As of November 11, 2026UM Payments sets the order in which a Shopify store's checkout shows its payment methods, hides or shows payment methods by rules and renames them. For that the app stores almost nothing: no customer data, no orders, no tracking.Go to the legal notice of UBARTAS.MEDIA GmbHUBARTAS.MEDIA GmbH, Nicolaiweg 4b, 59494 Soest, Germany. Represented by Andrei Ubartas. Email: apps@ubartas.mediaThe store's address (…myshopify.com) and the access tokens from Shopify, encryptedPurpose: So the app can create and change the payment customization in checkout on the store's behalfHow long: Until uninstall, then deleted immediatelyID, topic and store of every notification Shopify sends to the appPurpose: So a notification that Shopify delivers twice is processed only onceHow long: 7 daysServer logs (time, requested address) and technical error reports without personal dataPurpose: Operations and securityHow long: Short termThe legal basis is the performance of the contract with the merchant (Art. 6(1)(b) GDPR), and for server logs and error reports our legitimate interest in secure operation (Art. 6(1)(f) GDPR).The order and the rules a store sets up are not stored by the app but at Shopify, on the payment customization in the store. The test run on the app's home page calculates in the browser and stores nothing.At checkout, a Shopify Function of the app checks the store's rules. It runs at Shopify and sees what a rule needs: the cart (amount, product tags, whether it holds gift cards or subscriptions), country, language and the chosen delivery method, and for signed-in customers their tags, their number of orders and the amount they have spent in the store. It does not read name, address, email address or phone number. The function has no network access: none of this leaves Shopify, none of it reaches the app's server, none of it is stored. How Shopify itself handles this data is described in Shopify's privacy policy: privacy.shopify.comIt stores no data about the store's customers: no names, email addresses, postal addresses or phone numbersIt has no access to orders; it may only read and write payment customizationsIt stores no personal data of staff: it signs in for the store, not for a personNo pixel in the store, no tracking cookies, no analytics tools, no ad networksWhen the app is uninstalled, it deletes the access tokens immediately; Shopify removes the payment customization together with the app. 48 hours later Shopify sends the request to delete all of the store's data; the app then deletes it completely, unless it has been reinstalled in the meantime. In the server's backups, deleted data is kept for up to 14 more days and is then deleted there as well.Shopify, because the app creates the payment customization through Shopify's API. The server is located in Germany; the hosting provider processes data on our behalf under a contract according to Art. 28 GDPR. Technical error reports go to an error tracker that we run ourselves on the same server. No one else.You have the right of access, rectification, erasure, restriction of processing, data portability and objection (Art. 15 to 21 GDPR). An informal email is enough. You can also lodge a complaint with a supervisory authority; the competent one is the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia. apps@ubartas.mediaUBARTAS.MEDIA GmbH, Nicolaiweg 4b, 59494 Soest, GermanyRepresented by Andrei Ubartas, managing directorCommercial register: Amtsgericht Arnsberg, HRB 14703VAT identification number according to § 27a UStG: DE359381550Email: apps@ubartas.media