Privacy Policy

Last updated: September 27, 2026

1. Introduction

Welcome to CodaScan, operated by Hackerman Barcelona Agency 42 SL. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use the CodaScan mobile app, platform services, website, and our Shopify app CodaScan Fulfillment Photos. By using our services, you consent to the practices described in this policy.

2. Information We Collect

CodaScan separates the visual documentation captured in the mobile app from the account and licensing information used to provide the service. Photos and their operational metadata are designed to upload directly to the connected provider destination selected by the customer. The account service processes the information listed below.

We collect and process the following types of information:

• Account information: name, email address, company details
• Payment information: processed securely through Stripe
• License usage data: device IDs, activation timestamps, usage patterns
• Technical data: IP addresses, browser type, operating system
• Communication data: emails and support interactions

3. Shopify Fulfillment Photos app

CodaScan Fulfillment Photos is a free Shopify app that connects a merchant's store to CodaScan warehouse devices used by fulfillment teams and third-party logistics (3PL) providers. The app is hosted at shpf.getcodascan.com and installed through the Shopify admin or Shopify App Store.

3.1 Data we store in the Shopify app

To operate the Shopify integration, we store the following data in our application database:

• Shop domain (e.g. your-store.myshopify.com) and OAuth session data required to authenticate with Shopify
• Staff user details provided by Shopify during admin login (such as name, email, and user ID), where applicable
• Device pairing records: temporary pairing codes, pairing timestamps, and whether a warehouse device has been linked to the store

We do not store end-customer (buyer) personal information in the Shopify app database. Customer data requests and redaction webhooks are acknowledged; we have no buyer PII to export or delete from our app storage.

3.2 Fulfillment photos on Shopify

Proof-of-pack photos captured by warehouse staff are stored on the merchant's Shopify store, attached to orders as files and order metafields (codascan.fulfillment_photos). These images remain in the merchant's Shopify account and are subject to Shopify's own privacy and data policies.

3.3 Shopify API access

The app requests the following Shopify access scopes: write_orders and write_files, used solely to attach fulfillment photos and related metadata to orders.

3.4 Compliance webhooks and data deletion

We subscribe to Shopify's mandatory compliance webhooks:

• customers/data_request — we confirm we hold no buyer PII in app storage
• customers/redact — we confirm we hold no buyer PII in app storage
• shop/redact — we delete shop pairing records and pairing codes from our database

When the app is uninstalled from a store, we delete OAuth sessions and shop pairing data associated with that store.

3.5 Billing

The Shopify app is free to install. CodaScan warehouse platform licensing is sold separately to fulfillment providers and is not billed through Shopify for this app.

4. Legal Basis for Processing

Under GDPR, we process your data based on the following legal grounds:

• Contract performance: to provide our license management and integration services
• Legal obligation: to comply with tax, business, and platform regulations
• Legitimate interests: to improve our services and prevent fraud
• Consent: for marketing communications (where applicable)

5. How We Use Your Information

We use your information to:

• Provide and manage our license management and warehouse services
• Operate the Shopify Fulfillment Photos integration and device pairing
• Process payments and handle billing
• Send service notifications and updates
• Improve our services and develop new features
• Comply with legal obligations and platform requirements
• Detect and prevent fraudulent activities

6. Data Sharing and Third Parties

We share your data with:

• Stripe: for payment processing
• DigitalOcean: for hosting services
• Shopify: when you install or use the CodaScan Fulfillment Photos app, data flows between our app and Shopify's platform as described in section 3
• Crisp: for customer support
• SendGrid: for email communications

We do not sell your personal information to third parties.

7. International Data Transfers

Your data may be transferred to and processed in countries outside the European Economic Area (EEA). We ensure appropriate safeguards are in place through standard contractual clauses and adequacy decisions.

8. Data Security

We implement appropriate technical and organizational measures to protect your data, including encryption in transit (TLS), access controls, and regular security assessments. However, no method of transmission over the internet is 100% secure.

9. Data Retention

We retain your data for as long as necessary to provide our services and comply with legal obligations. Account data is kept for the duration of your subscription plus 12 months, or longer if required by law.

For the Shopify app: OAuth sessions and shop pairing data are retained while the app is installed. Pairing codes expire after a short period (typically 15 minutes). All shop-specific app data is deleted when the app is uninstalled or when Shopify sends a shop redact request. Fulfillment photos remain on the merchant's Shopify store until the merchant or their apps remove them.

10. Your Rights Under GDPR

You have the right to:

• Access your personal data
• Correct inaccurate data
• Request deletion of your data
• Object to processing
• Request data portability
• Withdraw consent for marketing

To exercise these rights, contact us at [email protected].

11. Cookies and Tracking

We use essential cookies to maintain your session, language, and cookie preferences. The codascan_analytics_consent cookie stores your analytics choice for up to six months. The embedded Shopify app uses Shopify session tokens for authentication rather than third-party cookies.

If you accept analytics, Google Analytics measures visits, acquisition sources, and product actions such as account creation and purchases. Google Analytics is not loaded before you accept. Its first-party _ga cookies are configured to expire after no more than six months. Advertising storage, advertising user data, advertising personalization, and Google Signals remain disabled.

You can change or withdraw your choice at any time using the persistent “Cookie settings” control. Withdrawing consent stops further collection and removes the Google Analytics cookies available to this website from your browser.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by email or through our service. Your continued use of our services after such changes constitutes acceptance of the new policy.

13. Contact Information

For privacy-related inquiries, contact our Data Protection Officer at:

If you are not satisfied with our response, you have the right to lodge a complaint with the Spanish Data Protection Authority (AEPD).