Privacy policy
Last updated: 31 October 2026
We keep only the data our apps need to work, we do not sell data, and we do not track your customers across sites. This page explains what we process, why, for how long, and who helps us.
1. Who we are
Controller under the GDPR for this website and for the data merchants give us when they use our apps:
Mercurio Labs, Levent YakinPaulsborner Straße 91, 10709 Berlin, Germany
hello@mercuriolabs.app
We are not required to appoint a data protection officer. Questions about privacy go to the address above.
2. This website
Hosting and server logs
This website runs on Cloudflare. When you open a page, your browser sends technical data: IP address, date and time, page requested, referrer, browser and operating system. Cloudflare processes this to deliver the page and to protect it from attacks. Legal basis: Art. 6 (1) (f) GDPR (our interest in a secure, working website). We do not combine this data with other sources and do not use it to identify you.
Cookie settings and analytics
This website sets no cookies and currently uses no analytics or advertising tools. When you make a choice in the cookie banner, we store that choice in your browser's local storage (key mercurio-cookie-consent), so we don't ask again. This storage is necessary to respect your choice (Section 25 (2) TDDDG). Should we add analytics later, they will only run if you allow them under "Cookie settings" in the footer, and we will name the provider here. Fonts are served from our own domain, so no request goes to a font provider.
If you write to us, we use your email address and message to answer you. Legal basis: Art. 6 (1) (b) GDPR when your request relates to a contract, otherwise Art. 6 (1) (f) GDPR. We delete the correspondence when it is no longer needed, unless statutory retention periods apply (for example six or ten years for business letters and invoices under German commercial and tax law).
3. Mercurio Art Wall
Mercurio Art Wall is a Shopify app. Merchants install it in their Shopify store; their customers use it on the storefront to plan a gallery wall.
Data about merchants
| Data | Purpose | Kept until |
|---|---|---|
| Shop domain, access token, granted permissions, and the name, email and locale of the staff member who opened the app, as provided by Shopify | Sign-in to the app and access to the store's products, collections and discounts through the Shopify API | Uninstall; all shop data is deleted 48 hours after uninstall when Shopify sends its deletion request |
| App settings: chosen products, sizes, frames, rooms, design, texts, plan, margins | Running the designer as configured | As above |
| Set discounts created by the app | Showing the offer in the designer | As above |
Legal basis: Art. 6 (1) (b) GDPR (providing the app under our terms). Billing is handled entirely by Shopify; we never see payment details.
Data about the store's visitors
For data about visitors of a merchant's store, the merchant is the controller and we process data on the merchant's behalf (Art. 28 GDPR). Merchants can request our data processing agreement at hello@mercuriolabs.app.
| Data | What happens | Kept until |
|---|---|---|
| Wall photo taken in the browser | Stays in the visitor's browser. It is not uploaded to us. | Not stored by us |
| Wall photo sent from a phone via QR code | Stored briefly so the visitor's computer can pick it up, then deleted | Pickup, at most 20 minutes |
| Usage events: "wall built" and "wall added to cart", with layout, number of pictures, product titles and cart value | Statistics for the merchant in the app. No IP address, no customer ID, no cookie. | 400 days |
| The visitor's last wall, saved in the browser's local storage | Lets the visitor continue where they left off. It stays on their device and is never sent to us. | Until the visitor clears it or starts over |
The app does not read or store customer accounts, orders of individual customers, email addresses or payment data. Adding a wall to the cart uses the store's own Shopify cart.
Shopify privacy requests
We answer Shopify's mandatory privacy webhooks. Because we keep no customer records, a customer data request or deletion request finds no personal data with us. A shop deletion request removes all data of that shop.
4. Service providers
| Provider | Role | Location and safeguards |
|---|---|---|
| Cloudflare, Inc., San Francisco, USA | Hosting of this website and the app, database and file storage, receiving email for hello@mercuriolabs.app | Data processing agreement; Cloudflare is certified under the EU-U.S. Data Privacy Framework; Standard Contractual Clauses |
| Shopify International Ltd., Dublin, Ireland | Platform the app runs in, app billing | EU company; Shopify's own privacy policy applies to the store and its checkout |
| Apple Distribution International Ltd., Cork, Ireland | Mailbox our email is forwarded to (iCloud Mail) | EU company; Apple is certified under the EU-U.S. Data Privacy Framework |
We do not pass data to anyone else unless the law requires it.
5. Your rights
You have the right to access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21). Write to hello@mercuriolabs.app. If you are a customer of a store that uses our app, please contact that store first; it decides about your data and we support it.
You may also complain to a supervisory authority, for example ours: Berliner Beauftragte für Datenschutz und Informationsfreiheit, Alt-Moabit 59–61, 10555 Berlin.
6. Changes
We update this policy when our apps or providers change. The date at the top shows the current version.