[…] must be filled with real details and legally reviewed before going live.1 · Controller
The controller for data processing on this website is:
We have not appointed a separate data protection officer, as there is no legal obligation to do so. For any data protection questions, you can reach us at any time at the address above.
2 · Principles & legal bases
We process personal data only to the extent necessary to provide a functional service and our content and offerings. The legal bases are in particular:
- Art. 6(1)(b) GDPR — performance of a contract or pre-contractual measures (e.g. account, indexing orders).
- Art. 6(1)(a) GDPR — consent (e.g. optional cookies, newsletter).
- Art. 6(1)(f) GDPR — legitimate interest (e.g. secure & stable provision, abuse prevention).
- Art. 6(1)(c) GDPR — compliance with legal obligations (e.g. commercial and tax retention).
3 · Hosting & server log files
Our service is hosted by the following processors: Contabo GmbH, Aschauer Straße 32a, 81549 Munich, Germany (backend/VPS) and Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA (frontend, served via EU edge locations). On every access the system automatically collects data and information (server log files):
- IP address (shortened/anonymized where possible)
- Date and time of access
- Page / file requested
- Referrer URL
- Browser type and version, operating system
Processing is based on Art. 6(1)(f) GDPR to ensure a smooth connection setup and system security. Log files are deleted after 14 days at the latest.
5 · Account, registration & Google connection
Registration
To use the service you create an account (email + password or Google login). We process your email address, authentication data and usage data to provide the service (Art. 6(1)(b) GDPR).
Google sign-in & Search Console (optional)
If you voluntarily connect your Google Search Console, we access your verified properties and indexing status via the Google API in read-only mode to provide the service. The connection is made via OAuth; we store only the tokens necessary for the function. You can revoke the connection at any time in the settings or in your Google account. Use of Google APIs is additionally subject to Google's terms and privacy policy.
6 · Shopify integration
When you install the FastIndexing Shopify app, we process the Shopify shop domain and identity, store name, published product, collection, page and blog-article URLs and metadata, installation and session identifiers, app activity, task links, and Shopify Billing purchase identifiers and status. We use this data to discover storefront URLs, show technical evidence, create tasks only after confirmation, provide monitoring and support, and prevent abuse (Art. 6(1)(b) and (f) GDPR).
The app requests read-only access to the minimum Shopify content required for these functions. It does not request customer, order, payment-card, theme-write or checkout data. Shopify passwords and Google credentials are never stored in Shopify. Shopify sessions and the revocable FastIndexing installation token are stored server-side in encrypted form.
Purchases started inside the Shopify app are reviewed and approved through the Shopify Billing API. Stripe is used only for purchases started independently in the FastIndexing web dashboard.
After uninstall, Shopify sessions are removed and remote connection revocation is retried if necessary. A verified shop/redact request deletes the Shopify connection and related integration storage after remote erasure is confirmed. Independent FastIndexing account, task and billing records are retained only where they remain necessary for the account, contract, legal obligations or dispute handling; you may request deletion at any time via the controller address above.
7 · Indexing orders
As part of the service, we process the URLs you enter and technical information derived from them (e.g. index status, crawling signals) to perform checks, submissions, monitoring and reports (Art. 6(1)(b) GDPR). This data relates to your content; processing of third parties' personal data does not normally take place.
8 · Payment processing
Web-dashboard payments are processed via Stripe (Stripe Payments Europe, Ltd., Ireland). Purchases initiated in the Shopify app are processed through Shopify Billing (Shopify International Limited, Ireland, or the applicable Shopify entity). You enter payment data directly with the relevant provider; we do not receive card details in plain text. The legal basis is Art. 6(1)(b) and (f) GDPR. The payment provider's privacy notices apply additionally.
9 · Contacting us
If you contact us via the form or email, we process your details (name, email, message) to handle the request (Art. 6(1)(b) or (f) GDPR). The data is deleted once it is no longer needed for the purpose and no retention obligations apply.
10 · Recipients & third-country transfer
Data is only shared with processors (hosting, payment processing, email delivery) on the basis of contracts under Art. 28 GDPR or where legally permitted. Where data is transferred to third countries (e.g. the USA), we base this on appropriate safeguards (e.g. EU Standard Contractual Clauses, adequacy decision / EU-US Data Privacy Framework).
11 · Your rights
Under the GDPR you have the following rights:
- Access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18)
- Data portability (Art. 20)
- Objection to processing based on legitimate interests (Art. 21)
- Withdrawal of consent given, with effect for the future (Art. 7(3))
- Complaint to a supervisory authority (Art. 77) — competent is, among others, the Bavarian State Office for Data Protection Supervision (BayLDA).
To exercise your rights, a message to the email address above is sufficient.
12 · Storage period
We store personal data only as long as necessary for the respective purposes or as required by statutory retention periods (e.g. 6–10 years under the German Commercial Code / Fiscal Code for invoice data). After that, the data is deleted or blocked.