Privacy policy
Last updated 2026-10-15
This page explains what Substanza - EU Green Claims does with data: in the Shopify app, and on this website. It is written to be read, not skipped.
Who we are
Substanza - EU Green Claims is run by Pálosi Ákos, 1192 Budapest, Zalaegerszeg utca 11, Hungary. For anything in this policy, or for help with the app itself, write to support@substanza.slmail.me.
We have two roles. For your store's data that the app handles for you (products, text, documents and records), you are the controller and we are the processor. For the people who sign up on this website, and for our own server logs, we are the controller.
What we collect
In the app
- Store data we read from Shopify: product titles, descriptions, metafields and translations; store pages, blog articles and policies; theme text; the store's markets; the store's name and contact email address.
- Details we save in your Shopify store: claim status and summary fields on your products, verification fields, and a certificate type in your Custom data.
- Documents you upload as evidence (PDF, JPG or PNG, up to 20 MB), such as certificates and test reports. A certificate can name people, for example its holder or a signatory.
- Records of what happened: the claims found, the checks run, and the actions taken in the app, with the name of the staff member who took each action.
- Your email address for notifications: the store's contact email address from Shopify, or the one you choose in Settings.
- Access details you enter so the app can check your public pages: the storefront password, if your store has one, and a crawler signature, if you add one. They are stored for scanning only and are never shown again.
- Server logs: for each request, our hosting provider records the IP address, the time and the address asked for. We keep them for 7 days, for security.
We hold no data about your store's shoppers. The app does not ask Shopify for customers or orders, so there are no customer or order records to keep, return or delete. Shoppers' browsers do load the notice and label pictures from our server, so the server log in the last point holds their IP address for 7 days. Nothing else about them is kept.
On this website
- If you sign up for early access: your email address and the platform you chose. If you give your store's address, we keep that too. From your request we also keep your IP address, your browser and your approximate location (the country, and the region or city when your network provides them), and the date and the form you used.
- In your own browser: after you sign up, your browser remembers your email address and your choices in its local storage, so the page does not ask again. This website sets no cookies and runs no analytics or advertising.
Why we use it
- To check your store's text and documents for risky green claims, and to keep a record of what backs each claim. That is the purpose of the app.
- To send the emails the app promises: findings, expiring evidence and digests.
- To keep the service secure and to answer support requests.
- For the early-access list: to email you once when we launch on your platform.
We do not sell data and we do not use it for advertising.
AI checks. The app sends product text and uploaded documents to Google's Vertex AI (Gemini), on Google's EU endpoint, to read them for claims. A filter removes email addresses, phone numbers and street addresses from product text first, but it is not perfect. Uploaded documents are sent as they are, so a certificate's holder name and signature go with them. A production server never sends text or documents to an AI endpoint outside the EU: if it is set up that way, it refuses, the AI checks switch off, and the rule-based checks carry on.
Who else handles your data, and where
Every server we run is in the EU. The providers below handle data for us. Shopify keeps its own copy of your store's data and is not one of our providers.
| Provider | What it does for us | What reaches it | Where it processes |
|---|---|---|---|
| Google Cloud: Firebase App Hosting and Cloud Run | Runs the app and the storefront page renderer | Everything the app handles | The Netherlands (europe-west4) |
| Google Cloud Firestore | The database | Store data, records and settings | Poland (europe-central2) |
| Google Cloud Storage | Keeps the evidence files you upload | Your uploaded documents | Poland (europe-central2) |
| Google Cloud Tasks and Cloud Scheduler | Queue the background jobs and start the daily check | Job instructions | Belgium (europe-west1); the jobs run on our servers in the Netherlands |
| Google Vertex AI (Gemini) | AI checks of product text and documents | Product text and uploaded documents, as described above | Google's EU endpoint (the eu multi-region) |
| Google Cloud Logging | Keeps our server logs for 7 days | IP addresses, the addresses asked for, error messages | The EU (the eu multi-region) |
| Google Cloud Functions and Firebase Hosting | Serve this website and run its sign-up form | Sign-up details | The sign-up function runs in the Netherlands (europe-west4) and stores sign-ups in Poland |
| Resend | Sends the emails we send you, and the welcome email to people who sign up on this website | The recipient's email address; in notifications, the product title and the claim text; a link back to the app that carries the store's address | Resend may process these emails in the US |
| Slack | Posts each website sign-up to our team | The sign-up's email address, store address and country, and the result of the store check. Website sign-ups only: the app sends nothing to Slack | Slack stores the message in the US |
| European Commission: the EU Ecolabel register | We check a licence number against the public register | The EU Ecolabel register receives only the licence number | The European Commission, in the EU |
How long we keep it
While the app is installed, we keep your store's data and records so that the app works. When you uninstall it:
- The app stops working at once. It can no longer read your store, and nothing new is recorded.
- Shopify asks us to delete your store's data, normally about 2 days after the uninstall. We delete it then.
- If that notice does not arrive, we delete the data ourselves, no later than 23 days after the uninstall. The deadline is 22 days, and we check once a day.
- Backups and logs are gone within 30 days of the uninstall. Our logs are kept for 7 days, so a log line written on the last day of deletion is gone by day 30.
- Product details the app saved in your Shopify store stay in your Shopify store until you remove them. Shopify does not remove them when an app is uninstalled. You can delete them in your Shopify admin.
- If you install the app again, it starts fresh. Your earlier records are not brought back.
What we keep after the deletion. We keep one receipt that the deletion happened: when it ran, and counts. It holds no names and no store address. We also keep a copy of your store's compliance records, meaning what was claimed, what was checked, and when, with personal data removed (staff names, for example). That copy is kept with no end date, so that we can answer legal claims. It is kept for that purpose only.
Website sign-ups. We keep your sign-up details until you ask us to delete them.
Your rights
You can ask us to show you the data we hold about you, to correct it, to delete it, to limit how we use it, or to give it to you in a form you can reuse. You can object to our use of it. Where you asked for the early-access email, you can withdraw that at any time. Write to support@substanza.slmail.me and we will answer within one month.
For your store's data in the app, we act for you as processor. If one of your own customers or staff asks you for their data, we help you answer.
If you are not satisfied with our answer, you can complain to the data protection authority in your country. For us, that is the Hungarian authority, the National Authority for Data Protection and Freedom of Information (NAIH), naih.hu.
Changes to this policy
When what the app or this website does with data changes, we change this page and the date at the top. The date above is when it last changed.