Privacy Policy

Last updated: November 8, 2026

1. General Information

Protecting your personal data is of the highest importance to us. This Privacy Policy explains what data we collect, how we use it, and what rights you have under the EU General Data Protection Regulation (GDPR).

2. Controller

KPIHelm – Alter Günes Pechleraustr. 15 83308 Trostberg, Germany Email: support@kpihelm.com

3. Types of Data Processed

We process:

Contact data (name, email)
Account & usage data (login data, settings)
KPI and marketing analytics data provided by users
Technical data (IP address, browser information, device information, logs)
Data from integrations (e.g., Shopify) when a user connects external services (details in Section 7)
Advertising performance data from connected ad platforms (details in Section 8)

4. Purpose of Processing

Providing KPIHelm functions and services
Analytics, reporting, and optimization of digital performance indicators
Customer communication, support, and maintenance
IT security, error management, and fraud prevention
Compliance with legal requirements

5. Legal Bases

GDPR Art. 6(1)(b) – performance of the contract (providing KPIHelm, accounts, reports, notifications)
GDPR Art. 6(1)(c) – legal obligations (e.g., retention of commission and accounting records)
GDPR Art. 6(1)(f) – legitimate interest (IT security and logging; anonymization of report data for benchmarks, see Section 6a)

Our website does not use analytics or tracking tools and sets no tracking cookies.

6. Data Retention

We keep personal data only as long as it is needed for the purposes above, and delete it automatically:

Shopify store data (reports, AI texts, daily measurements, settings): while the KPIHelm app is installed; deleted about 48 hours after uninstalling (Shopify's data deletion request), at the latest within 30 days.
Web panel accounts (email address, organization, team and store labels): while you use the account. If you have not signed in for 12 months, we email you; if you do not sign in within 30 days of that email, we delete the account.
Platform connections and access tokens: deleted immediately on uninstall or disconnect; we also revoke our access at the advertising platform.
SUYLA notification cards marked as handled: 90 days after being handled.
Temporary job data: 7 days. Team invitations: 7 days.
Server and security logs (IP address, browser information): 14–30 days.
Backups: 90 days.
Commission and accounting records of referral partners: 10 years (statutory retention).

A daily automated check verifies that data past its retention period has actually been deleted.

6a. Storage, Processing and Anonymization of User Data

All processing takes place server-side within KPIHelm's infrastructure on AWS in the European Union (Frankfurt, eu-central-1).

To build industry benchmarks, we create an anonymous copy of report data once a calendar month has ended. Only anonymous data is kept long-term:

each record receives a new random identifier and contains no store name, domain, account or request identifier, and no date finer than the month;
all numbers, including those in AI-generated texts, are reduced to two significant digits;
a month is only included if at least five different stores generated reports in it; the country is kept only if at least five stores of the same industry are from that country (otherwise only the region or no location is kept).

Anonymous data cannot be linked back to a store or a person and is therefore not personal data (Recital 26 GDPR).

7. Shopify App / Shopify Integration

The KPIHelm Shopify App is active and available on the Shopify App Store.

7.1 Data Processed

If a user installs the KPIHelm Shopify App, we process:

Store information (store domain, country and currency of the store)
Order financial values (order totals, taxes, currency) for the selected period
Whether an order's landing page carried an advertising click tag (presence only; the URL and tag values are not stored, except the Google Ads campaign ID, which is counted per campaign)
Performance and marketing metrics provided by the merchant or connected ad platforms
Metadata related to app usage

Protected Customer Data — Data Minimization

KPIHelm requests order data at the minimum access level and does not collect, process, or store customer personal fields (such as name, address, email, or phone number). No product data is read. No individual customer is identified or profiled. In short: KPIHelm never collects or stores customer details — only your sales metrics.

7.2 Purpose

Syncing data between Shopify and KPIHelm
Providing analytics and performance insights
Improving app features

7.3 Data Deletion upon Uninstall

Upon uninstall:

Connections to advertising platforms are deleted immediately, and our access is revoked at the platforms (Meta, Google Ads, TikTok)
All other store data — including the store's entry in an agency's web dashboard — is deleted when Shopify sends its data deletion request, about 48 hours after uninstalling, at the latest within 30 days

7.4 Merchant Rights

Shopify merchants may:

Request a copy of their stored data
Request deletion at any time

Contact: support@kpihelm.com

7.5 AI Processing

To write narrative report texts, KPIHelm sends performance data to its AI service provider Anthropic (USA): KPIs and their deviation from industry benchmarks, store revenue and costs entered by the merchant, the industry, the reporting period, and the language. No store name, domain, campaign or product names, customer data, or other identifiers are transmitted. The transfer is based on Standard Contractual Clauses (see Section 11).

