Privacy notice
What data the website, Shopify app and support process, who is responsible and how to contact us.
Last updated: 11 November 2026
Website, Shopify app and support
This notice covers the aiconit website and its interactive demo, the Shopify app and the handling of support enquiries. Public help is available without a staff account. The app is installed and used through Shopify; the website does not connect a store.
Who is responsible
The controller is Chamelion GmbH, Winkelriedstrasse 7, 6003 Lucerne, Switzerland, represented by managing director Olesja Becker. For privacy questions and to exercise your rights, contact us at:
Data protection representation in the EU
Our authorised data protection representative in Germany is Dirk Busshart. For processing covered by Article 3(2) GDPR, he is also our representative under Article 27 GDPR. Individuals and supervisory authorities can contact him about the processing of personal data in addition to, or instead of, Chamelion.
You can request his postal address for data protection matters using this email address.
One-time launch notification
If you sign up, we use your email address, chosen language and the timestamps and wording of your consent to send a confirmation email and, after confirmation, one launch email. Processing and email delivery use our existing IONOS services; administration takes place from Switzerland. Where the GDPR applies, this is based on consent under Article 6(1)(a). Pending registrations expire after 48 hours. You can unsubscribe at any time using the email link. Your address is deleted after withdrawal, within seven days after the launch email, or after six months without a launch. To limit abuse, short-lived pseudonymous connection identifiers are retained for at most 24 hours. Provider connection and delivery logs follow the provider’s retention rules. No tracking pixels are included.
This website
Hosting and secure operation
We host aiconit.com and the public help site with IONOS in its Europe data centre region. When you visit, your IP address, requested address, access time and browser and device information are processed to deliver the pages and protect against misuse. Images, fonts and explainer videos load directly from our website servers.
Website, app and support backups
We back up website files, the app database, and the database and necessary configuration of the private support system daily. Encrypted cloud backups are stored with IONOS in the Europe backup region; app database exports are additionally encrypted before transfer. Regular local app and support exports are limited to seven versions and seven days. Regular cloud retention is set uniformly to 12 days, without longer weekly or monthly copies. Immutable storage then retains deleted backups for an additional protected period of 14 days. The total period also accounts for deletion from the live system, the age of the exported source and technical cleanup. Stale export sources are removed from subsequent cloud backups. Support backups may contain imported messages; original Shopify images and a full mailbox backup are not included. After deletion from the live system, older data may remain in access-restricted backups until their retention periods expire. Before a restored system returns to service, intervening erasures must be reconciled. Backups are not used for day-to-day processing.
Google Analytics and Google Ads
We load Google Analytics 4 to measure page visits and successful form submissions only after your voluntary consent. If you also consent to advertising measurement, ad clicks can be linked to these events in our connected Google Ads account. The recipient is Google Ireland Limited; processing in the USA is possible. Data includes visited pages, technical browser and device information, shortened referrer addresses, cookie identifiers and, with advertising consent, ad-click identifiers. Google also technically receives your IP address; GA4 does not store individual IP addresses. We do not send email addresses, form text, confirmation tokens or our own user identifiers. Google Signals, user-provided data and personalised advertising are disabled. A recorded submission does not mean the email address has been confirmed. Event and user data are retained for two months; aggregated reports may remain longer. Processing is based on your consent, including Article 6(1)(a) GDPR where applicable. You can change your choices at any time under “Privacy settings”. Before consent and after rejection, we do not load Google measurement tags.
Demo and guide answers
Custom disclosure text, colour choices and guide answers are processed only in the open page’s memory. Our code does not transmit them or store them permanently. They reset when you reload the page. There are no AI requests or uploads of your images.
When you contact us
An email link opens your email application. When you send a message, we process information such as your name, email address, message content and technical message details to handle your enquiry and, where relevant, prepare a contract. Messages are held in the mailbox and may be imported into our private support system, which may also store handling status, assignments and internal notes. Public help does not provide access to these data. Please send only information needed for your enquiry, and never passwords or access tokens.
