Privacy Policy
Last updated: 22 October 2026
Controller
E1NSER – Sascha Eisner, Arnsteingasse 26/36, 1150 Vienna, Austria, office@einser.at. Aivio is a Shopify app for labelling AI-generated product images.
Data we process
On installation Aivio stores the shop domain, a Shopify Admin API access token, the chosen app language and the subscription status. For every label we store product ID, product title, media ID, image URL, alt text, label type and timestamps. With optional digital signing we additionally store SHA-256 hashes, the C2PA manifest, the certificate fingerprint and – for 90 days – a backup of the original file.
Shop owner contact data
Through the Shopify interface, the shop owner’s contact data (name, email address, phone number, address) is technically accessible to the app. Aivio does not store this data and only uses contact data when the merchant contacts support.
No customer data
Aivio does not process personal data of shop customers. The mandatory Shopify webhooks customers/data_request and customers/redact are acknowledged without any data being held; shop/redact deletes all shop data.
Cookies & consent
Without your consent, this website only uses technically necessary, functional storage in your browser’s local storage (localStorage): the chosen language and your cookie-consent choice itself. This storage is required to operate the website and does not require consent.
Only with your consent do we additionally activate Google Analytics 4 (see below). You can withdraw or change your consent at any time via the “Cookie settings” link in the footer of this page.
Fonts
The fonts used on this website (Inter and JetBrains Mono) are served from our own server; no connection to third-party servers (e.g. Google Fonts) is made for this.
Google Analytics 4
With your consent we use Google Analytics 4, a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”). We use Google Consent Mode v2: no analytics cookies are set and no personal analytics data is transmitted to Google until you grant consent. IP addresses are anonymised/truncated by Google before storage (IP anonymisation).
A transfer of data to the US is not excluded as part of Google’s processing; Google relies on the EU Standard Contractual Clauses (SCCs) as appropriate safeguards under Art. 46 GDPR. Retention of user and event data in our Analytics account is limited to the shortest available setting (2 months).
You can withdraw your consent at any time, with effect for the future, via “Cookie settings” in the footer.
Error diagnostics & availability
We use Sentry with EU storage for technical error events. Events contain technical error classes, sanitized stack traces, route templates, status codes and the software release. Shop domains, user data, access tokens, cookies, request bodies and full URLs are not sent as error context. Browser errors are captured only in the embedded Shopify admin; Session Replay and interaction recording are disabled. Network connections to the provider necessarily involve the IP address. Checkly checks availability, a fixed demo shop and completion of the daily backup cleanup. Sentry account and administration metadata may be processed in the US; Checkly may use international processing and a US disaster-recovery location.
Hosting & processors
| Provider | Purpose | Processing location |
|---|
| Vercel Inc. | Application hosting | Frankfurt (EU region) |
| Supabase Inc. | Database & file backups | Frankfurt (EU region) |
| Shopify International Ltd. | App platform, shop & access data | per Shopify’s data processing terms |
| Functional Software, Inc. (Sentry) | Technical error diagnostics | Error events: Frankfurt; administration metadata possibly US |
| Checkly Inc. / Checkly GmbH | Availability checks & operational alerts | EU/Ireland, Frankfurt check location; international processing possible |
| Google Ireland Ltd. | Web analytics (Google Analytics 4, consent-based only) | EU/Ireland, possibly US (SCCs) |
Purpose and legal basis
Providing the app's features (Art. 6(1)(b) GDPR), web analytics based on your consent (Art. 6(1)(a) GDPR), and supporting the merchant's transparency duties under Article 50 of the EU AI Act.
Retention
Shop data is deleted when the app is uninstalled (at the latest with the shop/redact webhook 48 hours later). Backups of original files are removed after 90 days. Sanitized technical error events without shop identifiers are retained for up to 30 days under the Sentry Developer plan.
Public provenance pages
For signed images Aivio serves a public provenance page through the shop (label, timestamps, hashes). It contains no personal data.
Your rights
Access, rectification, erasure and portability (CSV export in the app). Requests to office@einser.at. You also have the right to lodge a complaint with the Austrian data protection authority (DSB), Barichgasse 40–42, 1030 Vienna, Austria,
www.dsb.gv.at.