Security & privacy

Your buyers’ data, stored in Germany and kept apart from every other shop.

Pageseal handles the names and email addresses of the people who buy your eBooks. This page says exactly what it stores, where, how it is protected and when it is deleted. Every statement describes what the app does today.

Data processing agreement (PDF) AV-Vertrag auf Deutsch (PDF)

Status: 4 November 2026.

Facts at a glance

Servers in Germany

Databases and files are stored on a Hetzner server in Nuremberg.
DPA included

Data processing agreement under Article 28 GDPR, in force from installation, as a PDF in the app.
No AI

File check and personalisation run without artificial intelligence. No profiling.
One database per shop

Every store has its own database file and folder. Requests only ever open the store that signed in.
Buyer data encrypted

Name, email address and checkout confirmation number are encrypted field by field.
Every access logged

Every access to buyer data in the app is recorded with time, action and user, and kept for 12 months.

What Pageseal stores, and what it does not

Per eBook copy

name and email address of the buyer
Shopify customer ID, order ID and order number, checkout confirmation number, language
a random invisible code and a random download link
delivery status and download history: time, IP address as a keyed hash, shortened browser user agent

Never

no postal address, no phone number, no payment data
no plain IP addresses
no tracking or advertising cookies
no artificial intelligence and no automated decisions about buyers

Where the data goes

Data is stored only in Germany. Two more services see data in transit: delivery emails are sent through Amazon SES in the EU, and every request to Pageseal passes through Cloudflare’s network. These are all the sub-processors, the same list as in the data processing agreement.

Sub-processor	What for	Location
Hetzner Online GmbHGunzenhausen, Germany	Hosting of the server, databases, files and backups	Data centre Nuremberg, Germany
Amazon Web Services EMEA SARLLuxembourg	Sending delivery emails (Amazon SES)	EU region Stockholm, SwedenUS parent company: EU-U.S. Data Privacy Framework, alternatively EU Standard Contractual Clauses
Cloudflare, Inc.San Francisco, USA	Network in front of the app’s web address: HTTPS and protection against attacks; requests, downloads and IP addresses pass through it	Cloudflare network, data centre nearest to the userEU-U.S. Data Privacy Framework, alternatively EU Standard Contractual Clauses

Shopify is your own platform, not a sub-processor of Pageseal: it sends the order to Pageseal and receives the fulfilment status.

How it is protected

Encryption in transit

HTTPS on every connection to Pageseal: the admin, Shopify webhooks, download pages and the checkout download button. Delivery emails are handed to Amazon SES over TLS.

Encryption at rest

Buyer name, email address and checkout confirmation number are encrypted field by field (AES-128 with HMAC-SHA256), as are Shopify access tokens and data request exports. The keys are not stored in the databases.

The personal eBook file shows the buyer’s name, because that is its purpose. It is deleted 30 days after the last download or when its link is blocked or expires, and rebuilt if the buyer downloads again.

Separation

Each store has its own database file and folder. Every admin request is bound to the store in the verified Shopify session token, every webhook to the store in its verified signature.

Access

Only staff of Orbita Media GmbH who run Pageseal can reach the server, with SSH keys only and a firewall. Every access to buyer data in the app (delivery list, leak search, resending a delivery email, data export, erasure) is logged without the data itself.

Backups

Hetzner backs up the whole server every day in Germany and keeps 7 versions.

Security incidents

A written procedure covers detection, containment and notice. Affected merchants are told without undue delay, at the latest within 72 hours.

When data is deleted

Deletion runs by itself: through Shopify’s mandatory privacy webhooks and a daily job with fixed periods.

Data	Deleted
Everything about one buyer	at once, when you or Shopify forward the buyer’s erasure request (customers/redact)
Everything about your store	48 hours after you uninstall Pageseal (shop/redact)Kept only: a hash of the store domain and the number of free copies used, so they are not granted twice.
Download history	12 months after the download
Access log	after 12 months
Personal eBook files	30 days after the last download, or when the link is blocked or expires
Data request exports	30 days after they were written (customers/data_request)

GDPR and US privacy law

GDPR

For your buyers’ data you are the controller and Orbita Media GmbH is your processor. The data processing agreement under Article 28 GDPR applies from installation, without signing or asking. Access and erasure requests that Shopify forwards are handled automatically: Pageseal emails you what it stores about the buyer, or deletes it.

CCPA and CPRA (California)

Pageseal acts as your service provider. As the law requires of service providers, it does not sell or share personal information and uses it only to deliver your eBooks. Deletion requests reach Pageseal through Shopify and are carried out at once. Section 11 of the agreement contains the service provider terms of Cal. Civ. Code § 1798.140(ag).

The data processing agreement, ready when you are

In force from the moment you install Pageseal; no email, no signature, no waiting.
In the app under Settings, as a PDF with your company details from Shopify, which you can complete there.
In English and German, with the technical and organisational measures and the list of sub-processors.
New sub-processors are announced by email 30 days in advance.

Download

English (PDF) Deutsch (PDF)

General version without store details. Questions: support@pageseal.app