Privacy policy for the Shopify app.

Who we are

The Raum Visualisierer app for Shopify stores (“the app”) is provided by Roots Organics GmbH, Georg-Wulf-Str. 15, 28199 Bremen, Germany (“we”, see the imprint). Contact: anfragen@raumvisualisierer.de. This policy covers what the app processes for the merchants who install it and for the shoppers who use it in their stores. The website itself is covered by the website privacy information.

Merchants

When a store installs the app, Shopify gives us the store’s domain and an access token. We store them to run the app, together with a count of the photo analyses the store’s shoppers start (time and our estimated processing cost), which we need to apply the store’s plan. We do not store staff names or email addresses. Billing is handled by Shopify. When a store uninstalls the app, Shopify asks us 48 hours later to delete its data, and we delete all of it.

Shoppers

Sample rooms are drawn in the shopper’s browser. Nothing is sent to us.

Own room photos: when a shopper uploads a photo of a room, it is sent to our analysis service, which finds the floor and furniture and returns the result. The photo is processed in memory and not stored. If the shopper sends it from a phone by QR code, it is held in memory until the computer picks it up, at most 10 minutes.

Usage counts: the room view counts anonymous events (opened, rug shown, room changed, photo uploaded, added to cart, shared) with a random identifier kept in the browser’s local storage. We keep these events per store, with the room and the product involved and whether a phone was used, so the merchant can see in the app which rugs are viewed and added to the cart; they are deleted after 400 days, or when the store’s data is deleted. Our services do not store photos, names, orders, IP addresses or anything a shopper types. They use the IP address only in memory, to limit how many photos one visitor can analyse per day and how often events are sent. Google Cloud’s request logs record each request with its IP address; we use them only for security and troubleshooting, and they are deleted after 30 days.

Cart and products: product data comes from the store; adding to the cart goes through the store’s own Shopify cart.

We do not sell data, do not use it for advertising and do not combine it across stores.

Where and with whom

The app and the analysis service run on Google Cloud in the European Union (Belgium). Google acts as our processor. Merchants can sign our data processing agreement (Art. 28 GDPR).

Roles and legal bases

For the data of merchants and their stores we are the controller; we process it to provide the app under our contract with the merchant (Art. 6(1)(b) GDPR). Shoppers’ photos and usage counts we process on behalf of the merchant, who is the controller for their store; the data processing agreement covers this (Art. 28 GDPR). Request logs we keep for the security of our services, a legitimate interest (Art. 6(1)(f) GDPR).

Storage in the shopper’s browser

The room view keeps a few small entries in the browser’s local and session storage: the random identifiers used to count visits, the shopper’s favourite rugs, how many of their own photos they analysed today and whether the product list is open. No cookies are set and nothing is shared with third parties. Where the law of the merchant’s country requires consent for this storage, such as § 25 TDDDG in Germany, the merchant obtains it, for example with Shopify’s cookie banner.

Your rights

Shoppers and merchants can ask us about their data, have it corrected, restricted or deleted, object to its processing, receive it in a portable form, and complain to a data protection authority, for example the data protection commissioner of Bremen (Die Landesbeauftragte für Datenschutz und Informationsfreiheit Bremen). We hold nothing that links to a store’s customers, such as names, email addresses, orders or Shopify customer IDs, so requests that Shopify forwards for a store’s customers have nothing to return or delete.

Changes

When the app changes what it processes, we update this policy and the date below.

Last updated

19 October 2026