, who in your workspace wrote each message, and when you read our replies (we see a read mark). Your workspace's members can read its messages, and so can the people at nouz who answer support. An AI assistant run by Anthropic (section 3) helps us answer. It drafts replies that a person at nouz reads before sending, and where we switch it on for Customer success or Tech help it may answer first itself. The replies it sends itself are always marked as AI, and a person at nouz reads every conversation. For this it receives the words of your workspace's conversations with us and the first name of the person who wrote, never the screenshots and nothing about your store. Anthropic may not use them to train its models. Messages sent with the earlier support form in the app are kept as closed conversations. We also keep messages you send by email to support@nouz.co. If you turn on Email me replies for a conversation, we email you when a reply has waited unread for a few minutes, from no-reply@nouz.co, with a one-click link to turn it off.
• Feature requests: when you ask us for something nouz does not do yet, in a chat, on a call or in a message, we may note your name, your workspace and your words beside that idea on our internal list, so we can weigh what to build and tell you when it ships. Only the people at nouz can see that list.
• How you heard about nouz, only if you answer the optional question at the end of setup: one answer picked from a short list (ChatGPT, another AI assistant, Google, the Shopify App Store, a recommendation or something else), never free text, stored with the time you gave it.

Legal basis: Art. 6(1)(b) GDPR, necessary to perform the contract. For the optional answer on how you heard about nouz: Art. 6(1)(f) GDPR, our legitimate interest in knowing which channels bring merchants to nouz. For a feature request from someone who is not a customer: Art. 6(1)(f) GDPR, our legitimate interest in deciding what to build and telling you when it ships.

2.2 Your store data

Once you connect your shop, nouz reads the figures it needs to build your profit and loss statement. Access is read only: nouz never creates, changes or deletes an order, a product, a price, a customer or a setting in your shop.

• From Shopify: orders and their line items, prices, discounts, taxes and shipping charges; refunds and returns; payment transactions, the gateway that processed them and the fee Shopify reports on a Shopify Payments payment; products, variants, SKUs, prices, weights and inventory levels, including stock on its way; Shopify's numeric customer id on each order (see 2.3); the number of visits your store receives each day and your Shop Campaigns ad spend per campaign and day, where Shopify grants access to them; for an order in another currency, the amounts Shopify itself converted into your store currency; and shop settings such as currency and time zone.
• From your ad accounts, if you connect them: daily spend per account and campaign from Meta, Google and TikTok. We read spend figures, not audiences and not creatives.
• From you: the cost rules that turn revenue into profit (unit costs, product weights and packaging sizes, shipping rate cards, pick and pack rates, packaging, return processing, packaging levies, payment gateway fees and your overhead); marketing spend you enter by hand or import from a CSV file; and the settings you save, such as margin targets, lead times, forecast goals and scenarios, report schedules and your store's logo.

This data is stored under your account. It is never sold, never shared with another customer, and never used to train machine learning models.

Legal basis: Art. 6(1)(b) GDPR, necessary to perform the contract.

2.3 What we keep about your customers

2.4 Billing data

When you start a trial or a subscription we store your plan, its status, the trial end date and whether it has been cancelled. What else we hold depends on who bills you:

• Billed through Shopify, when you install nouz from the Shopify App Store: your shop's domain and Shopify's id for the subscription. Shopify is the billing processor here, for billing data only: it charges the plan on your Shopify invoice and collects the payment, so we receive no payment details and no billing address.
• Billed by us directly: your billing name, billing address, country and VAT ID where you give one; your Stripe customer id and subscription id; and invoice metadata: amounts, VAT rate, VAT country, reverse charge flag and the payment method fingerprint.

Card numbers, expiry dates and security codes are collected and stored by Stripe directly and never reach our servers. We only ever see the last four digits, for display.

Legal basis: Art. 6(1)(b) GDPR (contract performance) and Art. 6(1)(c) GDPR (legal obligation, invoice retention under §132 Bundesabgabenordnung).