Purposes and legal bases
Swiss data protection law applies. Where the GDPR applies, we rely on legitimate interests under Article 6(1)(f) for secure operation and general enquiries. Article 6(1)(b) applies to pre-contractual enquiries. You do not have to complete the demo or send us personal information.
Retention and processing abroad
We generally delete routine support enquiries six calendar months after closure. Earlier statutory deletion obligations, valid erasure requests and applicable Shopify deadlines take precedence. Only specifically required contractual or accounting records and justified legal claims may warrant separate, longer retention. This covers both tickets and related mailbox copies. Technical operational and security data is retained for as long as necessary for its purpose. We administer the service from Switzerland. Service providers may also access or process data outside Switzerland and the European Economic Area. Such transfers are subject to applicable data protection law; depending on the recipient, adequacy decisions or appropriate safeguards such as standard contractual clauses apply. Further information about recipients, countries and transfers is available in the linked provider information and the section for the relevant processing activity.
External links
Links such as EU sources open in a new tab, leaving this page open. Following a link sends the destination provider the connection data needed to load its page. Its privacy information applies there. Our external links suppress the referring page address; this does not make your visit anonymous.
The Shopify app
The app and its image processing run on IONOS in the EU. The app database is hosted by Supabase in Frankfurt, Germany. The private support system, including its database, runs on our IONOS server. Chamelion administers the service from Switzerland. Support, administration and service-provider access may take place outside the EU; these storage locations therefore do not mean that all processing takes place exclusively in the EU.
People first and your label decision
When you start People first, our server temporarily processes small Shopify image previews in memory using a local detection model. No external AI analysis service is called. We store the result, image and model versions, check time and scan progress, without facial recognition, identities or image copies. The scan can be paused and continues when the app is closed. It detects possible people, not AI origin. You confirm every AI label yourself.
What the app stores
We store store domain, installation and session data, permissions and encrypted access tokens. We also store image and product associations, image addresses and versions, review decisions, changes, settings, scan results and job progress. Shopify sessions may contain staff ID, name, email and language. For plans, we process subscription status and capacity; billing is handled by Shopify. Hash values are not full anonymisation.
Which store data it accesses
The app reads image and product information to match images and display labels. Its current permissions do not allow it to retrieve orders, payment data or customer directories. File names, image addresses, alternative text, product information and image content may nevertheless contain personal data. Previews are loaded from Shopify; complete image files are not stored in our app database.
When a customer visits the store
For image notices, the store requests matching confirmed labels through Shopify. Shopify may technically forward an IP address and a customer ID for signed-in customers. Our application code does not store these details in the app database or build visitor profiles. The internal monitor retains aggregate operating figures for 48 hours without IP addresses, store identifiers, images or request contents. Alert emails contain technical incident details only.
App cookies
The app stores your chosen language and light/dark appearance in functional cookies (“chamelion-ai-labels-language” and “aiconit-appearance”) for up to 365 days. Both use HTTPS and are partitioned by embedding website; the language cookie is also inaccessible to JavaScript. Our storefront notice code sets no cookies and uses no persistent browser storage. Shopify may use its own cookies.
Our role and the store’s role
Chamelion is responsible for its own website and business contacts. Where we process personal store data for labelling on the store’s instructions, we act as a processor; the store remains responsible for its use and for informing its customers. Distribution through the Shopify App Store does not replace our privacy obligations or the necessary data processing agreements.
Deletion and retention
Reviews and settings remain stored during an active installation. After a confirmed uninstall, access is blocked and sessions, reviews and jobs are cleaned up through the deletion workflow. Shopify privacy notifications are verified and processed. Minimal technical records remain to prevent duplicate or late events. Protected backups may contain earlier data and are not used in the live store. Staff can export their own data and request its deletion in the app; other deletion requests can be sent by email.
Store customers should first contact the relevant store about their store data. For questions about the app or your own business relationship with Chamelion, contact us directly using the email address above.
Your rights
Under applicable law, you can request access, correction, deletion and, where applicable, a copy or transfer of your data. Where the GDPR applies, restriction and objection rights may also apply. You can withdraw consent you have given for future processing. Contact us at the address above. You can also contact the Swiss FDPIC or your competent data protection authority.