Privacy
Privacy policy
Skonto Pay: B2B & D2C · last updated 12 October 2026
Skonto Pay is a Shopify app by Shopfabrik Berlin GmbH, Friedrichstr. 155, 10117 Berlin, Germany (“we”). This policy explains which data the app processes when a merchant installs it, where the data is kept and how it is deleted.
Roles
For the data of a shop’s customers, the merchant is the controller and we act as a processor on the merchant’s behalf. For the merchant’s own account data (the shop’s domain and settings) we are the controller.
What the app processes
| Data | Purpose | Where it is kept |
|---|---|---|
| Shop domain, time zone, name of the Skonto payment method, plan, the app’s access token | Running the app for the shop, billing through Shopify | Our database |
| Skonto settings, including the bank details the merchant enters for its buyers | Showing the terms and bank details in checkout, on the thank-you page and on the order status page | In Shopify (shop metafield); a copy of each saved version in our audit log |
| Skonto orders: order ID and number, Skonto status, the two deadlines, the customer’s Shopify ID | Checking deadlines once a day, the limit of unpaid Skonto orders per customer, the monthly order count of the plan | Our database (no names, emails or addresses) |
| Skonto terms, status and the confirmed payment of an order | Showing the terms to buyer and staff, reducing the order after a timely payment | In Shopify (order metafields) |
| Buyer’s name, company and order contents | Read from Shopify when staff open the app or an order; shown, not stored | Not stored by the app |
| Audit log: which staff member changed the settings and when; automatic cancellations | Traceability for the merchant | Our database |
The app does not process payment card data, does not track buyers and does not use data for advertising or profiling.
Where the data is processed
- Shopify – the shop’s own platform; the app reads and writes there through Shopify’s APIs.
- DigitalOcean – our application server and database, in Frankfurt, Germany.
- Sentry (Functional Software, Inc., USA) – error reports. They contain technical details and can contain a shop domain and an order ID; they do not contain buyers’ names, emails or addresses.
How long the data is kept
- While the app is installed: records of orders that were paid or cancelled are deleted 180 days later, audit log entries after two years.
- When the app is uninstalled, the access token and the order index are deleted at once.
- 48 hours after the uninstall Shopify asks apps to erase the shop’s data; all remaining records of the shop are then deleted.
- When Shopify forwards a customer’s erasure request, the records of that customer’s orders are deleted or detached from the customer.
Rights of buyers and merchants
Buyers address requests for access, correction or erasure to the shop they bought from; the merchant forwards them through Shopify and the app answers them automatically. Merchants can contact us directly. Everyone has the right to lodge a complaint with a data protection authority.
Contact
Shopfabrik Berlin GmbH, Friedrichstr. 155, 10117 Berlin, Germany · info@shop-fabrik.net
Skonto in Shopify. No workarounds.
Skonto Pay is coming to the Shopify App Store soon. Questions about the app or the setup before then? Write to us.