Privacy policy

For getfondo.app and the Fondo Shopify app. Last updated: 26 October 2026. Deutsche Fassung

1. Who we are

kreativkonnekt GmbH, Fuhlsbüttler Str. 421, 22309 Hamburg, Germany. Managing directors: Michael Wanjek, Nikolas Schaffmann. Email: hi@getfondo.app. More in our legal notice.

2. Our two roles

For a merchant's account, their team and visits to getfondo.app, we are the controller under the GDPR. The data of a store's customers, however, we process on the merchant's behalf (Art. 28 GDPR): the merchant decides what Fondo uses it for and is responsible for it. Merchants can request a data processing agreement at hi@getfondo.app.

3. Visiting getfondo.app

Our server records technically necessary details of each request (IP address, time, address requested, browser). We use them to provide and secure the service (Art. 6(1)(f) GDPR) and delete them once they are no longer needed for that.

We only set strictly necessary cookies: to keep you signed in, to remember your language, and for the moment you connect Fondo to Shopify or Klaviyo. There are no analytics, advertising or tracking cookies.

4. Merchant accounts and teams

• Name, email address, password (stored only as a hash), team role and the connected stores.
• Purpose: providing the account, sending invitations and password links by email, and support (Art. 6(1)(b) GDPR).
• We keep this data while the account exists and delete it afterwards, unless the law requires us to keep it.

5. Connecting Shopify

When a merchant installs Fondo in their store, Shopify shares details of the store (name, domain, currency, time zone) and an access token, which we store encrypted. Billing runs through Shopify; we never receive payment details.

6. Store customers' data (on the merchant's behalf)

• Shopify customer ID, language and, where Shopify shares them, name and email address; orders with their amounts; store credit, its transactions and expiry dates; membership tier; referral codes; a birthday the customer chose to give; their loyalty email preference.
• Purpose: running the merchant's loyalty program (cashback, store credit, tiers, referrals, reminders).
• Requests and deletion go through Shopify's privacy webhooks: Fondo answers the access and deletion requests Shopify forwards, and deletes all of a store's data after it uninstalls Fondo, once Shopify asks for it.

7. Integrations a merchant switches on

• Klaviyo (Klaviyo, Inc., USA): Fondo sends events (such as “credit added”) and profile properties (balance, tier, language) to the merchant's Klaviyo account and creates email templates and flows there. Klaviyo sends the emails under the merchant's own agreement with Klaviyo.
• Judge.me and Shopify Flow: Fondo receives reviews, or sends events, when the merchant connects them.
• Apple Wallet and Google Wallet (Apple Inc. and Google LLC, and their European companies): when a customer adds their credit card to a wallet, the card shows their balance and tier and is updated through Apple or Google.

Loyalty emails contain a link to unsubscribe from them. When an email is opened, the email client may load fonts from Google Fonts and images from our servers or Klaviyo's.

8. Service providers

• netcup GmbH, Karlsruhe, Germany: servers and database.
• Spaceship, Inc. (Spacemail), USA: sending our system emails (invitations, password links, notifications).

We have data processing agreements with these providers. Where data is processed outside the EU/EEA, we rely on appropriate safeguards under Art. 44 ff. GDPR, such as the EU Standard Contractual Clauses.

9. Security

All connections are encrypted (TLS). Access tokens for Shopify and Klaviyo are additionally stored encrypted.

10. Your rights

You have the right of access, rectification, erasure, restriction of processing, data portability and objection (Art. 15–21 GDPR), and you can withdraw a consent at any time. Write to us at hi@getfondo.app. If you are a customer of a store, it is best to contact the store first; we support it in answering you.

You can lodge a complaint with a data protection authority, for example the one responsible for us: Der Hamburgische Beauftragte für Datenschutz und Informationsfreiheit, Ludwig-Erhard-Str. 22, 20459 Hamburg, Germany.

11. Changes

We update this policy when Fondo or the law changes. The version published here applies.