2.5 Logs and technical data

• Server access logs: IP address, user agent, timestamp and requested URL, kept for up to 30 days for security and abuse prevention.
• Abuse limits: the forms that sign you in or send email, and a few other endpoints, count requests per IP address so they cannot be used to flood inboxes or the service. Each count covers at most a day and is deleted within two days.
• Error reports sent to Sentry, scrubbed of user identifiers where technically possible.
• Sync logs: which source was synced, when, how many records arrived and any error returned. These are about your store, not about a person.

Legal basis: Art. 6(1)(f) GDPR, our legitimate interest in keeping the service secure and diagnosable.

2.6 Cookies and analytics

Strictly necessary, set without asking because the service needs them to work and to keep the choices you make in it:

• Supabase authentication cookies, which keep you signed in.
• Short-lived cookies that secure the connection to Shopify while it is being set up, which expire within 30 minutes.
• Cookies that remember choices you make in the app: the store or stores you are looking at, how your P&L is laid out, and whether the sidebar is open.
• A cookie that records your analytics choice, so we do not ask again.

Legal basis: Art. 6(1)(b) GDPR and §165(3) TKG 2021, strictly necessary.

Page view and click statistics, without cookies: Vercel Web Analytics counts how often the pages of this website and of the product are opened, so we can see which pages are read and which are never found, and how often a few buttons are used: starting the free trial, booking a call, downloading a template, using a calculator, and creating an account. It sets no cookie and stores nothing on your device. With each page view or click it records the time, the page's address with any query string or fragment removed, the referring website, your approximate location (country, region and city), and your browser, operating system and device type. A click also records which of those buttons it was and where on the page it sits; for an account, only whether it was created on this website or from the Shopify App Store, never your email address. It tells one visit from another only by a hash of the request that is discarded after 24 hours, and nothing it records is tied to your account or to your IP address. We see aggregated counts, never an individual visitor.

Legal basis: Art. 6(1)(f) GDPR, our legitimate interest in knowing which pages and buttons are used, so we can improve them.

Product analytics, only with your consent: PostHog, for measuring how the product is used: which pages are opened, what is clicked, where a flow is abandoned, and recordings of the screen (session recordings). In recordings all text on the screen is replaced before it leaves your browser, so no amount, count or percentage is recorded, charts are left out entirely, and nothing you type is recorded either. The data travels through nouz's own domain and is stored in PostHog's EU region in Frankfurt. Until you consent, no analytics script captures anything and no analytics cookie is set. You can change your choice at any time in Settings → Profile; withdrawing stops the recording at once and deletes PostHog's cookie and stored data on that device.

We run no advertising pixels and no cross-site tracking on the product or on this website, and we send nothing about your business to an advertising network.

Legal basis: Art. 6(1)(a) GDPR and §165(3) TKG 2021, consent.

2.7 Data from Google

If you connect Google Ads, nouz receives a credential for the Google Ads API and uses it to read two things: the Google Ads accounts your Google login can access, with each account's id, name and currency, and the daily cost of each campaign, with its name, in the accounts you choose to sync. We receive nothing else from your Google account: not its email address, not your contacts and nothing from any other Google service. nouz never creates, changes or deletes anything in your Google Ads account.

We use this data only to show your marketing costs wherever nouz shows them: your profit and loss statement, Insights, the emails and reports you set up, and your exports. The credential is encrypted at rest and never sent to the browser. The spend figures are stored with the rest of your store data in the EU, and are shared only with the sub-processors in section 3, which run the service, and with the recipients you add to your own reports.

We do not sell this data or transfer it to advertising platforms, data brokers or other resellers, and we do not use it to serve ads, to judge creditworthiness or for lending, or to train machine learning models. No person at nouz reads it unless you ask us to, for example in a support request, or unless that is necessary to investigate a bug or abuse, or to comply with the law.

nouz's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

You can disconnect Google Ads at any time in Settings → Integrations. When you disconnect the last account connected through a Google login, nouz deletes that login's credential. You can also revoke nouz's access from your Google account at myaccount.google.com/permissions. Spend already imported stays in your history and is kept as described in section 5.

Legal basis: Art. 6(1)(b) GDPR, necessary to perform the contract.

2.8 People you invite or send reports to

When you invite someone to your workspace, we store their email address and the role you chose, and send them the invitation, which expires if it is not accepted and is deleted if you withdraw it. When you add recipients to a custom report, we store their email addresses and send each of them that report on the schedule you set. Recipients need no account, and every report email carries a link that removes the address from the report at once.

