Privacy policy
Last updated · 11/06/2026
1. Data controller
The controller responsible for personal data collected via www.kodaswap.com is:
- Denis ZHENG (KodaSwap)
- 14 rue Olympe de Gouges, 92600 Asnières-sur-Seine, France
- Email: [email protected]
2. Data collected and purposes
| Data collected | Purpose | Legal basis | Retention |
|---|---|---|---|
| First name, last name, business email, company, phone (demo form) | Process your demo request and follow up | Pre-contractual measures (GDPR art. 6.1.b) | 3 years from last contact |
| Navigation data (Google Analytics) | Measure audience and improve the Site | Consent (GDPR art. 6.1.a) | 14 months maximum |
| IP address, server logs | Security and proper operation of the Site | Legitimate interest (GDPR art. 6.1.f) | 12 months |
No sensitive data (within the meaning of GDPR Article 9) is collected.
3. Data recipients
Your data is processed by Denis ZHENG and may be transmitted to the following processors, acting solely on instructions:
- Scaleway SAS — hosting, data stored in the EU
- Google Ireland Limited — Google Analytics (see transfers outside the EU)
- Calendly LLC — demo booking (see transfers outside the EU)
Your data is never sold, rented or transferred to third parties for commercial purposes.
4. Transfers outside the European Union
The use of Google Analytics and Calendly involves transfers of data to the United States (Google LLC and Calendly LLC). These transfers are governed by the Data Privacy Framework (European Commission adequacy decision of 10 July 2023) and by standard contractual clauses.
5. Your rights
Under the GDPR and the French Data Protection Act, you have the following rights:
- Access: obtain a copy of your data
- Rectification: correct inaccurate data
- Erasure ("right to be forgotten")
- Restriction of processing
- Objection to processing
- Portability of data
- Withdrawal of consent at any time
- Define instructions for the use of your data after death
To exercise these rights, email [email protected] with proof of identity. We will respond within one month maximum.
In case of disagreement, you may lodge a complaint with the CNIL (French data protection authority): www.cnil.fr — 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France.
6. Security
Data is stored on servers located in the European Union, secured by TLS encryption, access controls and regular backups.
7. Changes
This policy may be updated. The date of the last modification appears at the top of the document.
8. KodaSwap Shopify App
This section supplements the policy above and applies specifically to the KodaSwap app installed by merchants on their Shopify store. For the personal data of the merchant's customers processed in this context, the merchant is the data controller and KodaSwap acts as a processor (GDPR Article 28), on the merchant's instructions and solely for the purposes of managing returns, exchanges and refunds.
8.1 Data processed via Shopify
| Data | Source | Purpose |
|---|---|---|
| Order number, items, prices, discount codes, country | Shopify API (orders) | Let the customer select items to return and compute the refund |
| Customer name and email | Shopify API / widget | Identify the request and communicate with the customer (status emails) |
| Postal address and phone (exchanges) | Entered by the customer in the widget | Generate the return or reshipment label |
| Photos of returned items | Uploaded by the customer | Allow the merchant to assess the condition of items |
| Product catalog, variants, inventory | Shopify API | Offer exchanges and restocking |
| Tracking number, pickup point, carrier | Carrier APIs | Track the return parcel |
KodaSwap never accesses customers' payment (card) data: any payments (exchanges with a price difference) are made directly through Shopify's secure checkout.
8.2 Permissions requested from Shopify
At installation, the app requests only the access required for it to function:
- Read orders — display items eligible for return
- Read/write orders and draft orders — refunds, exchanges and payment links
- Read products and inventory — exchange catalog and restocking
- Read customers — name and email needed to process the request
- Store credit — issue a refund as store credit
- Script tag — display the return widget on the storefront
8.3 App processors
Within the app, data may be processed by the following processors, acting solely on instructions:
- Scaleway SAS — application hosting, database and storage of labels and return photos, European Union
- Amazon Web Services (Amazon SES) — sending transactional emails, Paris region (eu-west-3)
- Carriers (Colissimo / La Poste, Mondial Relay, Chronopost) — label generation: receive the customer's name, address and phone
- Cloudflare, Inc. — technical delivery of the widget (content delivery network)
- Shopify (Shopify Billing) — billing of the merchant's subscription only (no customer return data passes through it)
8.4 Hosting and location
App data is hosted within the European Union. Your data is never sold, rented or transferred to third parties for commercial purposes.
8.5 Security
Data is exchanged over TLS encryption. Carrier credentials and access tokens are encrypted at rest (AES-256-GCM). Access to data is restricted, controlled and logged, with regular backups.
8.6 Retention
As a guideline, and unless the merchant instructs otherwise:
- Return requests and associated data are kept for the duration of the merchant's subscription, then up to 3 years for accounting and evidentiary purposes.
- Photos uploaded by the customer are deleted 90 days after the return is closed.
- If the app is uninstalled, all store data is deleted within 60 days.
- A customer's erasure request is processed within 30 days at most.
8.7 Access requests, erasure and compliance webhooks
In line with Shopify's requirements and the GDPR, KodaSwap handles requests issued automatically via Shopify's mandatory compliance webhooks:
- Customer data request ("customers/data_request") — return of the data held about a customer
- Customer data erasure ("customers/redact") — deletion of a customer's data
- Shop data erasure ("shop/redact") — deletion of data after uninstall
Any direct request may be sent to [email protected]. End customers exercise their rights with the merchant, who is the data controller and whom KodaSwap assists in its capacity as a processor.