Privacy Policy

Last updated: September 1, 2026

1. Introduction

Welcome to CodaScan, operated by Hackerman Barcelona Agency 42 SL. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use the CodaScan mobile app, platform services, website, and our Shopify app CodaScan Fulfillment Photos. By using our services, you consent to the practices described in this policy.

2. Information We Collect

CodaScan separates visual documentation captured in the mobile app from the account and licensing information used to provide the service. Photos and their operational metadata upload to the destination configured for each store — such as SharePoint, Shopify orders, or other supported integrations. The account service processes the information listed below.

We collect and process the following types of information:

• Account information: name, email address, company details
• Payment information: processed securely through Stripe
• License usage data: device IDs, activation timestamps, usage patterns
• Technical data: IP addresses, browser type, operating system
• Communication data: emails and support interactions

3. Shopify Fulfillment Photos app

CodaScan Fulfillment Photos is a free Shopify app that connects a merchant's store to CodaScan warehouse devices used by fulfillment teams and third-party logistics (3PL) providers. The app is hosted at shpf.getcodascan.com and installed through the Shopify admin or Shopify App Store.

3.1 Data we store in the Shopify app

To operate the Shopify integration, we store the following data in our application database:

• Shop domain (e.g. your-store.myshopify.com) and OAuth session data required to authenticate with Shopify
• Staff user details provided by Shopify during admin login (such as name, email, and user ID), where applicable
• Device pairing records: temporary pairing codes, pairing timestamps, and whether a warehouse device has been linked to the store

We do not store end-customer (buyer) personal information in the Shopify app database. Customer data requests and redaction webhooks are acknowledged; we have no buyer PII to export or delete from our app storage.

3.2 Fulfillment photos on Shopify

Proof-of-pack photos captured by warehouse staff are stored on the merchant's Shopify store, attached to orders as files and order metafields (codascan.fulfillment_photos). These images remain in the merchant's Shopify account and are subject to Shopify's own privacy and data policies.

3.3 Shopify API access

The app requests the following Shopify access scopes: write_orders and write_files, used solely to attach fulfillment photos and related metadata to orders.

3.4 Compliance webhooks and data deletion

We subscribe to Shopify's mandatory compliance webhooks:

• customers/data_request — we confirm we hold no buyer PII in app storage
• customers/redact — we confirm we hold no buyer PII in app storage
• shop/redact — we delete shop pairing records and pairing codes from our database

When the app is uninstalled from a store, we delete OAuth sessions and shop pairing data associated with that store.

3.5 Billing

The Shopify app is free to install. CodaScan warehouse platform licensing is sold separately to fulfillment providers and is not billed through Shopify for this app.

4. Legal Basis for Processing

Under GDPR, we process your data based on the following legal grounds:

• Contract performance: to provide our license management and integration services
• Legal obligation: to comply with tax, business, and platform regulations
• Legitimate interests: to improve our services and prevent fraud
• Consent: for marketing communications (where applicable)

5. How We Use Your Information

We use your information to:

• Provide and manage our license management and warehouse services
• Operate the Shopify Fulfillment Photos integration and device pairing
• Process payments and handle billing
• Send service notifications and updates
• Improve our services and develop new features
• Comply with legal obligations and platform requirements
• Detect and prevent fraudulent activities

6. Data Sharing and Third Parties

We share your data with:

• Stripe: for payment processing
• DigitalOcean: for hosting services
• Shopify: when you install or use the CodaScan Fulfillment Photos app, data flows between our app and Shopify's platform as described in section 3
• Crisp: for customer support
• SendGrid: for email communications

We do not sell your personal information to third parties.

7. International Data Transfers

Your data may be transferred to and processed in countries outside the European Economic Area (EEA). We ensure appropriate safeguards are in place through standard contractual clauses and adequacy decisions.

8. Data Security

We implement appropriate technical and organizational measures to protect your data, including encryption in transit (TLS), access controls, and regular security assessments. However, no method of transmission over the internet is 100% secure.

9. Data Retention

We retain your data for as long as necessary to provide our services and comply with legal obligations. Account data is kept for the duration of your subscription plus 12 months, or longer if required by law.

For the Shopify app: OAuth sessions and shop pairing data are retained while the app is installed. Pairing codes expire after a short period (typically 15 minutes). All shop-specific app data is deleted when the app is uninstalled or when Shopify sends a shop redact request. Fulfillment photos remain on the merchant's Shopify store until the merchant or their apps remove them.

10. Your Rights Under GDPR

You have the right to:

• Access your personal data
• Correct inaccurate data
• Request deletion of your data
• Object to processing
• Request data portability
• Withdraw consent for marketing

To exercise these rights, contact us at [email protected].

11. Cookies and Tracking

We use essential cookies to maintain your session and preferences. Analytics cookies are used only with your consent. You can manage cookie preferences through your browser settings. The embedded Shopify app uses Shopify session tokens for authentication rather than third-party cookies.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by email or through our service. Your continued use of our services after such changes constitutes acceptance of the new policy.

13. Contact Information

For privacy-related inquiries, contact our Data Protection Officer at:

If you are not satisfied with our response, you have the right to lodge a complaint with the Spanish Data Protection Authority (AEPD).