Legal basis: Art. 6(1)(f) GDPR, your legitimate interest and ours in delivering the invitations and reports you ask us to send to the people you choose.

2.9 People nouz calls

nouz calls businesses that sell through Shopify, to offer them nouz. If we have called your business, or plan to, this clause is about you.

Where your details come from: from public sources, mostly your shop's own website, read by us or by a tool we run for this: its legal notice (Impressum), its contact page and its storefront. From there we note:

• The shop's name and website, the company's name, register number and VAT ID, and the business address.
• The phone number and email address the business publishes, and the name and role of the owner or managing director where the legal notice gives them.
• Facts about the store itself, as its storefront shows them: the apps and theme it uses, the countries it ships to, its price range, how many collections it has, and where it stands in a public ranking of websites by visits.

If you asked us to call you, the details come from you. When we call, we add when we called and how it went, the notes the caller takes, the answers you give (for example roughly how many orders your store has and which tools you use), a time you asked us to call back and, if you agree to a meeting, the name and email addresses Calendly needs to send the invitation. On the first call we tell you where we found your number and that you can object.

These records are stored in our database in Frankfurt and only the people at nouz who make the calls can see them. A caller's note can be tidied up by Anthropic's AI (section 3): it receives the note and the first name of the person we spoke to, nothing else from our records, and may not use them to train its models.

You can object at any time, on the call or by writing to support@nouz.co, and we stop calling. We then erase everything that names or reaches you: names, numbers, email addresses, the address and the notes. We keep only a one-way fingerprint of the phone number, the email address and the website (a keyed hash from which they cannot be read back), so that a later list can never bring them back into our records, and the bare fact that calls took place, for our own counts. If you never object, we erase the details 2 years after our last call, or 2 years after we noted your business if we never called, unless your business became a nouz customer.

Legal basis: Art. 6(1)(f) GDPR, our legitimate interest in offering nouz to businesses (direct marketing, Recital 47 GDPR). Where you asked us to call you: Art. 6(1)(b) GDPR, steps taken at your request before entering into a contract.

2.10 How you use nouz, and what our team sees

Usage counts: so we can help you set up nouz and notice when someone gets stuck, the app counts, for each signed-in person and each day, how often each area of nouz was opened (Overview, P&L, Forecast, Insights, Costs, Inventory, Settings and Support) and the times of day it was in use. While nouz is open in a browser tab you are looking at, the tab tells our server once a minute that it is still open and which area is on screen; we keep only the latest of these per person, so we can see who is using nouz right now. With them we note the store you are looking at, whether the device is a phone or a computer (from the browser's user agent) and, at the start of a visit, whether you came from the Shopify admin, from this website or from elsewhere. No figure, nothing on the page, nothing you type and no click is recorded, no cookie is set and nothing is stored on your device.

What our team sees: to support your account, the people at nouz who look after customers can see these usage counts, your plan and its charges, which costs and connections you have set up, the health of your syncs, and from your Shopify data your orders, net revenue, average order value and returns by month. They never see marketing spend or a figure that contains it (contribution margin 3 and EBITDA), because those contain data from Google (2.7). Every time someone at nouz opens a workspace's page, our audit log records it.

Legal basis: Art. 6(1)(f) GDPR, our legitimate interest in supporting your account and improving nouz. You can object at any time by writing to [support@nouz.co](mailto:support@nouz.co); we then stop counting for you and delete the row that shows you as active.

We use the following sub-processors to run the service. All are bound by a data processing agreement under Article 28 GDPR, and none of them may use your data for their own purposes.

Shopify, for App Store billing. If you install nouz from the Shopify App Store, Shopify is the billing processor: it charges your subscription on your Shopify invoice and collects the payment on our behalf. For this it handles billing data only, meaning the plan your store is on, its status and its charges, under the Shopify Partner Program Agreement and its own privacy policy. We send Shopify none of your store data.

Separately, nouz reads data from the platforms you connect. You choose which of these to connect and you can disconnect any of them at any time. We hold an access credential for each connection and use it only to read the figures listed in section 2.2.

