Privacy Policy — Social Media Live Counter. This page is ready
Last updated: 21 October 2026
Information about data processing in the Social Media Live Counter Shopify app.
BasecapStudio — Vincent Sahl (sole proprietor), Händerlstraße 9, 38304 Wolfenbüttel, Germany. Email: info@vincent-sahl.de. Phone: +49 176 41980885.
This notice describes our processing in connection with the Social Media Live Counter Shopify application and its public app pages. Shopify merchants may separately be controllers for processing of their storefront visitors' data. The allocation of responsibilities depends on the processing activity.
Through Shopify authentication and API access, we process the store domain, granted access scopes, installation and subscription status, access tokens, Shopify session identifiers, and, where supplied by Shopify, merchant/staff identifiers, names, email addresses, locale and related account metadata.
We store settings for widgets, connected social accounts, plan and billing status, metrics, and configuration. Shopify handles subscription billing; we do not collect payment-card details through this app. Requests to our servers can also produce technical access and security logs, potentially including IP address, request time and user-agent.
Purposes include authentication, app operation, providing subscriptions and support, preventing misuse and troubleshooting. Legal bases are GDPR Art. 6(1)(b) for contractual services with individual merchants, Art. 6(1)(f) for legitimate business interests where appropriate, and Art. 6(1)(c) for statutory duties. For staff or representatives of business customers, Art. 6(1)(f) may apply.
If a merchant authorizes a supported social-network connection, we process the authorized social account identifier/name and relevant public or account-authorized performance statistics (for example followers, likes, views, posts and page metrics). We store OAuth access tokens, and refresh tokens where issued, plus validity, scope and account metadata to retrieve and update these figures.
The code includes connections to Meta/Facebook and Instagram and to Pinterest. The interface may also support manually entered numbers or links for other platforms; manually entered metrics do not necessarily involve API access to the named platform. Connecting an external account redirects the merchant to the provider's authorization service, which processes information under its own privacy notice.
For Meta and Pinterest API activity, network providers may process data outside the EEA. We do not use the permissions to read private messages or publish posts on a merchant's behalf.
Widgets display social account links and metrics in participating Shopify storefronts. If a merchant activates Growth analytics, the storefront script measures impressions (after a widget has been visible for approximately three seconds) and clicks on social platform links. The event includes its type and, for clicks, the platform identifier; the request is associated with the store via Shopify's authenticated app proxy.
For impression deduplication, the script writes a random 128-bit identifier and its expiry into the visitor browser's localStorage, under the key smc_impression_window_v2. The browser identifier is reused for a 30-minute window and transmitted with impression events. The server stores this identifier temporarily for deduplication and aggregates event counts by store, date/month and event type/platform. A housekeeping routine can remove temporary deduplication identifiers older than two days if that routine is scheduled and runs successfully. This is not a general deletion schedule for Growth statistics.
Requests to the app proxy can expose IP address and browser headers to the storefront infrastructure, Shopify and our host even where these fields are not written to the analytics tables. The implementation does not intentionally store a visitor's name or email in analytics records.
Growth analytics is optional for merchants, but that setting alone is not visitor consent. Under section 25 TDDDG, non-essential access to or storage in browser localStorage normally requires valid visitor consent before the tracking script accesses storage or sends optional measurement events. Merchants must ensure that an appropriate consent mechanism prevents this optional tracking until valid consent exists; technical consent enforcement is not implemented in this storefront tracking code; merchants must ensure that legally required visitor consent is obtained and enforced before optional tracking occurs. Where applicable, subsequent processing is based on consent under GDPR Art. 6(1)(a), which can be withdrawn with future effect. Simply enabling the merchant setting must not be treated as a substitute for consent.
The optional floating bar additionally uses localStorage under the key smc-floating-bar-dismissed to remember a visitor-initiated dismissal (indefinitely or for one day, depending on merchant settings). The necessity and consent requirements of this storage must be evaluated separately. The use of social widgets and links itself does not mean that a Meta advertising pixel, Google Analytics or another third-party marketing script is automatically loaded by this app. Third-party destinations may process visitor data when a visitor follows a social link.
Shopify provides the application platform, authentication, billing integrations, app proxy and parts of the storefront delivery. The application and its MySQL database run on a rented server hosted by STRATO, according to the operator's production setup. STRATO supplies the hosting infrastructure; the operator administers the application and database. The exact data-centre location, backup configuration and relevant data-processing agreement must be checked against the STRATO contract.
Relevant social-network operators (notably Meta for Facebook/Instagram and Pinterest) receive data when API access is authorized and performed. Technical service providers may process connection and log information to operate and secure the service. We do not sell personal data.
We do not assert that Google Analytics or Meta Pixel is active in this application: deployment-specific integrations and marketing pages must be assessed separately, and this notice updated if those tools are actually used.
Some providers may process personal data outside the EU/EEA. Where such transfers are governed by the GDPR, we assess applicable adequacy decisions (including certified recipients under the EU-US Data Privacy Framework where relevant) or appropriate safeguards such as standard contractual clauses, together with supplementary safeguards when required. Specific safeguards and recipient locations must be verified against actual production service agreements; contact us for available details.
Social connection records and tokens are generally required while the corresponding connection or app is active. On Shopify app uninstallation and on shop-data erasure events, the app invokes deletion of shop data, related social account tokens, sessions and settings. Actual deletion also depends on operational success, backups, and provider retention rules; legally mandatory records may remain as required by law.
Growth analytics keeps daily and monthly aggregated counts and temporary impression identifiers. Temporary identifier records can be removed by the separate two-day housekeeping routine if scheduled. No periodic automatic deletion of the aggregated Growth statistics is configured in the reviewed code. The shop-associated records are intended to be removed when the app is uninstalled or a shop-erasure request is processed. Records linked to a shop are subject to shop deletion. Browser localStorage entries expire logically after 30 minutes, though they can remain physically present until overwritten or cleared by the visitor.
Server/security logs, provider backups and statutory accounting documents can have different retention periods. We determine these periods by necessity and legal obligation and can provide more detail on request. Do not interpret this section as a promise that every copy is deleted within 30 days.
Depending on applicable law, you have rights to access, rectification, erasure, restriction, portability, objection to processing based on legitimate interests and withdrawal of consent without affecting earlier lawful processing. You may also lodge a complaint with a competent data protection supervisory authority.
Contact info@vincent-sahl.de to exercise rights or ask about data processing. Storefront visitors may also contact the relevant merchant about the merchant's use of the widget. Shopify mandatory privacy webhooks are configured for shop/customer data requests and deletion; the current app does not intentionally collect customer identity records from Shopify's customer/order APIs.
We apply access controls and transport security and limit application access to needed functions. No internet service can guarantee absolute security. We may update this notice when features, providers or legal requirements change; the revision date above identifies this version.