Privacy Policy and Data Processing Agreement

1. Controller Information

The operator of Hivebee is:
Rankskipper GmbH
Döblinger Hauptstraße 82/2A
1190 Vienna
Austria
Email: hello@hivebee.ai
Website: https://hivebee.ai

PART A - PRIVACY POLICY

2. General Information

Hivebee is an AI-powered product search, recommendation, and analytics solution for Shopify merchants.

Hivebee processes data only to provide its services, including product search, product recommendations, order attribution, conversion analytics, and performance reporting.

For customer data processed through Shopify, the merchant acts as the Data Controller, and Hivebee acts as the Data Processor under Article 28 GDPR.

3. Data Processed by Hivebee

Hivebee processes only the data necessary to operate the app.

Product and Collection Data

Hivebee may process:

• Product names
• Product descriptions
• Product IDs
• Product variants
• Product prices
• Product images
• Product categories
• Collections

This data is used to index the product catalog, provide search results, generate recommendations, and improve product discovery.

Hivebee does not modify product data, inventory, descriptions, tags, collections, or metafields.

Order Data

Hivebee processes only the following order-related fields:

• Order Number
• Product ID(s)
• Order Total Value
• Currency
• Fulfillment Status

This data is used solely for order attribution, conversion analytics, and performance reporting.

Hivebee does not access or store payment data.

Customer Data

Hivebee may process:

• Customer Name
• Customer Email Address

This data is used only to associate orders placed through Hivebee-powered experiences with the corresponding customer.

Customer data is not used for marketing purposes.

4. Data Hivebee Does Not Access

Hivebee does not access or store:

• Shipping addresses
• Billing addresses
• Phone numbers
• Credit card data
• Bank details
• Payment information
• Government IDs
• Dates of birth

Hivebee only accesses the minimum data required to provide its services.

5. Search Queries and Interaction Data

When customers use Hivebee-powered search or recommendations, Hivebee may process:

• Search queries
• Product clicks
• Product interaction events
• Recommendation events

This data is used only to provide search functionality, recommendations, analytics, and performance reporting.

6. No Sharing with Third-Party AI Providers

Hivebee does not send customer data, order data, product catalog data, search queries, or merchant data to third-party AI providers.

In particular, Hivebee does not transmit such data to:

• OpenAI
• Anthropic
• Google Gemini
• Meta AI
• DeepSeek
• Mistral AI
• Cohere
• Any other external AI provider

All processing takes place within Hivebee's controlled infrastructure or through contracted service providers.

7. No AI Model Training

Hivebee does not use merchant data, customer data, order data, product catalog data, search queries, or analytics data to train AI or machine learning models.

Hivebee does not sell, license, or share such data for AI training purposes.

8. Hosting and Infrastructure

Hivebee's website and application infrastructure are hosted on Amazon Web Services.

Provider:
Amazon Web Services EMEA SARL
38 Avenue John F. Kennedy
L-1855 Luxembourg

Hivebee uses AWS servers located in Germany within the European Union.

9. Data Retention and Deletion

Hivebee stores data only as long as necessary to provide the service and fulfill contractual or legal obligations.

Upon app uninstallation or receipt of a valid deletion request, personal data is deleted or anonymized, generally within seven (7) days.

10. Shopify Privacy Compliance

Hivebee implements Shopify's required privacy compliance webhooks, including:

• Customer Data Requests
• Customer Data Erasure Requests
• Shop Data Erasure Requests

Hivebee processes such requests in accordance with Shopify requirements and applicable privacy laws.

11. Security Measures

Hivebee applies appropriate technical and organizational measures to protect personal data, including:

• SSL/TLS encryption
• Encrypted data storage
• Role-based access controls
• Access restrictions
• Firewalls and network protection
• Security monitoring
• Regular software updates
• Backup and recovery procedures
• Access logging

PART B - DATA PROCESSING AGREEMENT

12. Purpose of this Data Processing Agreement

This Data Processing Agreement forms part of the contractual relationship between the Shopify merchant using Hivebee and Rankskipper GmbH as the provider of Hivebee.

This agreement governs the processing of personal data by Hivebee on behalf of the merchant in accordance with Article 28 GDPR.

13. Roles of the Parties

The Shopify merchant is the Data Controller.

Hivebee, operated by Rankskipper GmbH, is the Data Processor.

Hivebee processes personal data only on behalf of the merchant and only for the purposes described in this Privacy Policy and Data Processing Agreement.

14. Subject Matter of Processing

The subject matter of processing is the provision of AI-powered product search, product recommendations, analytics, order attribution, and performance reporting for Shopify merchants.

