Privacy policy

WhatTheFAQ is operated by kreativkonnekt GmbH, Fuhlsbüttler Straße 421, 22309 Hamburg, Germany.

Managing directors: Michael Wanjek and Nikolas Schaffmann. Commercial register: HRB 188943, Amtsgericht Hamburg. VAT ID: DE451767536.

For privacy questions or data requests, email [email protected]. Please mention WhatTheFAQ and your Shopify store so we can direct your request to the right app.

WhatTheFAQ stores the FAQ content a merchant writes: questions, answers, groups, ordering, translations and appearance settings. It also stores a copy of the merchant's product catalog (identifiers, titles, handles, descriptions, images, categories, prices, status and market availability), their store languages and markets, so FAQs can be attached to products and shown in the right language.

It stores the Shopify access token issued when the merchant installs the app. Tokens are encrypted at rest with AES-256-GCM.

For Shopify App Pricing, it stores the shop identifier, the plan confirmed by Shopify, trial and billing-cycle dates, scheduled plan changes or cancellation, and AI credit usage. Shopify handles plan approval and payment; the app does not collect payment details.

The app does not request access to customers, orders or checkouts, and cannot read them. It holds only product, language, market, publication and theme read access plus the app proxy. No customer names, email addresses, postal addresses, payment details, order history or IP addresses are collected or stored.

When a shopper expands an answer, the app can record that an answer was opened, on which placement, and for which product. This happens only when the shopper has accepted analytics tracking through Shopify's customer privacy API; without consent nothing is sent.

The event carries a random identifier generated in the browser's session storage. It is not linked to a Shopify customer, it does not follow the shopper between sessions or stores, and it is not used for advertising or profiling. Events are deleted automatically after 90 days.

The app and its database run on servers rented from Hetzner Online GmbH in Nuremberg, Germany. Data is stored in the European Union.

Requests to the app pass through Cloudflare, Inc., which provides TLS and protection against attacks. Cloudflare sees the IP address of each request in transit; the app itself does not store IP addresses.

When a merchant uses answer polishing, suggestions or translation, the question, answer or label being processed is sent to OpenAI to produce the result. Suggested FAQs also use the selected product's catalog data and existing FAQs as context. Requests are sent with response storage disabled. No customer data is involved, because the app holds none. Merchants who do not use these features send nothing to OpenAI.

Subprocessors: Hetzner Online GmbH (hosting, Germany), Cloudflare, Inc. (network and TLS), OpenAI, L.L.C. (AI features, only when used).

The app does not sell data and does not share it for advertising.

Uninstalling the app immediately deletes the stored Shopify access token, so the app can no longer reach the store. The FAQ content the merchant wrote is kept so that reinstalling restores it, and is permanently deleted when Shopify sends its shop data erasure request (48 hours after uninstall) or, at the latest, 30 days after uninstall. Activity logs and anonymous FAQ-open counts are deleted after 90 days.

The app answers Shopify's three compliance webhooks. shop/redact, which Shopify sends 48 hours after an uninstall, deletes the workspace and the session, and that deletion cascades to the activity log, the analytics events and the background jobs for that shop. customers/data_request and customers/redact are acknowledged and have nothing to return or erase, because no customer identifiers are stored.

For privacy questions or a deletion request, contact [email protected].