Privacy Policy

How Workflow Functions handles personal data

Last updated: 12 August 2026

1. Controller and contact

This Privacy Policy explains how Workflow Functions ("the app") processes personal data. The app is operated by Code Creation Labs GmbH, Friedensstr. 1, 47647 Kerken, Germany (Yann Faulhaber; Amtsgericht Kleve, HRB 20472; VAT ID DE451671933).

For any data-protection question or to exercise your rights, contact us at support@codecreationlabs.com.

2. Our role: processor for the merchant

The app is installed by a Shopify merchant (the "merchant") to extend Shopify Flow. For any personal data contained in the store data and Flow payloads the merchant routes through the app, the merchant is the data controller and we act as a processor on the merchant's behalf under Article 28 GDPR. Our Data Processing Agreement is available at /avv.html.

We are the controller only for the limited account and operational data we need to run the service and to communicate with the merchant (for example the merchant's contact email, shop domain and plan, and support correspondence).

3. What we process and why

Purpose of processing: Executing merchant-defined functions (JavaScript / TypeScript) inside Shopify Flow to transform, calculate and process the data passed to them, and storing the function code and any secrets the merchant configures for those functions.

Categories of personal data: Any personal data contained in the Shopify Flow inputs the merchant passes to a function - this may include customer names, email addresses, postal addresses, order data and any custom fields the merchant includes - together with any secrets (such as API keys or credentials) the merchant stores for use by their functions.

Categories of data subjects: The merchant's customers and any other individuals whose data appears in the inputs passed to the functions; the merchant's own staff who use the app.

Legal basis: performance of the contract with the merchant and our legitimate interest in providing and securing the service (Art. 6(1)(b) and (f) GDPR). For the personal data the merchant routes through the app, the merchant determines the legal basis towards its own customers.

4. Where your data is hosted

All processing takes place in the European Union on Google Cloud, region europe-west1 (Belgium). Databases, caches and file storage are region-local, with encryption at rest.

Personal data and secrets (such as credentials and tokens) are additionally encrypted at field level using Google Cloud KMS, with separate keys, and are decrypted only in memory for the moment a request runs.

5. Sub-processors

We engage the following sub-processors to provide the service. Each is bound by a data processing agreement with obligations equivalent to ours:

Google Cloud (Google Ireland Limited) - Compute, storage and Cloud KMS key management - European Union - Google Cloud region europe-west1 (Belgium) - DPA: https://cloud.google.com/terms/data-processing-addendum
Shopify International Limited - The Shopify platform - the app receives triggers from and returns data to Shopify Flow; that data may contain personal data the merchant routes through it - Ireland (EU); Shopify operates globally, third-country transfers safeguarded under Chapter V GDPR (SCC / EU-U.S. DPF) - DPA: https://www.shopify.com/legal/dpa

6. Data retention and deletion

We keep personal data only as long as needed to provide the service. All processing history (send, run and webhook history) is automatically cleared after 30 days, and operational logs are retained no longer than 30 days.

Uninstalling the app deletes the merchant's data; on termination we delete or return all personal data processed on the merchant's behalf within 30 days, unless Union or Member State law requires storage. We honour Shopify's mandatory data-protection webhooks (customers/data_request, customers/redact and shop/redact) within the timelines Shopify specifies.

Merchants can request deletion at any time by contacting support@codecreationlabs.com.

7. International transfers

Our own infrastructure is in the EU. Where a sub-processor - in particular Shopify - processes personal data outside the EEA, the transfer is safeguarded under Chapter V GDPR, in particular the EU Standard Contractual Clauses and, where applicable, the EU-U.S. Data Privacy Framework.

8. Your rights

Subject to the applicable conditions, you have the right of access, rectification, erasure, restriction, data portability, and objection, and the right to lodge a complaint with a supervisory authority. Our lead authority is the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW).

Because we usually act as the merchant's processor, requests about a merchant's customer data are best directed to that merchant; we will assist the merchant in responding.

9. No tracking on this site

This website sets no third-party advertising or analytics cookies and embeds no third-party trackers.

10. Changes to this policy

We may update this Privacy Policy to reflect changes to the service or the law. The current version and its date are shown at the top of this page; material changes to sub-processors are notified in accordance with our DPA.

11. Our other apps

We operate other Shopify apps, each with its own privacy policy:

Workflow Webhooks: https://workflow-webhooks.app
Workflow Trigger Extensions: https://workflow-trigger-extensions.app
Workflow Transactional Email: https://workflow-transactional-email.app