15. Duration of Processing

The processing begins when the merchant installs or activates Hivebee and continues for as long as the merchant uses the service.

After app uninstallation or termination of the service, Hivebee deletes or anonymizes personal data, unless legal retention obligations require further storage.

16. Nature and Purpose of Processing

Hivebee processes personal data for the following purposes:

• Providing product search functionality
• Generating product recommendations
• Indexing product catalog data
• Measuring search performance
• Measuring recommendation performance
• Attributing orders to Hivebee-powered experiences
• Providing conversion analytics
• Creating merchant performance reports
• Maintaining technical operation and security of the service

Hivebee does not process data for its own marketing purposes.

Hivebee does not use personal data for AI model training.

17. Categories of Personal Data

Hivebee may process the following categories of personal data:

• Customer names
• Customer email addresses
• Order numbers
• Product interaction data
• Search queries
• Technical event data related to search and recommendations

Hivebee does not process sensitive personal data within the meaning of Article 9 GDPR.

18. Categories of Data Subjects

The data subjects may include:

• Customers of Shopify merchants
• Visitors of Shopify storefronts using Hivebee-powered search or recommendations
• Merchant users or administrative contacts

19. Instructions from the Merchant

Hivebee processes personal data only on documented instructions from the merchant.

The merchant's instructions are provided through:

• Installation and configuration of the Hivebee app
• Shopify permissions granted by the merchant
• Contractual agreements
• Valid deletion or access requests
• Written instructions sent to Hivebee

Hivebee will not process personal data for purposes outside the scope of these instructions.

20. Confidentiality

Hivebee ensures that all persons authorized to process personal data are bound by confidentiality obligations.

Access to personal data is restricted to authorized personnel who require access to provide, maintain, or secure the service.

21. Technical and Organizational Measures

Hivebee implements appropriate technical and organizational security measures, including:

• Encryption of data in transit
• Secure hosting on AWS infrastructure in Germany
• Restricted internal access
• Role-based permissions
• Secure authentication procedures
• Logging and monitoring
• Regular system updates
• Backup and recovery processes
• Measures to prevent unauthorized access
• Measures to protect against accidental loss, destruction, or damage

These measures are reviewed and updated where necessary.

22. Subprocessors

Hivebee may use subprocessors to provide the service.

Current subprocessors include:

Hivebee does not use third-party AI providers as subprocessors for processing customer data, search queries, order data, or product catalog data.

Hivebee will ensure that subprocessors are subject to appropriate data protection obligations.

23. International Data Transfers

Hivebee aims to process personal data within the European Union.

Hivebee uses AWS servers located in Germany.

If any international data transfer becomes necessary, Hivebee will ensure that appropriate safeguards are in place, such as Standard Contractual Clauses or other legally recognized transfer mechanisms.

24. Assistance with Data Subject Rights

Hivebee assists merchants, where reasonably possible, in responding to data subject requests, including requests for:

• Access
• Correction
• Deletion
• Restriction of processing
• Data portability
• Objection

Hivebee also supports Shopify privacy compliance webhooks for customer data requests and deletion requests.

25. Deletion and Return of Data

Upon termination of the service, app uninstallation, or valid deletion request, Hivebee will delete or anonymize personal data unless legal obligations require continued retention.

Data deletion is generally completed within seven (7) days.

26. Personal Data Breach Notification

If Hivebee becomes aware of a personal data breach affecting merchant or customer data, Hivebee will notify the affected merchant without undue delay.

Hivebee will provide reasonable information available at the time, including:

• Nature of the incident
• Categories of affected data
• Likely consequences
• Measures taken or proposed
• Contact point for further information

27. Audits and Compliance

Hivebee will make available information reasonably necessary to demonstrate compliance with this Data Processing Agreement.

Audits may be conducted upon reasonable prior notice and only to the extent required under applicable data protection law.

Audits must not compromise the security, confidentiality, or availability of Hivebee's systems or other merchants' data.

28. Merchant Responsibilities

The merchant is responsible for:

• Having a valid legal basis for processing customer data
• Informing customers about the use of Hivebee
• Maintaining an appropriate privacy policy for the Shopify store
• Ensuring that Shopify permissions are granted lawfully
• Responding to customer privacy requests as Data Controller

29. No Sale of Personal Data

Hivebee does not sell personal data.

Hivebee does not share personal data for advertising networks, third-party profiling, or AI training purposes.

30. Contact for Privacy and Data Processing Requests

For privacy-related questions, deletion requests, or requests regarding this Data Processing Agreement, please contact:
Rankskipper GmbH
Döblinger Hauptstraße 82/2A
1190 Vienna
Austria
Email: hello@hivebee.ai