Privacy Policy

Appdesh (operated by Revnous, "we", "us", or "our") takes your privacy seriously. This Privacy Policy explains how we collect, use, and protect your personal data when you use our website, waitlist, and platform.

1. Data Controller

The Data Controller responsible for processing your data under the General Data Protection Regulation (GDPR) is:

• Name: Irfan Ahmed
• Company: Revnous
• Address: Henriette-Herz-Allee 9, 13057 Berlin, Germany
• Email: hello@revnous.com

2. Our Role: Data Controller vs. Data Processor

• As a Data Controller: We are the Controller for the personal data belonging to you (the App Founder), such as your name, email, account preferences, and billing information.
• As a Data Processor: When you connect your Shopify Partner API credentials to Appdesh, you (the App Founder) act as the Data Controller for your merchants' and customers' data. Appdesh acts strictly as a Data Processor (or Sub-processor) for that data. Our handling of Shopify API data is governed entirely by our Data Processing Agreement (DPA) and not by this policy.

3. Data We Collect (As a Controller)

We collect information you provide directly to us, as well as metadata generated during your use of the platform:

• Waitlist & Registration: Name, email address, business name, and Shopify app URL.
• Account & Authentication: Account credentials, configurations, and API integration keys (e.g., Shopify Partner API credentials, Slack OAuth tokens).
• Usage & Analytics Data: IP address, browser type, device details, and interaction data detailing how you use the Appdesh dashboard.

4. Purpose and Legal Basis for Processing

We process your personal data under the following legal bases:

• Consent (Art. 6(1)(a) GDPR): For processing waitlist signups, marketing communication, and non-essential cookies.
• Performance of a Contract (Art. 6(1)(b) GDPR): To set up your account, deliver platform features, and manage your integrations.
• Legitimate Interests (Art. 6(1)(f) GDPR): To secure our platform, detect bots, optimize performance, and improve our services.

5. Third-Party Services & Sub-processors

We share data with trusted third-party service providers who operate under strict data processing instructions. To maximize privacy compliance, we utilize EU-native hosting and endpoints wherever possible:

• Mixpanel (Product Analytics): We utilize Mixpanel's dedicated EU-data region. All product analytics data remains strictly hosted within the European Union.
• Crisp (Live Chat): Provided by Crisp IM SARL (France), ensuring EU-based user support data storage.
• Cloudflare Turnstile (Bot Detection): Used to secure forms and prevent spam.
• Google Analytics: Used strictly on our public marketing site to understand traffic trends.
• Slack Technologies: Used to deliver operational alerts to your workspace via your established OAuth configurations.

6. International Data Transfers

While we prioritize EU localization (such as our Mixpanel EU setup), some of our global service providers (e.g., Slack, Google) may process metadata or routing information outside the European Economic Area (EEA), primarily in the United States. We ensure these transfers are legally protected by relying on recognized legal frameworks, including the EU-US Data Privacy Framework or standard contractual clauses (SCCs).

7. Data Retention

We retain your personal account data only as long as your Appdesh account remains active. If you request the deletion of your account, we will permanently delete or anonymize your personal data within 30 days, except where legal, financial, or tax retention obligations (e.g., under German commercial law) require us to hold it longer.

8. Your GDPR Rights

As an EU resident, you hold the following rights regarding your personal data:

• Right of access (Art. 15 GDPR)
• Right to rectification (Art. 16 GDPR)
• Right to erasure ("Right to be forgotten") (Art. 17 GDPR)
• Right to restriction of processing (Art. 18 GDPR)
• Right to data portability (Art. 20 GDPR)
• Right to object to processing (Art. 21 GDPR)

To exercise any of these rights, please contact us at hello@revnous.com. You also possess the right to lodge a formal complaint with a data protection supervisory authority (such as the Berlin Commissioner for Data Protection and Freedom of Information).