We do not sell or rent your data to anyone, and we have no advertising business that could benefit from it.

Your account, your store data and your cost rules are stored in the European Union, in Frankfurt. The application is served from the same region.

Where a sub-processor's contracting entity sits outside the EU or the EEA, that transfer is covered by EU Standard Contractual Clauses under Article 46 GDPR, or by an adequacy decision under Article 45 GDPR where one applies. We will name the mechanism for any individual sub-processor on request.

• Account, store and cost data: for as long as your account exists.
• When you ask us to delete your account: we delete it, with all of its store data, within 30 days of your request, except the invoices and billing events the law makes us keep (below). The app has no button for this yet, so write to support@nouz.co from the address you sign in with.
• After you uninstall the nouz app in Shopify: Shopify tells us 48 hours later, and we then delete the orders, refunds, payments, daily figures and exports synced from that store. Delete store data, in Settings under Store, does the same at once. Either way the cost rules you entered, your product catalogue with its costs and your advertising spend stay in your account, so a reconnect does not start from nothing, until you ask us to delete them or the account.
• Invoices and billing events: 7 years, as required by §132 Bundesabgabenordnung. We cannot delete these earlier.
• Businesses we call: until the business objects, and then erased at once, keeping only the fingerprints described in 2.9; otherwise 2 years after our last call, or after we noted the business if we never called, unless it became a customer. The fingerprints stay for as long as nouz makes such calls, because they are what keeps a person who objected from being called again.
• Server access logs: up to 30 days.
• Page view and click statistics: the hash that tells one visit from another is discarded after 24 hours; the counts kept after that identify nobody.
• Usage counts: 13 months; the row that shows a person as using nouz right now, one day after its last update.
• Messages in nouz, with their screenshots: for as long as your account exists, and deleted with it. A screenshot attached to a message that was never sent is deleted after a day. The AI assistant's drafts and our notes on how it answered are kept with the conversation and deleted with it.
• Support messages sent by email, and the copies of messages from the earlier support form that reached our support inbox: up to 2 years after the last message in the thread.
• Feature requests: for as long as your account exists. For a business we call, as long as its other records (2.9). For anyone else, we keep the idea but remove your name and words 2 years after we noted them.

Under the GDPR you have the right to:

• Access (Art. 15), a copy of the personal data we hold about you.
• Rectification (Art. 16), correction of anything inaccurate.
• Erasure (Art. 17), deletion of your data, subject to the retention obligations above.
• Restriction (Art. 18), a pause on processing.
• Portability (Art. 20), your data in a structured, machine-readable format.
• Objection (Art. 21), to processing based on legitimate interest.
• Withdrawal of consent at any time, where processing rests on consent.

You do not have to ask us to exercise the portability right: the app carries a full account export that gives you every dataset it holds, on every plan, at any time. Portability is a right, so it is never something we charge for.

To have your account and everything in it deleted, write to support@nouz.co from the address you sign in with: the app has no button for that yet, and we delete it within 30 days. The owner of a workspace can delete one store's synced data at any time, in Settings under Store.

For anything else, write to support@nouz.co. We answer within 30 days.

You may also complain to a supervisory authority. The Austrian one is:

Datenschutzbehörde

Barichgasse 40-421030 WienAustriadsb.gv.at

Measures under Article 32 GDPR, in plain terms:

• Every table carries row level security, scoped to your organisation, so one customer's query cannot reach another customer's rows.
• The credentials for Shopify, Meta, Google and TikTok are encrypted at rest, decrypted only on the server at the moment of a call, never sent to the browser and never written to a log.
• All traffic runs over TLS: between your browser and nouz, between nouz and the platforms you connect, and between our servers and the database.
• Data at rest is encrypted by our database provider, Supabase.
• The Shopify connection requests read-only scopes, so even a compromised credential could not change your shop.
• Payment details never reach our servers at all: Shopify holds them for App Store billing, and Stripe for direct billing.

nouz is a tool for people running a business. We do not knowingly collect data from anyone under 16. If you believe a minor has created an account, tell us and we will delete it.

When we make a material change we notify you by email and update the date at the top of this page. The current version is dated 14 Oct 2026. Continuing to use the service after a change means you accept the updated policy.