8. Advertising Platform Integrations (Meta, TikTok, Google Ads)

KPIHelm allows users to connect their advertising accounts (currently TikTok for Business, Meta (Facebook/Instagram) Ads, and Google Ads) so that advertising performance data can be retrieved automatically instead of being entered manually.

8.1 Connection and Authorization

Connections are established via the official OAuth authorization flow of the respective platform. KPIHelm receives an access token limited to the scopes the user has explicitly granted (for example, read-only access to advertising performance data such as Meta's ads_read permission). KPIHelm never receives or stores the user's platform password. Access tokens are stored encrypted within our infrastructure and are used exclusively to retrieve the data described below.

8.2 Data Retrieved

From connected advertising accounts, KPIHelm retrieves only advertising performance data, such as:

Campaign, ad set, and ad level performance metrics (e.g., impressions, clicks, CTR, CPM, spend, conversions, ROAS)
Account and campaign metadata (e.g., campaign names, ad account identifiers) required to attribute metrics correctly

KPIHelm does not retrieve or process personal data of the end users or customers who see or interact with the advertisements (no audience lists, no individual user profiles, no contact details).

8.3 Purpose and Legal Basis

The retrieved data is used solely to generate diagnostic reports, performance analyses, and growth signals for the connecting user. The legal basis is contract performance (GDPR Art. 6(1)(b)), as data retrieval is initiated by the user connecting their account.

8.4 Disconnecting

Users can disconnect a platform at any time within KPIHelm. On disconnection, KPIHelm revokes its access at the platform where the platform offers this (Meta, Google Ads and TikTok), and the stored access token is deleted. Users can additionally revoke KPIHelm's access in the settings of the respective platform.

8.5 Security of Processing (Technical and Organizational Measures)

We protect all sensitive data — including advertising performance data retrieved from connected platforms such as Google Ads, Meta, and TikTok — with the following technical and organizational measures:

Encryption in transit: All data is transmitted exclusively over TLS/HTTPS, both between your browser and KPIHelm and between KPIHelm and platform APIs (including the Google Ads API).
Encryption at rest: OAuth tokens and platform credentials are stored in encrypted form on AWS infrastructure (AWS Secrets Manager and encrypted databases in the EU Frankfurt region, eu-central-1). Refresh tokens are never exposed to the browser and are never stored client-side.
Access control: Access to production systems follows the least-privilege principle. Advertising data is only ever displayed to the authenticated user who owns the connected account; no other user or third party can access it.
Data minimization: We retrieve only the campaign performance metrics required to generate reports, for the reporting period selected by the user (see Section 8.2). Deletion and disconnection rights are described in Sections 8.4 and 9.

8.6 Google API Services — Limited Use Disclosure

KPIHelm's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Google user data is used solely to provide the reporting features visible to the user within KPIHelm. It is never sold, never transferred to third parties except as necessary to provide these features (see Section 10), never used for advertising purposes, and never used to train generalized machine-learning models.

9. Data Deletion

You can request the deletion of your personal data at any time:

Shopify App: Uninstalling the KPIHelm app triggers the deletion described in Section 7.3.
Advertising platform connections: Disconnecting a platform (Section 8.4) deletes the token and revokes our access.
Deletion request by email: Write to support@kpihelm.com. We complete the deletion within 30 days, unless statutory retention obligations apply. Backups are overwritten within 90 days.

Data is shared only with carefully selected processors bound by data processing agreements:

Amazon Web Services (hosting, storage, email delivery via Amazon SES) — EU region Frankfurt
Anthropic (AI-generated report texts) — performance data only, see Section 7.5

Shopify and the advertising platforms you connect are not our processors; data is retrieved from them on your instruction.

11. International Transfers

Data is processed in the EU. Exceptions: report data sent to Anthropic (USA), and security logs of our content delivery network processed by AWS in the USA. Both transfers are based on Standard Contractual Clauses (Art. 46 GDPR).

12. User Rights

Under the GDPR, you have the following rights:

Right of access
Right to rectification
Right to erasure
Right to restriction of processing
Right to data portability
Right to withdraw consent
Right to lodge a complaint with a supervisory authority

13. Contact

For data protection inquiries: support@kpihelm.com

We have not appointed a data protection officer because the legal requirements for one (Art. 37 GDPR, § 38 BDSG) are not met. The competent supervisory authority is the Bavarian Data Protection Authority (BayLDA), Ansbach.